@usepowerplant/cli 0.4.20 → 0.4.22

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9f447c4d-0ccb-5f45-8960-6853e28aadfb")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="91b4b5e6-fdd5-5127-9372-913ad2bc7af5")}catch(e){}}();
 const __cliNodeMajor = Number(process.versions.node.split('.')[0]);
 if (__cliNodeMajor < 20) {
   console.error(`powerplant needs Node 20 or newer — this is Node ${process.versions.node}.`);
@@ -23886,7 +23886,7 @@ var require_mock_interceptor = __commonJS({
 var require_mock_client = __commonJS({
   "../../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-client.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify2 } = __require("node:util");
+    var { promisify: promisify3 } = __require("node:util");
     var Client2 = require_client();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -23934,7 +23934,7 @@ var require_mock_client = __commonJS({
         this[kDispatches] = [];
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -24147,7 +24147,7 @@ var require_mock_call_history = __commonJS({
 var require_mock_pool = __commonJS({
   "../../node_modules/.pnpm/undici@7.29.1/node_modules/undici/lib/mock/mock-pool.js"(exports, module2) {
     "use strict";
-    var { promisify: promisify2 } = __require("node:util");
+    var { promisify: promisify3 } = __require("node:util");
     var Pool = require_pool();
     var { buildMockDispatch } = require_mock_utils();
     var {
@@ -24195,7 +24195,7 @@ var require_mock_pool = __commonJS({
         this[kDispatches] = [];
       }
       async [kClose]() {
-        await promisify2(this[kOriginalClose])();
+        await promisify3(this[kOriginalClose])();
         this[kConnected] = 0;
         this[kMockAgent][Symbols.kClients].delete(this[kOrigin]);
       }
@@ -56051,7 +56051,7 @@ function visit(schema, fnOrHandlers) {
     return h ? h(node3, rewritten) : node3;
   };
   const cache = /* @__PURE__ */ new Map();
-  function run(s) {
+  function run2(s) {
     const cached3 = cache.get(s);
     if (cached3 === RESOLVING) {
       return new $ZodLazy({
@@ -56077,21 +56077,21 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newShape = {};
         for (const k2 of keys) {
-          const mapped = run(oldShape[k2]);
+          const mapped = run2(oldShape[k2]);
           if (mapped !== oldShape[k2])
             changed = true;
           newShape[k2] = mapped;
         }
         let newCatchall = def.catchall;
         if (def.catchall) {
-          newCatchall = run(def.catchall);
+          newCatchall = run2(def.catchall);
           if (newCatchall !== def.catchall)
             changed = true;
         }
         return changed ? clone(s, { ...def, shape: newShape, catchall: newCatchall }) : s;
       }
       case "array": {
-        const mapped = run(def.element);
+        const mapped = run2(def.element);
         return mapped === def.element ? s : clone(s, { ...def, element: mapped });
       }
       case "tuple": {
@@ -56099,14 +56099,14 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newItems = [];
         for (const item of oldItems) {
-          const mapped = run(item);
+          const mapped = run2(item);
           if (mapped !== item)
             changed = true;
           newItems.push(mapped);
         }
         let newRest = def.rest;
         if (def.rest) {
-          newRest = run(def.rest);
+          newRest = run2(def.rest);
           if (newRest !== def.rest)
             changed = true;
         }
@@ -56114,12 +56114,12 @@ function visit(schema, fnOrHandlers) {
       }
       case "record":
       case "map": {
-        const newKey = run(def.keyType);
-        const newVal = run(def.valueType);
+        const newKey = run2(def.keyType);
+        const newVal = run2(def.valueType);
         return newKey === def.keyType && newVal === def.valueType ? s : clone(s, { ...def, keyType: newKey, valueType: newVal });
       }
       case "set": {
-        const newVal = run(def.valueType);
+        const newVal = run2(def.valueType);
         return newVal === def.valueType ? s : clone(s, { ...def, valueType: newVal });
       }
       case "union": {
@@ -56127,7 +56127,7 @@ function visit(schema, fnOrHandlers) {
         let changed = false;
         const newOptions = [];
         for (const opt of oldOptions) {
-          const mapped = run(opt);
+          const mapped = run2(opt);
           if (mapped !== opt)
             changed = true;
           newOptions.push(mapped);
@@ -56135,8 +56135,8 @@ function visit(schema, fnOrHandlers) {
         return changed ? clone(s, { ...def, options: newOptions }) : s;
       }
       case "intersection": {
-        const newLeft = run(def.left);
-        const newRight = run(def.right);
+        const newLeft = run2(def.left);
+        const newRight = run2(def.right);
         return newLeft === def.left && newRight === def.right ? s : clone(s, { ...def, left: newLeft, right: newRight });
       }
       case "optional":
@@ -56148,23 +56148,23 @@ function visit(schema, fnOrHandlers) {
       case "nonoptional":
       case "promise":
       case "success": {
-        const newInner = run(def.innerType);
+        const newInner = run2(def.innerType);
         return newInner === def.innerType ? s : clone(s, { ...def, innerType: newInner });
       }
       case "pipe": {
-        const newIn = run(def.in);
-        const newOut = run(def.out);
+        const newIn = run2(def.in);
+        const newOut = run2(def.out);
         return newIn === def.in && newOut === def.out ? s : clone(s, { ...def, in: newIn, out: newOut });
       }
       case "function": {
-        const newInput = run(def.input);
-        const newOutput = run(def.output);
+        const newInput = run2(def.input);
+        const newOutput = run2(def.output);
         return newInput === def.input && newOutput === def.output ? s : clone(s, { ...def, input: newInput, output: newOutput });
       }
       case "lazy": {
         const original = def.getter;
         const { _cachedInner, ...rest } = def;
-        return clone(s, { ...rest, getter: () => run(original()) });
+        return clone(s, { ...rest, getter: () => run2(original()) });
       }
       // A leaf by choice: `parts` are regex fragments, not data positions.
       case "template_literal":
@@ -56195,7 +56195,7 @@ function visit(schema, fnOrHandlers) {
       }
     }
   }
-  return run(schema);
+  return run2(schema);
 }
 
 // ../../node_modules/.pnpm/zod@4.6.5/node_modules/zod/v4/classic/deep-partial.js
@@ -56630,9 +56630,9 @@ function isImageBase64Payload(record2, key) {
   if (key === "base64") return isEncodedImage(data, record2.type);
   return false;
 }
-function describeImageBlock(block) {
-  if (block.type !== "image") return null;
-  const source = asRecord(block.source);
+function describeImageBlock(block2) {
+  if (block2.type !== "image") return null;
+  const source = asRecord(block2.source);
   const mediaType = typeof source?.media_type === "string" ? source.media_type : null;
   if (source?.type === "base64" && typeof source.data === "string") {
     return { mediaType, bytes: base64ByteLength(source.data) };
@@ -56805,7 +56805,7 @@ function jsonTokens(text) {
     let backslashes = 0;
     while (text[index - backslashes - 1] === "\\") backslashes += 1;
     let level = 0;
-    for (let run = backslashes + 1; run % 2 === 0; run /= 2) level += 1;
+    for (let run2 = backslashes + 1; run2 % 2 === 0; run2 /= 2) level += 1;
     tokens.push({ index, level });
   }
   return tokens;
@@ -57641,8 +57641,8 @@ function createDigestTurnParser(options = {}) {
       }
       const model = typeof message2.model === "string" ? message2.model : null;
       const facts = originFacts(record2);
-      for (const block of message2.content) {
-        const part = block;
+      for (const block2 of message2.content) {
+        const part = block2;
         if (part.type === "tool_use" && typeof part.name === "string") {
           const call = { name: part.name, ...toolFilePath(part.input) };
           if (options.keepToolInputs === true && isRecord(part.input)) {
@@ -57757,19 +57757,19 @@ function toolResults(record2, evidence, tasks, line) {
   const result = isRecord(record2.toolUseResult) ? record2.toolUseResult : {};
   const file2 = isRecord(result.file) ? result.file : {};
   const task = isRecord(result.task) ? result.task : {};
-  for (const block of content) {
-    if (!isRecord(block) || block.type !== "tool_result" || typeof block.tool_use_id !== "string") continue;
-    if (!evidence.watching(block.tool_use_id)) continue;
-    const reads = tasks.reads.get(block.tool_use_id);
-    tasks.reads.delete(block.tool_use_id);
+  for (const block2 of content) {
+    if (!isRecord(block2) || block2.type !== "tool_result" || typeof block2.tool_use_id !== "string") continue;
+    if (!evidence.watching(block2.tool_use_id)) continue;
+    const reads = tasks.reads.get(block2.tool_use_id);
+    tasks.reads.delete(block2.tool_use_id);
     const started = typeof result.backgroundTaskId === "string" ? result.backgroundTaskId : null;
     if (started !== null) keepBounded(tasks.started, started, reads ?? started);
-    const failed2 = block.is_error === true || result.interrupted === true;
+    const failed2 = block2.is_error === true || result.interrupted === true;
     const taskExited = typeof task.exitCode === "number" && task.task_id === reads;
     const status = reads !== void 0 ? { succeeded: taskExited ? task.exitCode === 0 : null, running: taskExited ? null : reads } : { succeeded: failed2 ? false : started !== null ? null : true, running: started };
-    evidence.result(block.tool_use_id, {
+    evidence.result(block2.tool_use_id, {
       ...status,
-      text: [result.stdout, result.stderr, file2.content, task.output].filter((part) => typeof part === "string").concat(contentText(block.content)).join("\n"),
+      text: [result.stdout, result.stderr, file2.content, task.output].filter((part) => typeof part === "string").concat(contentText(block2.content)).join("\n"),
       at: recordTime(record2),
       line
     });
@@ -57778,7 +57778,7 @@ function toolResults(record2, evidence, tasks, line) {
 function contentText(content) {
   if (typeof content === "string") return content;
   if (!Array.isArray(content)) return "";
-  return content.map((block) => isRecord(block) && typeof block.text === "string" ? block.text : "").join("\n");
+  return content.map((block2) => isRecord(block2) && typeof block2.text === "string" ? block2.text : "").join("\n");
 }
 function messageIdOf(record2, message2) {
   if (typeof message2.id === "string") return message2.id;
@@ -57845,13 +57845,13 @@ function userText(record2) {
   if (typeof content === "string") return content.trim() === "" ? null : content;
   if (!Array.isArray(content)) return null;
   const parts = [];
-  for (const block of content) {
-    if (!isRecord(block)) continue;
-    if (block.type === "text" && typeof block.text === "string" && block.text.trim() !== "") {
-      parts.push(block.text);
+  for (const block2 of content) {
+    if (!isRecord(block2)) continue;
+    if (block2.type === "text" && typeof block2.text === "string" && block2.text.trim() !== "") {
+      parts.push(block2.text);
       continue;
     }
-    const image = describeImageBlock(block);
+    const image = describeImageBlock(block2);
     if (image) parts.push(imageLabel(image));
   }
   return parts.length > 0 ? parts.join("\n") : null;
@@ -58374,6 +58374,7 @@ var MACHINE_ENROLL_CALLBACK_URL = `http://127.0.0.1:${MACHINE_ENROLL_CALLBACK_PO
 
 // ../core/src/sessionRooms.ts
 var ROOM_QUIET_AFTER_MS = 7 * 24 * 36e5;
+var RECENT_ACTIVITY_WINDOW_MS = 5 * 24 * 36e5;
 function capturedSessionEvents(turns, anchor2) {
   const events = [];
   const base = {
@@ -58459,22 +58460,22 @@ function safeJsonRecord(text) {
 function outputTextBlocks(content) {
   if (!Array.isArray(content)) return [];
   return content.filter(
-    (block) => typeof block === "object" && block !== null && block.type === "output_text" && typeof block.text === "string"
-  ).map((block) => block.text);
+    (block2) => typeof block2 === "object" && block2 !== null && block2.type === "output_text" && typeof block2.text === "string"
+  ).map((block2) => block2.text);
 }
 function promptText(content) {
   if (!Array.isArray(content)) return null;
   const kept = [];
   const textOrigins = [];
   for (const raw of content) {
-    const block = asRecord2(raw);
-    if (!block) continue;
-    if (block.type === "input_image") {
-      kept.push(imageLabel(describeImageUrl(block.image_url)));
+    const block2 = asRecord2(raw);
+    if (!block2) continue;
+    if (block2.type === "input_image") {
+      kept.push(imageLabel(describeImageUrl(block2.image_url)));
       continue;
     }
-    if (block.type !== "input_text" || typeof block.text !== "string") continue;
-    const parsed = codexPromptBlock(block.text);
+    if (block2.type !== "input_text" || typeof block2.text !== "string") continue;
+    const parsed = codexPromptBlock(block2.text);
     if (parsed.origin === "harness") continue;
     textOrigins.push(parsed.origin);
     if (parsed.ask !== "") kept.push(parsed.ask);
@@ -58689,8 +58690,8 @@ function scriptResult(evidence, script, header, blocks, at, line) {
 function outputBlocks(output2) {
   if (typeof output2 === "string") return [output2];
   if (!Array.isArray(output2)) return [];
-  return output2.map((block) => {
-    const text = asRecord2(block)?.text;
+  return output2.map((block2) => {
+    const text = asRecord2(block2)?.text;
     return typeof text === "string" ? text : "";
   });
 }
@@ -58818,9 +58819,9 @@ function parseCursorRunEventsDetailed(runs, options = {}) {
     pendingTools = [];
     pendingTokens = 0;
   };
-  for (const run of runs) {
+  for (const run2 of runs) {
     const openCalls = /* @__PURE__ */ new Map();
-    for (const raw of run.events) {
+    for (const raw of run2.events) {
       const evt = asRawEvent(raw);
       if (!evt) continue;
       if (evt.event === "tool_call") {
@@ -59110,9 +59111,9 @@ function envelopeRuns(transcript) {
   if (!parsed || !Array.isArray(parsed.runs)) return [];
   const runs = [];
   for (const item of parsed.runs) {
-    const run = item;
-    if (typeof run?.runId !== "string" || typeof run.sse !== "string") continue;
-    runs.push({ runId: run.runId, events: redactCursorRunEvents(parseSseEvents(run.sse), { servedOnly: true }) });
+    const run2 = item;
+    if (typeof run2?.runId !== "string" || typeof run2.sse !== "string") continue;
+    runs.push({ runId: run2.runId, events: redactCursorRunEvents(parseSseEvents(run2.sse), { servedOnly: true }) });
   }
   return runs;
 }
@@ -59131,30 +59132,104 @@ var SECRET_QUERY_PARAM_PATTERN = /^(?:token|access_token|refresh_token|id_token|
 var BEARER_TOKEN_PATTERN = /\bBearer\s+[\w\-._~+/=]+/gi;
 var JWT_PATTERN = /\b[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g;
 var EMBEDDED_QUERY_SECRET_PATTERN = /([?&](?:token|access_token|refresh_token|id_token|api_key|apikey|key|code|signature|password|secret|client_secret|state)=)[^&\s#]+/gi;
-var URL_FIELD_NAMES = /* @__PURE__ */ new Set(["url", "to", "from", "href", "request_url"]);
+var URL_USER_INFO_PATTERN = /(:\/\/)(?:[^\s/?#@"<>:[]+:(?!\d*(?:[/?#\s"<>]|$))[^\s"<>]{0,256}|[^\s/?#"<>]+)@/g;
+var URL_FIELD_NAMES = /* @__PURE__ */ new Set([
+  "url",
+  "to",
+  "from",
+  "href",
+  "request_url",
+  "referer",
+  "url.full",
+  "http.url",
+  "http.target",
+  "url.path"
+]);
+var KEPT_HEADER_NAMES = /* @__PURE__ */ new Set([
+  "accept",
+  "content-encoding",
+  "content-length",
+  "content-type",
+  "host",
+  "mcp-protocol-version",
+  "referer",
+  "user-agent",
+  "x-github-event",
+  "x-powerplant-cli-version"
+]);
+var KEPT_HTTP_ATTRIBUTES = /* @__PURE__ */ new Set([
+  "http.method",
+  "http.request.method",
+  "http.request.method_original",
+  "http.route",
+  "http.status_code",
+  "http.status_text",
+  "http.response.status_code",
+  "http.scheme",
+  "http.host",
+  "http.flavor",
+  "http.request_content_length_uncompressed",
+  "url.scheme",
+  "url.full",
+  "http.url",
+  "http.target",
+  "url.path"
+]);
+var HTTP_ATTRIBUTE_PREFIX = /^(?:http|url)\./;
+var URL_PARTS = /^([a-z][a-z\d+.-]*:\/\/)([^/?#]*)([^?#]*)/i;
+var PATH_KEPT_HOSTS = /(?:^|\.)(?:supabase\.co|usepowerplant\.com)$/i;
+var OUTGOING_ROUTES = [
+  // GitHub REST API
+  "/app/installations/{installation_id}/access_tokens",
+  "/app/installations/{installation_id}",
+  "/installation/repositories",
+  "/orgs/{org}/memberships/{username}",
+  "/repos/{owner}/{repo}/contents/{path}",
+  "/user/installations",
+  "/user/{account_id}",
+  // GitHub sign-in
+  "/login/oauth/access_token",
+  // Cursor API
+  "/v1/agents",
+  "/v1/agents/{agent_id}",
+  "/v1/agents/{agent_id}/runs",
+  "/v1/agents/{agent_id}/runs/{run_id}",
+  "/v1/agents/{agent_id}/runs/{run_id}/stream",
+  "/teams/filtered-usage-events"
+];
+var OUTGOING_URL_FIELD_NAMES = ["url", "url.full", "http.url"];
+var OUTGOING_PATH_FIELD_NAMES = ["url.path", "http.target"];
 var MAX_DEPTH = 10;
 function scrubString(value) {
-  return value.replace(POWERPLANT_TOKEN_PATTERN, REDACTED3).replace(BEARER_TOKEN_PATTERN, `Bearer ${REDACTED3}`).replace(JWT_PATTERN, REDACTED3).replace(EMBEDDED_QUERY_SECRET_PATTERN, `$1${REDACTED3}`);
+  return scrubUserInfo(value).replace(POWERPLANT_TOKEN_PATTERN, REDACTED3).replace(BEARER_TOKEN_PATTERN, `Bearer ${REDACTED3}`).replace(JWT_PATTERN, REDACTED3).replace(EMBEDDED_QUERY_SECRET_PATTERN, `$1${REDACTED3}`);
 }
 function scrubUrl(url2) {
-  if (!url2) return url2;
-  const PLACEHOLDER_ORIGIN = "https://scrub.invalid";
-  let parsed;
-  try {
-    parsed = new URL(url2, PLACEHOLDER_ORIGIN);
-  } catch {
-    return url2;
-  }
-  let mutated = false;
-  for (const key of [...parsed.searchParams.keys()]) {
-    if (SECRET_QUERY_PARAM_PATTERN.test(key)) {
-      parsed.searchParams.set(key, REDACTED3);
-      mutated = true;
-    }
-  }
-  if (!mutated) return url2;
-  const result = parsed.toString();
-  return url2.startsWith(PLACEHOLDER_ORIGIN) || !url2.includes("://") ? result.replace(PLACEHOLDER_ORIGIN, "") : result;
+  const scrubbed = scrubUserInfo(url2);
+  const queryStart = scrubbed.search(/[?#]/);
+  return queryStart === -1 ? scrubbed : scrubbed.slice(0, queryStart);
+}
+function scrubUserInfo(value) {
+  return value.replace(URL_USER_INFO_PATTERN, `$1${REDACTED3}@`);
+}
+function scrubOutgoingUrl(url2) {
+  const parts = URL_PARTS.exec(url2);
+  if (!parts) return REDACTED3;
+  const [, scheme = "", authority = "", path38 = ""] = parts;
+  const host = authority.slice(authority.lastIndexOf("@") + 1);
+  const origin = `${scheme}${host}`;
+  if (PATH_KEPT_HOSTS.test(host.replace(/:\d*$/, ""))) return `${origin}${path38}`;
+  const route = OUTGOING_ROUTES.find((template) => fitsRoute(path38, template));
+  return `${origin}${route ?? ""}`;
+}
+function fitsRoute(path38, template) {
+  const segments = path38.replace(/(.)\/$/, "$1").split("/");
+  const route = template.split("/");
+  const hasRest = route.at(-1) === "{path}";
+  const fixed = hasRest ? route.slice(0, -1) : route;
+  if (hasRest ? segments.length < fixed.length : segments.length !== fixed.length) return false;
+  return fixed.every(
+    (part, index) => part.startsWith("{") ? segments[index] !== "" : part === segments[index]
+  );
 }
 function scrubValue(value, depth = 0) {
   if (depth > MAX_DEPTH || value == null) return value;
@@ -59163,9 +59238,10 @@ function scrubValue(value, depth = 0) {
   if (typeof value !== "object") return value;
   const out = {};
   for (const [key, child] of Object.entries(value)) {
-    if (SECRET_KEY_PATTERN.test(key) || SECRET_QUERY_PARAM_PATTERN.test(key)) {
+    const name = key.toLowerCase();
+    if (SECRET_KEY_PATTERN.test(key) || SECRET_QUERY_PARAM_PATTERN.test(key) || HTTP_ATTRIBUTE_PREFIX.test(name) && !KEPT_HTTP_ATTRIBUTES.has(name)) {
       out[key] = REDACTED3;
-    } else if (URL_FIELD_NAMES.has(key.toLowerCase()) && typeof child === "string") {
+    } else if (URL_FIELD_NAMES.has(name) && typeof child === "string") {
       out[key] = scrubUrl(child);
     } else {
       out[key] = scrubValue(child, depth + 1);
@@ -59178,17 +59254,21 @@ function scrubSentryEvent(event) {
     if (typeof event.request.url === "string") {
       event.request.url = scrubUrl(event.request.url);
     }
-    if (typeof event.request.query_string === "string") {
-      event.request.query_string = scrubUrl(`?${event.request.query_string}`).replace(/^\?/, "");
+    if (event.request.query_string !== void 0) {
+      event.request.query_string = REDACTED3;
     }
     if (event.request.headers) {
-      event.request.headers = scrubValue(event.request.headers);
+      const headers = Object.entries(event.request.headers).map(([name, value]) => [
+        name,
+        KEPT_HEADER_NAMES.has(name.toLowerCase()) ? value : REDACTED3
+      ]);
+      event.request.headers = scrubValue(Object.fromEntries(headers));
     }
     if (event.request.cookies !== void 0) {
       event.request.cookies = REDACTED3;
     }
     if (event.request.data !== void 0) {
-      event.request.data = scrubValue(event.request.data);
+      event.request.data = REDACTED3;
     }
   }
   if (event.exception?.values) {
@@ -59210,14 +59290,45 @@ function scrubSentryEvent(event) {
   if (Array.isArray(event.breadcrumbs)) {
     event.breadcrumbs = event.breadcrumbs.map(scrubBreadcrumb);
   }
+  for (const span of event.spans ?? []) {
+    if (typeof span.description === "string") {
+      span.description = scrubString(span.description);
+    }
+    if (span.data) {
+      span.data = scrubValue(span.data);
+    }
+    if (span.op === "http.client") {
+      scrubOutgoingRequestSpan(span);
+    }
+  }
   return event;
 }
+function scrubOutgoingRequestSpan(span) {
+  if (typeof span.description === "string") {
+    const [method, ...target] = span.description.split(" ");
+    if (target.length > 0) {
+      span.description = `${method} ${scrubOutgoingUrl(target.join(" "))}`;
+    }
+  }
+  const data = span.data;
+  if (!data) return;
+  for (const name of OUTGOING_URL_FIELD_NAMES) {
+    const value = data[name];
+    if (typeof value === "string") data[name] = scrubOutgoingUrl(value);
+  }
+  for (const name of OUTGOING_PATH_FIELD_NAMES) {
+    if (name in data) data[name] = REDACTED3;
+  }
+}
 function scrubBreadcrumb(breadcrumb) {
   if (typeof breadcrumb.message === "string") {
     breadcrumb.message = scrubString(breadcrumb.message);
   }
   if (breadcrumb.data) {
     breadcrumb.data = scrubValue(breadcrumb.data);
+    if (breadcrumb.category === "http" && typeof breadcrumb.data.url === "string") {
+      breadcrumb.data.url = scrubOutgoingUrl(breadcrumb.data.url);
+    }
   }
   return breadcrumb;
 }
@@ -59256,11 +59367,15 @@ function addLocalSessionEvent(evidence, event) {
       const writes = writesAfterTurnEndMs.includes(event.atMs) ? writesAfterTurnEndMs : [...writesAfterTurnEndMs, event.atMs].sort((a, b2) => a - b2).slice(-WRITES_KEPT_AFTER_TURN_END);
       return { ...evidence, lastWriteMs, writesAfterTurnEndMs: writes };
     }
-    case "turn-end": {
+    case "turn-end":
+    case "transcript-turn-end": {
+      const inTranscript = event.kind === "transcript-turn-end";
+      if (event.atMs === lastTurnEndMs && inTranscript) return { ...evidence, lastTurnEndInTranscript: true };
       if (lastTurnEndMs !== void 0 && event.atMs <= lastTurnEndMs) return evidence;
       return {
         ...evidence,
         lastTurnEndMs: event.atMs,
+        lastTurnEndInTranscript: inTranscript,
         lastWriteByTurnEndMs: latest(evidence.lastWriteByTurnEndMs, writesAfterTurnEndMs.findLast((ms) => ms <= event.atMs)),
         writesAfterTurnEndMs: writesAfterTurnEndMs.filter((ms) => ms > event.atMs)
       };
@@ -59284,16 +59399,19 @@ function deadlineAfterLastEvent({ lastWriteMs, lastTurnEndMs, lastBoundary }) {
 function statusFromEvents({
   lastWriteMs,
   lastTurnEndMs,
+  lastTurnEndInTranscript,
   lastWriteByTurnEndMs,
   lastBoundary
 }) {
-  const isNewWork = (writeMs, eventMs) => writeMs !== void 0 && writeMs > eventMs + END_OBSERVATION_WRITE_SLACK_MS;
+  const isNewWork = (writeMs, eventMs, slackMs2 = END_OBSERVATION_WRITE_SLACK_MS) => writeMs !== void 0 && writeMs > eventMs + slackMs2;
   const endMs = lastBoundary?.event === "session-end" ? lastBoundary.atMs : void 0;
   const startMs = lastBoundary?.event === "session-start" ? lastBoundary.atMs : void 0;
   if (endMs !== void 0 && !isNewWork(lastWriteMs, endMs)) return "ended";
   const turnEndCounts = endMs === void 0 || isNewWork(lastWriteByTurnEndMs, endMs);
-  const waitingSinceMs = latest(turnEndCounts ? lastTurnEndMs : void 0, startMs);
-  if (waitingSinceMs !== void 0 && !isNewWork(lastWriteMs, waitingSinceMs)) return "waiting";
+  const turnEndMs = turnEndCounts ? lastTurnEndMs : void 0;
+  const waitingSinceMs = latest(turnEndMs, startMs);
+  const slackMs = waitingSinceMs === turnEndMs && lastTurnEndInTranscript === true ? 0 : END_OBSERVATION_WRITE_SLACK_MS;
+  if (waitingSinceMs !== void 0 && !isNewWork(lastWriteMs, waitingSinceMs, slackMs)) return "waiting";
   return lastWriteMs === void 0 ? "unknown" : "working";
 }
 function latest(a, b2) {
@@ -59416,9 +59534,10 @@ function parseCodexChildThread(sessionMeta) {
 // ../core/src/recentSessionPage.ts
 var RECENT_SESSION_WINDOW_MS = 72 * 60 * 60 * 1e3;
 var RECENT_SESSION_VISIBLE_LIMIT = 12;
+var RECENT_SESSION_PAGE_MAX = 40;
 var recentSessionOptionsSchema = external_exports.object({
   windowHours: external_exports.coerce.number().int().min(1).max(120).default(72),
-  limit: external_exports.coerce.number().int().min(1).max(40).default(12)
+  limit: external_exports.coerce.number().int().min(1).max(RECENT_SESSION_PAGE_MAX).default(12)
 });
 var recentSessionCursorSchema = external_exports.object({
   at: external_exports.iso.datetime({ offset: true }),
@@ -78610,10 +78729,10 @@ function dispatchEngineSpan(engineSpan, allSpans, linkIds, ignoreSpanTypes) {
     }
   );
 }
-function endSpan2(span, run) {
+function endSpan2(span, run2) {
   let result;
   try {
-    result = run();
+    result = run2();
   } catch (reason) {
     span.end();
     throw reason;
@@ -80582,7 +80701,7 @@ var KafkaJsInstrumentation = class extends import_instrumentation9.Instrumentati
   _getConsumerRunPatch() {
     const instrumentation = this;
     return (original) => {
-      return function run(...args) {
+      return function run2(...args) {
         const config2 = args[0];
         if (config2?.eachMessage) {
           if ((0, import_instrumentation9.isWrapped)(config2.eachMessage)) {
@@ -86582,40 +86701,45 @@ function readCodexTranscriptDiscoveryRecords(home, roots) {
   } catch {
     return [];
   }
-  const result = [];
-  for (const file2 of files) {
-    if (!/^[a-f0-9]{64}\.json$/.test(file2)) continue;
+  return files.flatMap((file2) => {
+    if (!/^[a-f0-9]{64}\.json$/.test(file2)) return [];
+    const record2 = readRecord(path2.join(dir, file2), roots);
+    return record2 === null ? [] : [record2];
+  });
+}
+function readCodexTranscriptDiscoveryRecord(home, sessionId, roots) {
+  return readRecord(codexTranscriptRecordPath(home, sessionId), roots);
+}
+function readRecord(recordPath, roots) {
+  try {
+    if (!lstatSync(recordPath).isFile()) return null;
+    const fd = openSync(recordPath, "r");
+    let text;
     try {
-      const recordPath = path2.join(dir, file2);
-      if (!lstatSync(recordPath).isFile()) continue;
-      const fd = openSync(recordPath, "r");
-      let text;
-      try {
-        const buffer = Buffer.alloc(32 * 1024 + 1);
-        const read = readSync(fd, buffer, 0, buffer.length, null);
-        if (read === buffer.length) continue;
-        text = buffer.subarray(0, read).toString("utf8");
-      } finally {
-        closeSync(fd);
-      }
-      const record2 = transcriptDiscoveryRecordSchema.parse(JSON.parse(text));
-      if (file2 !== `${createHash("sha256").update(record2.sessionId).digest("hex")}.json`) continue;
-      if (record2.transcriptPath === null || !path2.isAbsolute(record2.transcriptPath)) continue;
-      const rolloutPath = path2.normalize(record2.transcriptPath);
-      if (path2.extname(rolloutPath) !== ".jsonl") continue;
-      const rootIndex = roots.findIndex((root2) => {
-        const relative2 = path2.relative(root2, rolloutPath);
-        return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative2);
-      });
-      if (rootIndex < 0 || !lstatSync(rolloutPath).isFile()) continue;
-      const root = roots[rootIndex];
-      if (realpathSync(rolloutPath) !== path2.join(realpathSync(root), path2.relative(root, rolloutPath)))
-        continue;
-      result.push({ rolloutPath, sessionId: record2.sessionId, archived: rootIndex === 1 });
-    } catch {
-    }
+      const buffer = Buffer.alloc(32 * 1024 + 1);
+      const read = readSync(fd, buffer, 0, buffer.length, null);
+      if (read === buffer.length) return null;
+      text = buffer.subarray(0, read).toString("utf8");
+    } finally {
+      closeSync(fd);
+    }
+    const record2 = transcriptDiscoveryRecordSchema.parse(JSON.parse(text));
+    if (path2.basename(recordPath) !== `${createHash("sha256").update(record2.sessionId).digest("hex")}.json`) return null;
+    if (record2.transcriptPath === null || !path2.isAbsolute(record2.transcriptPath)) return null;
+    const rolloutPath = path2.normalize(record2.transcriptPath);
+    if (path2.extname(rolloutPath) !== ".jsonl") return null;
+    const rootIndex = roots.findIndex((root2) => {
+      const relative2 = path2.relative(root2, rolloutPath);
+      return relative2 !== "" && relative2 !== ".." && !relative2.startsWith(`..${path2.sep}`) && !path2.isAbsolute(relative2);
+    });
+    if (rootIndex < 0 || !lstatSync(rolloutPath).isFile()) return null;
+    const root = roots[rootIndex];
+    if (realpathSync(rolloutPath) !== path2.join(realpathSync(root), path2.relative(root, rolloutPath)))
+      return null;
+    return { rolloutPath, sessionId: record2.sessionId, archived: rootIndex === 1 };
+  } catch {
+    return null;
   }
-  return result;
 }
 
 // ../../apps/syncservice/src/diagnostics.ts
@@ -86624,7 +86748,7 @@ import { createHmac } from "node:crypto";
 // ../../apps/syncservice/src/http.ts
 var import_undici = __toESM(require_undici(), 1);
 var CLI_VERSION_HEADER = "x-powerplant-cli-version";
-var cliVersion = true ? "0.4.20" : "0.0.0-checkout";
+var cliVersion = true ? "0.4.22" : "0.0.0-checkout";
 function cliVersionHeaders() {
   return { [CLI_VERSION_HEADER]: cliVersion, "user-agent": `powerplant-cli/${cliVersion}` };
 }
@@ -87717,7 +87841,7 @@ function mayBeParentOf(parent, childMadeMs) {
 function mayBeChildOf(threadTimeMs, parentTimeMs) {
   return threadTimeMs === void 0 || parentTimeMs === void 0 || threadTimeMs + THREAD_ID_TIME_MARGIN_MS >= parentTimeMs;
 }
-var CodexThreadLinks = class {
+var CodexThreadLinks = class _CodexThreadLinks {
   /** `readLink` is a test seam for the first-record read. */
   constructor(readLink = readThreadLink) {
     this.readLink = readLink;
@@ -87743,6 +87867,19 @@ var CodexThreadLinks = class {
    * (settleRecoveries), with the session the last pass made of it and how
    * many uploads of it failed. */
   recovering = /* @__PURE__ */ new Map();
+  /** A copy for a pass that runs beside the watcher's own passes (the
+   * new-session pass), so neither changes what the other knows. It keeps
+   * what each rollout's first record showed, and leaves out the rollouts
+   * and threads owed another read or a corrected capture, which only the
+   * watcher's own passes settle. */
+  copyForSidePass() {
+    const copy = new _CodexThreadLinks(this.readLink);
+    for (const [rolloutPath, link] of this.byPath) copy.byPath.set(rolloutPath, link);
+    for (const [rolloutPath, changedMs] of this.failedAt) copy.failedAt.set(rolloutPath, changedMs);
+    for (const [rolloutPath, state] of this.incomplete) copy.incomplete.set(rolloutPath, { ...state });
+    for (const rolloutPath of this.faulted) copy.faulted.add(rolloutPath);
+    return copy;
+  }
   /** Keeps what another read of the same first record found. */
   remember(rolloutPath, link) {
     this.byPath.set(rolloutPath, link);
@@ -87980,7 +88117,7 @@ var CodexThreadLinks = class {
     return true;
   }
 };
-var CodexThreadReads = class {
+var CodexThreadReads = class _CodexThreadReads {
   byThread = /* @__PURE__ */ new Map();
   /** What a full read found when the thread's files were `files`
    * (threadFilesKey): its summary and prefix, null for a thread holding no
@@ -87992,6 +88129,14 @@ var CodexThreadReads = class {
   set(threadId2, files, read) {
     this.byThread.set(threadId2, { files, read });
   }
+  /** A copy for a pass that runs beside the watcher's own passes. Each read
+   * is kept for exactly the files it was made from, so a copy never serves
+   * a read of files that have since changed. */
+  copyForSidePass() {
+    const copy = new _CodexThreadReads();
+    for (const [threadId2, kept] of this.byThread) copy.byThread.set(threadId2, kept);
+    return copy;
+  }
   /** Forgets the threads no longer on this machine. */
   keepOnly(threadIds) {
     for (const threadId2 of this.byThread.keys()) if (!threadIds.has(threadId2)) this.byThread.delete(threadId2);
@@ -90295,8 +90440,10 @@ var collectorStatusSchema = external_exports.object({
   /** Last pass that completed without error — everything eligible had been
    * uploaded as of this time. */
   lastSyncAt: external_exports.string().optional(),
-  /** Last pass that upserted at least one session; missing = no session
-   * has uploaded in this daemon's lifetime, not "never". */
+  /** When the server last stored a changed session record, from any pass,
+   * a recent catch-up inside one included. The next run of the same
+   * enrollment carries it (carriedUploadClock). Missing: no upload in this
+   * run or the one before it, not "never". */
   lastUploadAt: external_exports.string().optional(),
   consecutiveFailures: external_exports.number().int().nonnegative(),
   /** Whether the hooks this daemon installed are firing, per harness
@@ -90867,7 +91014,7 @@ function saveCredentials(appEnv, credentials) {
 function loadCredentials(appEnv) {
   if (process.platform === "darwin") {
     const raw2 = new MacosCredentialStore(appEnv).load();
-    return raw2 === null ? null : parseStoredCredentials(raw2, appEnv);
+    return raw2 === null ? null : withCurrentApiUrl(appEnv, parseStoredCredentials(raw2, appEnv));
   }
   let raw;
   try {
@@ -90879,7 +91026,19 @@ function loadCredentials(appEnv) {
       { cause }
     );
   }
-  return parseStoredCredentials(raw, appEnv);
+  return withCurrentApiUrl(appEnv, parseStoredCredentials(raw, appEnv));
+}
+var RETIRED_API_URLS = {
+  production: { retired: "https://api.powerplant.sh", replacement: "https://api.usepowerplant.com" },
+  staging: {
+    retired: "https://staging.api.powerplant.sh",
+    replacement: "https://staging.api.usepowerplant.com"
+  }
+};
+function withCurrentApiUrl(appEnv, credentials) {
+  const moved = RETIRED_API_URLS[appEnv];
+  if (moved === void 0 || credentials.apiUrl !== moved.retired) return credentials;
+  return { ...credentials, apiUrl: moved.replacement };
 }
 function isCredentialStoreAbsent(cause) {
   return cause instanceof Error && "code" in cause && cause.code === "ENOENT";
@@ -90912,7 +91071,9 @@ import os14 from "node:os";
 
 // ../../apps/syncservice/src/upload.ts
 import { readFileSync as readFileSync10 } from "node:fs";
-import { gzipSync } from "node:zlib";
+import { setImmediate as yieldToEventLoop3 } from "node:timers/promises";
+import { promisify as promisify2 } from "node:util";
+import { gzip } from "node:zlib";
 
 // ../../apps/syncservice/src/claudeCode.ts
 import { readdirSync as readdirSync6 } from "node:fs";
@@ -90929,7 +91090,9 @@ function parseClaudeCodeTranscript(text) {
   let entrypoint;
   let anonCounter = 0;
   let speedMode;
+  let endsWithAbortedTurn = false;
   for (const record2 of parseJsonl(text)) {
+    endsWithAbortedTurn = abortedTurnOf(record2) ?? endsWithAbortedTurn;
     if (record2.type === "custom-title" && typeof record2.customTitle === "string") {
       title = record2.customTitle;
       continue;
@@ -90990,8 +91153,38 @@ function parseClaudeCodeTranscript(text) {
     turnCount: usageByMessage.size,
     cwd,
     gitBranch,
-    entrypoint
-  };
+    entrypoint,
+    endsWithAbortedTurn
+  };
+}
+var STOPPED_TURN_TEXT = "[Request interrupted by user";
+var LOCAL_COMMAND_TEXT = /^\s*<(?:local-command-caveat|command-name|local-command-stdout|local-command-stderr)>/;
+var messageContentSchema = external_exports.object({ content: external_exports.union([external_exports.string(), external_exports.array(external_exports.unknown())]) });
+var textBlockSchema = external_exports.object({ type: external_exports.literal("text"), text: external_exports.string() });
+function abortedTurnOf(record2) {
+  if (record2.type !== "user" && record2.type !== "assistant" || record2.isSidechain === true) return void 0;
+  if (record2.type === "assistant") return record2.isApiErrorMessage === true;
+  const text = firstText(record2.message);
+  return LOCAL_COMMAND_TEXT.test(text) ? void 0 : text.startsWith(STOPPED_TURN_TEXT);
+}
+function claudeCodeEndsWithAbortedTurn(tail) {
+  const records = [...parseJsonl(tail)];
+  for (let index = records.length - 1; index >= 0; index -= 1) {
+    const aborted2 = abortedTurnOf(records[index]);
+    if (aborted2 !== void 0) return aborted2;
+  }
+  return false;
+}
+function firstText(message2) {
+  const parsed = messageContentSchema.safeParse(message2);
+  if (!parsed.success) return "";
+  const { content } = parsed.data;
+  if (typeof content === "string") return content;
+  for (const block2 of content) {
+    const text = textBlockSchema.safeParse(block2);
+    if (text.success) return text.data.text;
+  }
+  return "";
 }
 var AGENT_SDK_ENTRYPOINTS = /* @__PURE__ */ new Set(["sdk-py", "sdk-ts"]);
 function isAutomationEntrypoint(entrypoint) {
@@ -91101,6 +91294,7 @@ async function collectClaudeCodeSessions(options = {}) {
       const endedAt = endObservedAt ?? laterTimestamp(summary.endedAt, usage.endedAt);
       items.push({
         mtimeMs,
+        endsWithAbortedTurn: summary.endsWithAbortedTurn,
         transcriptPath,
         transcriptPrefix: transcript.prefix,
         subagents: {
@@ -91219,9 +91413,9 @@ function listWorkflowTranscripts(workflowsDir) {
     failedToRead();
     return [];
   };
-  for (const run of list(workflowsDir)) {
-    if (!run.isDirectory()) continue;
-    const runDir = path15.join(workflowsDir, run.name);
+  for (const run2 of list(workflowsDir)) {
+    if (!run2.isDirectory()) continue;
+    const runDir = path15.join(workflowsDir, run2.name);
     for (const file2 of list(runDir)) {
       if (!file2.isFile() || !file2.name.endsWith(".jsonl")) continue;
       try {
@@ -91490,8 +91684,20 @@ async function uploadPreviewRegistration(apiUrl, machineToken, registration) {
   }
   return "registered";
 }
-function encodeRawTranscript(text) {
-  return gzipSync(redactJsonl(text));
+var gzipAsync = promisify2(gzip);
+var REDACT_SLICE_CHARS = 64 * 1024;
+async function encodeRawTranscript(text) {
+  const lines = text.split("\n");
+  let sliceChars = 0;
+  for (const [index, line] of lines.entries()) {
+    lines[index] = redactJsonl(line);
+    sliceChars += line.length;
+    if (sliceChars >= REDACT_SLICE_CHARS) {
+      await yieldToEventLoop3();
+      sliceChars = 0;
+    }
+  }
+  return gzipAsync(lines.join("\n"));
 }
 function readCollectedTranscript(file2, prefix) {
   return prefix === void 0 ? readFileSync10(file2, "utf8") : readTranscriptPrefix(file2, prefix, false);
@@ -91501,8 +91707,8 @@ function readUnchangedTranscript(file2, prefix) {
 }
 var BUNDLE_HEADER_BYTES = 256;
 var BUNDLE_HEADER_BYTES_PER_PART = 256;
-function rawUploadBody(session, readTranscript, maxBytes = MAX_RAW_UPLOAD_BYTES) {
-  const main2 = encodeRawTranscript(readTranscript(session.transcriptPath, session.transcriptPrefix));
+async function rawUploadBody(session, readTranscript, maxBytes = MAX_RAW_UPLOAD_BYTES) {
+  const main2 = await encodeRawTranscript(readTranscript(session.transcriptPath, session.transcriptPrefix));
   if (session.subagents === void 0) {
     return main2.byteLength > maxBytes ? "too-large" : { body: main2, main: main2, contentType: "application/gzip", skippedSubagentFiles: 0, unreadableSubagentFiles: 0 };
   }
@@ -91514,7 +91720,7 @@ function rawUploadBody(session, readTranscript, maxBytes = MAX_RAW_UPLOAD_BYTES)
   for (const file2 of session.subagents.files) {
     let body;
     try {
-      body = encodeRawTranscript(readTranscript(file2.path, file2.prefix));
+      body = await encodeRawTranscript(readTranscript(file2.path, file2.prefix));
     } catch (error63) {
       if (error63 instanceof TranscriptChangedError) throw error63;
       skipped += 1;
@@ -91588,7 +91794,7 @@ async function uploadRawSessions(apiUrl, machineToken, transcriptUploadSources,
       continue;
     }
     try {
-      const encoded = rawUploadBody(session, readTranscript);
+      const encoded = await rawUploadBody(session, readTranscript);
       if (encoded === "too-large") {
         summary.skippedTooLarge += 1;
         summary.outcomes.set(key, "too-large");
@@ -92478,7 +92684,9 @@ var claudeLocal = {
   },
   registration: jsonServerEntry,
   // <project folder>/<session id>.jsonl
-  transcriptSession: (transcriptPath) => ({ externalId: path18.basename(transcriptPath, ".jsonl") })
+  transcriptSession: (transcriptPath) => ({ externalId: path18.basename(transcriptPath, ".jsonl") }),
+  // No Stop hook runs when a person stops a turn or the API fails it.
+  endsWithAbortedTurn: claudeCodeEndsWithAbortedTurn
 };
 var codexLocal = {
   harness: "codex-local",
@@ -92523,7 +92731,16 @@ var codexLocal = {
   transcriptSession(transcriptPath) {
     const identity = rolloutIdentity(transcriptPath);
     return identity.page ? { hookId: identity.threadId } : { externalId: path18.basename(transcriptPath, ".jsonl") };
-  }
+  },
+  // The hook records the rollout of each thread before it appends the
+  // journal line (.claude/hooks/powerplant-codex-transcript.mjs).
+  hookTranscriptPath(threadId2, homeDir) {
+    const sessionsDir = path18.join(homeDir, ".codex", "sessions");
+    return readCodexTranscriptDiscoveryRecord(homeDir, threadId2, [sessionsDir, codexArchivedSessionsDir(sessionsDir)])?.rolloutPath;
+  },
+  // The Codex app holds the rollout of each open thread for writing
+  // (lsof, 2026-09-27), and macOS reports a write to it only on close.
+  holdsTranscriptOpen: true
 };
 var cursorLocal = {
   harness: "cursor-local",
@@ -93204,7 +93421,7 @@ function watchHarnessConnections(deps) {
       }
     }
   };
-  const run = async (harnesses) => {
+  const run2 = async (harnesses) => {
     running = true;
     try {
       const before = /* @__PURE__ */ new Map();
@@ -93226,7 +93443,7 @@ function watchHarnessConnections(deps) {
     if (queued !== null && !stopped) {
       const next = queued === "all" ? void 0 : [...queued];
       queued = null;
-      void run(next);
+      void run2(next);
     }
   };
   const request2 = (harnesses) => {
@@ -93235,7 +93452,7 @@ function watchHarnessConnections(deps) {
       queued = harnesses === void 0 || queued === "all" ? "all" : /* @__PURE__ */ new Set([...queued ?? [], ...harnesses]);
       return;
     }
-    void run(harnesses);
+    void run2(harnesses);
   };
   request2(void 0);
   const timer = setInterval(() => request2(void 0), SIGN_IN_CHECK_INTERVAL_MS);
@@ -93311,14 +93528,14 @@ function startHarnessConnectionChecks(options) {
 }
 
 // ../../apps/syncservice/src/recentCatchup.ts
-function createRecentCatchup(run, now = Date.now) {
+function createRecentCatchup(run2, now = Date.now) {
   let coveredSince = now();
   let nextCheck = coveredSince + 15e3;
   return async () => {
     const started = now();
     if (started < nextCheck) return;
     try {
-      const result = await run(coveredSince - 1e3);
+      const result = await run2(coveredSince - 1e3);
       if (result === false) return;
       const diagnostic = result.diagnostic;
       if (diagnostic?.rawFailed !== 0 || diagnostic.rawMissingMetadata !== 0 || diagnostic.deferred !== 0 || diagnostic.rawUnconfigured !== false) return;
@@ -93429,6 +93646,7 @@ function readIfExists2(p) {
 }
 
 // ../../apps/syncservice/src/previewRegistration.ts
+import { setImmediate as yieldToEventLoop4 } from "node:timers/promises";
 async function registerAnnouncedPreviews(apiUrl, machineToken, collected, memo2, deps = {}) {
   const readTranscript = deps.readTranscript ?? readIfExists;
   const upload = deps.upload ?? uploadPreviewRegistration;
@@ -93444,6 +93662,7 @@ async function registerAnnouncedPreviews(apiUrl, machineToken, collected, memo2,
     const state = memo2.get(key);
     if (state?.foreignOwner || state?.previewsOff) continue;
     if (state?.examinedMtimeMs === session.mtimeMs) continue;
+    await yieldToEventLoop4();
     try {
       const text = readTranscript(session.transcriptPath);
       if (text === null) continue;
@@ -93489,6 +93708,22 @@ async function registerAnnouncedPreviews(apiUrl, machineToken, collected, memo2,
 }
 
 // ../../apps/syncservice/src/sync.ts
+var RecordTurns = class {
+  last = Promise.resolve();
+  /** Waits for the passes ahead, then returns `end`, which lets the next
+   * pass take its turn. Calling `end` again does nothing. */
+  async take() {
+    let end = () => {
+    };
+    const ended = new Promise((resolve2) => {
+      end = resolve2;
+    });
+    const ahead = this.last;
+    this.last = ahead.then(() => ended);
+    await ahead;
+    return end;
+  }
+};
 var defaultPolicyDeps = {
   fetchPolicy: fetchCapturePolicy,
   load: loadCredentials,
@@ -93590,7 +93825,17 @@ async function resolveCapturePolicy(config2, credentials, log3, deps = defaultPo
     environment
   };
 }
-async function runSyncPassInternal(config2, options, diagnostic) {
+function recordTurn(turns) {
+  let end = () => {
+  };
+  return {
+    start: async () => {
+      if (turns) end = await turns.take();
+    },
+    end: () => end()
+  };
+}
+async function runSyncPassInternal(config2, options, diagnostic, turn) {
   const log3 = options.log ?? console.log;
   const credentials = loadCredentials(config2.appEnv);
   if (!credentials) {
@@ -93616,6 +93861,7 @@ async function runSyncPassInternal(config2, options, diagnostic) {
   diagnostic.sinceMs = sinceMs;
   diagnostic.deepSweep = window2.deepSweep;
   const maxSessions = window2.deepSweep ? DEEP_FIRST_SYNC_MAX_SESSIONS : void 0;
+  await turn.start();
   diagnostic.stage = "claude";
   const claude = await collectClaudeCodeSessions({
     sinceMs,
@@ -93726,12 +93972,14 @@ async function runSyncPassInternal(config2, options, diagnostic) {
     credentials.token,
     items
   );
+  turn.end();
   const foreignKeys = new Set(foreignOwned.map(sessionKey));
   const writable = collected.filter(({ item }) => !foreignKeys.has(sessionKey(item)));
   for (const { harness, harnessSessionId } of foreignOwned) {
     log3(`Skipped ${harness} session ${harnessSessionId}: already synced from another machine.`);
   }
   Object.assign(diagnostic, { upserted, unchanged, outOfPolicy, deferred });
+  if (upserted > 0) options.onRecordsUpserted?.();
   log3(
     `Uploaded: ${upserted} session(s) upserted` + (unchanged > 0 ? `, ${unchanged} unchanged (no writes issued)` : "") + "."
   );
@@ -93863,8 +94111,9 @@ async function runSyncPass(config2, options = {}) {
     }
   };
   notify();
+  const turn = recordTurn(options.recordTurns);
   try {
-    const result = await runSyncPassInternal(config2, options, diagnostic);
+    const result = await runSyncPassInternal(config2, options, diagnostic, turn);
     diagnostic.outcome = "complete";
     diagnostic.stage = "complete";
     diagnostic.upserted = result.upserted;
@@ -93877,6 +94126,7 @@ async function runSyncPass(config2, options = {}) {
     if (error63 instanceof Error) failedPasses.set(error63, diagnostic);
     throw error63;
   } finally {
+    turn.end();
     diagnostic.durationMs = Math.max(0, Date.now() - start);
     notify();
   }
@@ -93939,7 +94189,7 @@ function unsupportedVersionNotice(cliVersion2, oldestSupportedVersion) {
 }
 
 // ../../apps/syncservice/src/watch.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync11, watch as fsWatch2 } from "node:fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync11, watch as fsWatch3 } from "node:fs";
 import os19 from "node:os";
 import path21 from "node:path";
 
@@ -93973,7 +94223,7 @@ function defaultStat(file2) {
 }
 
 // ../../apps/syncservice/src/sessionStatusFeed.ts
-import { statSync as statSync5 } from "node:fs";
+import { closeSync as closeSync7, fstatSync as fstatSync3, openSync as openSync7, readSync as readSync5, statSync as statSync5, watch as fsWatch2 } from "node:fs";
 
 // ../../apps/syncservice/src/sessionStatusModel.ts
 function createSessionStatusModel(now = Date.now) {
@@ -93992,6 +94242,7 @@ function createSessionStatusModel(now = Date.now) {
   return {
     applyLifecycleEntry: (entry) => apply(entry.harness, entry.sessionId, { kind: entry.event, atMs: Date.parse(entry.at) }),
     applyTranscriptWrite: (write) => apply(write.harness, write.sessionId, { kind: "transcript-write", atMs: write.atMs }),
+    applyTranscriptTurnEnd: (turnEnd) => apply(turnEnd.harness, turnEnd.sessionId, { kind: "transcript-turn-end", atMs: turnEnd.atMs }),
     expireDeadlines() {
       const nowMs = now();
       const changes = [];
@@ -94024,11 +94275,14 @@ function createSessionStatusModel(now = Date.now) {
 // ../../apps/syncservice/src/sessionStatusFeed.ts
 var TRANSCRIPT_WRITE_DELAY_MS = 500;
 var HELD_HOOK_ENTRIES_MAX = 500;
+var TRANSCRIPT_FILE_WATCHES_MAX = 32;
+var TRANSCRIPT_TAIL_BYTES = 256 * 1024;
 var HOOK_ID_PAIRS_MAX = 1e4;
 var MAX_TIMER_MS = 2 ** 31 - 1;
 function createSessionStatusFeed(deps) {
   const now = deps.now ?? Date.now;
   const adapters = deps.adapters ?? HARNESS_ADAPTERS;
+  const watchFile = deps.watchFile ?? watchFileWrites;
   const model = createSessionStatusModel(now);
   const adapterOf = (harness) => adapters.find((adapter) => adapter.harness === harness);
   const hookIdOf = (harness) => adapterOf(harness)?.hookSessionId;
@@ -94040,8 +94294,35 @@ function createSessionStatusFeed(deps) {
   let readQueued = false;
   let readFailing = false;
   let statFailing = false;
+  let tailFailing = false;
+  let watchFailing = false;
   const writeTimers = /* @__PURE__ */ new Map();
+  const hookFilesRead = /* @__PURE__ */ new Set();
+  const reportedFiles = /* @__PURE__ */ new Map();
+  const fileWatches = /* @__PURE__ */ new Map();
   let stopped = false;
+  function applyJournalEntry(entry) {
+    if (learnFromHookFile(entry.harness, entry.sessionId)) releaseHeld();
+    apply(entry);
+  }
+  function learnFromHookFile(harness, hookId) {
+    const adapter = adapterOf(harness);
+    const hookIdOfStored = adapter?.hookSessionId;
+    const key = pairKey(harness, hookId);
+    if (adapter?.hookTranscriptPath === void 0 || hookIdOfStored === void 0 || hookFilesRead.has(key)) {
+      return false;
+    }
+    hookFilesRead.add(key);
+    const file2 = adapter.hookTranscriptPath(hookId, deps.home);
+    const session = file2 === void 0 ? void 0 : adapter.transcriptSession?.(file2);
+    if (file2 === void 0 || session === void 0) return false;
+    const fileHookId = "externalId" in session ? hookIdOfStored(session.externalId) : session.hookId;
+    if (pairKey(harness, fileHookId) !== key) return false;
+    const externalId = "externalId" in session ? session.externalId : storedIds.get(key);
+    if (externalId === void 0) return false;
+    reportFile(file2, { harness, externalId });
+    return "externalId" in session && learnPair(harness, externalId);
+  }
   function stored(entry) {
     if (hookIdOf(entry.harness) === void 0) return entry;
     const storedId = storedIds.get(pairKey(entry.harness, entry.sessionId));
@@ -94071,8 +94352,20 @@ function createSessionStatusFeed(deps) {
     held = [];
     for (const entry of waiting) apply(entry);
   }
-  function applyWrite(harness, sessionId, atMs) {
-    if (model.applyTranscriptWrite({ harness, sessionId, atMs }) !== null) changedInBatch = true;
+  function applyWrite(harness, sessionId, atMs, endsWithAbortedTurn) {
+    const before = model.status(harness, sessionId);
+    model.applyTranscriptWrite({ harness, sessionId, atMs });
+    const status = model.status(harness, sessionId);
+    if ((status === "working" || status === "unknown") && endsWithAbortedTurn()) {
+      model.applyTranscriptTurnEnd({ harness, sessionId, atMs });
+    }
+    if (model.status(harness, sessionId) !== before) changedInBatch = true;
+  }
+  function fileEndsWithAbortedTurn(harness, transcriptPath) {
+    const endsWithAbortedTurn = adapterOf(harness)?.endsWithAbortedTurn;
+    if (endsWithAbortedTurn === void 0) return false;
+    const tail = transcriptTail(transcriptPath);
+    return tail !== null && endsWithAbortedTurn(tail);
   }
   function applyWatchedWrite(harness, transcriptPath) {
     const session = adapterOf(harness)?.transcriptSession?.(transcriptPath);
@@ -94082,9 +94375,69 @@ function createSessionStatusFeed(deps) {
     const mtimeMs = modifiedMs(transcriptPath);
     if (mtimeMs === null) return;
     const learned = "externalId" in session && learnPair(harness, externalId);
-    applyWrite(harness, externalId, mtimeMs);
+    applyWrite(harness, externalId, mtimeMs, () => fileEndsWithAbortedTurn(harness, transcriptPath));
+    reportFile(transcriptPath, { harness, externalId });
     if (learned) releaseHeld();
   }
+  function reportFile(file2, session) {
+    if (adapterOf(session.harness)?.holdsTranscriptOpen !== true) return;
+    reportedFiles.delete(file2);
+    reportedFiles.set(file2, session);
+  }
+  function needsFileWatch(session) {
+    const status = model.status(session.harness, session.externalId);
+    return status !== void 0 && status !== "ended";
+  }
+  function watchReportedFiles() {
+    for (const [file2, watched] of fileWatches) {
+      if (!needsFileWatch(watched)) closeFileWatch(file2);
+    }
+    const newest = [...reportedFiles].filter(([, session]) => needsFileWatch(session)).slice(-TRANSCRIPT_FILE_WATCHES_MAX);
+    reportedFiles.clear();
+    for (const [file2, session] of newest) {
+      const watched = fileWatches.get(file2);
+      if (watched === void 0) {
+        openFileWatch(file2, session);
+      } else {
+        fileWatches.delete(file2);
+        fileWatches.set(file2, watched);
+      }
+    }
+    while (fileWatches.size > TRANSCRIPT_FILE_WATCHES_MAX) closeFileWatch(fileWatches.keys().next().value);
+  }
+  function openFileWatch(file2, session) {
+    let close2;
+    try {
+      close2 = watchFile(
+        file2,
+        () => noteWrite(session.harness, file2),
+        (error63) => {
+          closeFileWatch(file2);
+          noteWatchFailure(error63);
+        }
+      );
+    } catch (error63) {
+      if (errorCode(error63) !== "ENOENT") noteWatchFailure(error63);
+      return;
+    }
+    if (watchFailing) deps.log("transcript files watched again");
+    watchFailing = false;
+    fileWatches.set(file2, { ...session, close: close2 });
+    const mtimeMs = modifiedMs(file2);
+    if (mtimeMs !== null) {
+      applyWrite(session.harness, session.externalId, mtimeMs, () => fileEndsWithAbortedTurn(session.harness, file2));
+    }
+  }
+  function closeFileWatch(file2) {
+    fileWatches.get(file2)?.close();
+    fileWatches.delete(file2);
+  }
+  function noteWatchFailure(error63) {
+    if (!watchFailing) {
+      deps.log(`\u26A0 transcript file not watched (${errorCode(error63)}), its status waits for hook events and sync passes`);
+    }
+    watchFailing = true;
+  }
   function modifiedMs(transcriptPath) {
     try {
       const mtimeMs = statSync5(transcriptPath).mtimeMs;
@@ -94092,7 +94445,10 @@ function createSessionStatusFeed(deps) {
       statFailing = false;
       return mtimeMs;
     } catch (error63) {
-      if (errorCode(error63) === "ENOENT") return null;
+      if (errorCode(error63) === "ENOENT") {
+        closeFileWatch(transcriptPath);
+        return null;
+      }
       if (!statFailing) {
         deps.log(`\u26A0 transcript file not read (${errorCode(error63)}), its status waits for the next sync pass`);
       }
@@ -94100,6 +94456,27 @@ function createSessionStatusFeed(deps) {
       return null;
     }
   }
+  function transcriptTail(transcriptPath) {
+    let fd;
+    try {
+      fd = openSync7(transcriptPath, "r");
+      const size = fstatSync3(fd).size;
+      const buffer = Buffer.alloc(Math.min(size, TRANSCRIPT_TAIL_BYTES));
+      const bytes = readSync5(fd, buffer, 0, buffer.length, size - buffer.length);
+      if (tailFailing) deps.log("transcript ends readable again");
+      tailFailing = false;
+      return buffer.toString("utf8", 0, bytes);
+    } catch (error63) {
+      if (errorCode(error63) === "ENOENT") return null;
+      if (!tailFailing) {
+        deps.log(`\u26A0 transcript end not read (${errorCode(error63)}), a stopped turn shows as working until its deadline`);
+      }
+      tailFailing = true;
+      return null;
+    } finally {
+      if (fd !== void 0) closeSync7(fd);
+    }
+  }
   function noteWrite(harness, transcriptPath) {
     if (writeTimers.has(transcriptPath)) return;
     const timer = setTimeout(() => {
@@ -94111,8 +94488,10 @@ function createSessionStatusFeed(deps) {
     timer.unref?.();
     writeTimers.set(transcriptPath, timer);
   }
-  const journal = createLifecycleJournalReader(deps.home, void 0, apply);
+  const journal = createLifecycleJournalReader(deps.home, void 0, applyJournalEntry);
   function settle2() {
+    watchReportedFiles();
+    hookFilesRead.clear();
     armDeadline();
     if (!changedInBatch) return;
     changedInBatch = false;
@@ -94158,9 +94537,9 @@ function createSessionStatusFeed(deps) {
       onEvent(change);
     },
     observeSessions(sessions) {
-      for (const { item, mtimeMs } of sessions) {
+      for (const { item, mtimeMs, endsWithAbortedTurn } of sessions) {
         learnPair(item.harness, item.harnessSessionId);
-        applyWrite(item.harness, item.harnessSessionId, mtimeMs);
+        applyWrite(item.harness, item.harnessSessionId, mtimeMs, () => endsWithAbortedTurn === true);
       }
       releaseHeld();
       settle2();
@@ -94169,6 +94548,7 @@ function createSessionStatusFeed(deps) {
       const floorMs = lifecycleJournalRetentionFloorMs(now());
       model.forgetBefore(floorMs);
       held = held.filter((entry) => Date.parse(entry.at) >= floorMs);
+      settle2();
       journal.deleteExpired(now());
     },
     status: (harness, externalId) => model.status(harness, externalId),
@@ -94177,9 +94557,17 @@ function createSessionStatusFeed(deps) {
       if (deadlineTimer) clearTimeout(deadlineTimer);
       for (const timer of writeTimers.values()) clearTimeout(timer);
       writeTimers.clear();
+      for (const watched of fileWatches.values()) watched.close();
+      fileWatches.clear();
     }
   };
 }
+function watchFileWrites(file2, onWrite, onError2) {
+  const watcher = fsWatch2(file2, onWrite);
+  watcher.on("error", onError2);
+  watcher.unref();
+  return () => watcher.close();
+}
 function errorCode(error63) {
   return error63 instanceof Error && "code" in error63 && typeof error63.code === "string" ? error63.code : "unknown";
 }
@@ -94238,6 +94626,8 @@ function createWatchLoop(deps) {
   const newTranscripts = /* @__PURE__ */ new Map();
   let newSessionTimer = null;
   let newSessionPassDue = false;
+  let newSessionRunning = false;
+  let failedBesidePass = null;
   function onEvent(change) {
     if (stopped) return;
     if (change === "lifecycle") lifecycleChanged = true;
@@ -94269,12 +94659,19 @@ function createWatchLoop(deps) {
       newSessionPassDue = false;
       return;
     }
-    if (running || startupOwed || now() < retryNotBefore) return;
+    if (newSessionRunning) return;
+    if (now() < retryNotBefore) {
+      newSessionTimer ??= setTimeout(() => {
+        newSessionTimer = null;
+        void newSessionPass();
+      }, retryNotBefore - now());
+      return;
+    }
     newSessionPassDue = false;
     const transcripts = [...newTranscripts];
     newTranscripts.clear();
     if (transcripts.length === 0) return;
-    running = true;
+    newSessionRunning = true;
     deps.log(`${transcripts.length} new transcript file(s), uploading new session records now`);
     const startedAt = now();
     const known = new Set(knownSessions);
@@ -94284,21 +94681,22 @@ function createWatchLoop(deps) {
         isNew: (session) => !known.has(sessionKey(session.item))
       });
       for (const session of summary.sessions) rememberSession(session);
-      if (summary.upserted > 0) deps.onNewSessionsUploaded?.(now());
     } catch (error63) {
       const holdMs = Math.max(FAILED_PASS_RETRY_MS, retryAfterMs(error63) ?? 0);
       retryNotBefore = Math.max(retryNotBefore, now() + holdMs);
-      deps.onPassResult?.(failedPassResult("new-session", startedAt, error63));
+      const result = failedPassResult("new-session", startedAt, error63);
+      if (running) failedBesidePass = result;
+      else deps.onPassResult?.(result);
       deps.log(
         `new session records not uploaded (${describeError(error63)}), the next pass uploads them in ${describeDelay(holdMs)}`
       );
     }
     for (const [transcript] of transcripts) rememberTranscript(transcript);
-    running = false;
-    runNext("new-session");
+    newSessionRunning = false;
+    void newSessionPass();
   }
-  function runNext(finished) {
-    if (queued === null || finished === "regular" && newSessionPassDue) void newSessionPass();
+  function runNext() {
+    void newSessionPass();
     if (queued === null || running) return;
     const next = queued === "steady" ? "net" : "change";
     queued = null;
@@ -94385,6 +94783,7 @@ function createWatchLoop(deps) {
         upserted: summary.upserted,
         ...summary.diagnostic && { diagnostic: summary.diagnostic }
       });
+      if (failedBesidePass !== null && now() < retryNotBefore) deps.onPassResult?.(failedBesidePass);
     } catch (error63) {
       consecutiveFailures += 1;
       const signature = errorSignature(error63);
@@ -94400,7 +94799,7 @@ function createWatchLoop(deps) {
         Math.min(FAILED_PASS_RETRY_MS * 2 ** (streakCount - 1), FAILED_PASS_BACKOFF_CAP_MS),
         retryAfterMs(error63) ?? 0
       );
-      retryNotBefore = now() + holdMs;
+      retryNotBefore = Math.max(retryNotBefore, now() + holdMs);
       lifecycleChanged ||= consultLifecycle;
       deps.onPassResult?.(failedPassResult(kind, startedAt, error63));
       const failLine = `${kind} pass failed (${describeError(error63)})`;
@@ -94429,8 +94828,9 @@ function createWatchLoop(deps) {
       }
     }
     running = false;
+    failedBesidePass = null;
     scheduleCompletionCheck();
-    runNext("regular");
+    runNext();
   }
   function scheduleCompletionCheck() {
     if (completionTimer) {
@@ -94517,7 +94917,7 @@ function watchEventChange(root, filename) {
 }
 function watchSessionStores(roots, onEvent, onLost) {
   const watchers = roots.map((root) => {
-    const watcher = fsWatch2(root.dir, { recursive: root.recursive }, (_type, filename) => {
+    const watcher = fsWatch3(root.dir, { recursive: root.recursive }, (_type, filename) => {
       const change = watchEventChange(root, filename);
       if (change !== "ignore") onEvent(change);
     });
@@ -94531,10 +94931,12 @@ function watchSessionStores(roots, onEvent, onLost) {
 function newSessionSyncOptions(shared, sinceMs, isNew) {
   return {
     lifecycleJournal: shared.lifecycleJournal,
-    codexThreadLinks: shared.codexThreadLinks,
-    codexThreadReads: shared.codexThreadReads,
     log: shared.log,
     enrollCommand: shared.enrollCommand,
+    onRecordsUpserted: shared.onRecordsUpserted,
+    recordTurns: shared.recordTurns,
+    codexThreadLinks: shared.codexThreadLinks?.copyForSidePass(),
+    codexThreadReads: shared.codexThreadReads?.copyForSidePass(),
     explicitSince: String(STEADY_SYNC_WINDOW_DAYS),
     narrowSinceMs: sinceMs,
     isNewSession: isNew
@@ -94653,6 +95055,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   });
   const writeStatus = (patch) => statusWriter.write(patch);
   writeStatus({});
+  const recordUpload = () => writeStatus({ lastUploadAt: (/* @__PURE__ */ new Date()).toISOString() });
   const diagnostics = createDiagnosticsReporter(() => loadCredentials(config2.appEnv));
   const checkIn = () => {
     let current;
@@ -94734,6 +95137,7 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
   const previewRegistrations = /* @__PURE__ */ new Map();
   const codexThreadLinks = new CodexThreadLinks();
   const codexThreadReads = new CodexThreadReads();
+  const recordTurns = new RecordTurns();
   const loop = createWatchLoop({
     runPass: async (options) => {
       let uploaded = 0;
@@ -94753,7 +95157,9 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
           uploaded += 1;
           if (uploaded === 1 || uploaded % 10 === 0)
             log3(`Transcript progress: ${uploaded} uploaded this pass.`);
-        }
+        },
+        onRecordsUpserted: recordUpload,
+        recordTurns
       };
       const catchUp = createRecentCatchup(async (narrowSinceMs) => {
         if (readCollectorControl(config2.appEnv, home).paused) return false;
@@ -94798,10 +95204,15 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
       }
       return summary;
     },
-    runNewSessionPass: ({ sinceMs, isNew }) => runSyncPass(config2, newSessionSyncOptions({ lifecycleJournal: journal, codexThreadLinks, codexThreadReads, log: log3, enrollCommand: runtime.enrollCommand }, sinceMs, isNew)),
-    // An upload changes what the menu shows, so this write wakes the menu,
-    // and the menu reads the new session from the server.
-    onNewSessionsUploaded: (at) => writeStatus({ lastUploadAt: new Date(at).toISOString() }),
+    runNewSessionPass: ({ sinceMs, isNew }) => runSyncPass(config2, newSessionSyncOptions({
+      lifecycleJournal: journal,
+      log: log3,
+      enrollCommand: runtime.enrollCommand,
+      onRecordsUpserted: recordUpload,
+      recordTurns,
+      codexThreadLinks,
+      codexThreadReads
+    }, sinceMs, isNew)),
     paused: () => readCollectorControl(config2.appEnv, home).paused,
     onPassResult: (result) => writeStatus({
       lastPass: {
@@ -94814,7 +95225,6 @@ function startWatch(config2, homeDir, runtime = { version: "checkout" }) {
         ...result.diagnostic && { diagnostic: result.diagnostic }
       },
       ...result.ok && { lastSyncAt: new Date(result.at).toISOString() },
-      ...result.ok && result.upserted > 0 && { lastUploadAt: new Date(result.at).toISOString() },
       consecutiveFailures: result.ok ? 0 : statusWriter.current.consecutiveFailures + 1
     }),
     reportError: reportCollectorError,
@@ -94897,7 +95307,7 @@ import os20 from "node:os";
 import path23 from "node:path";
 
 // ../../apps/syncservice/src/codexReviewFlags.ts
-import { closeSync as closeSync7, lstatSync as lstatSync5, openSync as openSync7, readSync as readSync5, realpathSync as realpathSync4 } from "node:fs";
+import { closeSync as closeSync8, lstatSync as lstatSync5, openSync as openSync8, readSync as readSync6, realpathSync as realpathSync4 } from "node:fs";
 import path22 from "node:path";
 var pointerSchema = external_exports.object({
   source: external_exports.unknown().optional(),
@@ -94935,14 +95345,14 @@ function readCodexReviewFlags(row, id, home) {
   }
 }
 function readPrefix(file2) {
-  const fd = openSync7(file2, "r");
+  const fd = openSync8(file2, "r");
   const buffer = Buffer.alloc(MAX_PREFIX_BYTES);
   let used = 0;
   let first = -1;
   let second = -1;
   try {
     while (used < buffer.length && second < 0) {
-      const bytes = readSync5(fd, buffer, used, Math.min(4096, buffer.length - used), null);
+      const bytes = readSync6(fd, buffer, used, Math.min(4096, buffer.length - used), null);
       if (bytes === 0) break;
       const end = used + bytes;
       for (let i = used; i < end; i++) {
@@ -94956,7 +95366,7 @@ function readPrefix(file2) {
       used = end;
     }
   } finally {
-    closeSync7(fd);
+    closeSync8(fd);
   }
   if (first < 0 || second < 0) return null;
   try {
@@ -95231,7 +95641,7 @@ function applyLocalSessionFlags(sessions, machineId, localFlags, localKey, claud
     };
   });
 }
-async function fetchMemberSessions(credentials, fetchImpl = fetch, options = { windowHours: RECENT_SESSION_WINDOW_MS / 36e5, limit: RECENT_SESSION_VISIBLE_LIMIT }) {
+async function fetchMemberSessions(credentials, fetchImpl = fetch, options = { windowHours: RECENT_SESSION_WINDOW_MS / 36e5, limit: RECENT_SESSION_PAGE_MAX }) {
   const { windowHours, limit } = recentSessionOptionsSchema.parse(options);
   try {
     const query = new URLSearchParams({ view: "recent", windowHours: String(windowHours), limit: String(limit) });
@@ -95457,7 +95867,7 @@ async function probeClaudeDesktopSessions(wanted, installed, reportFault, root =
 
 // src/menuModel.ts
 import { randomUUID as randomUUID5 } from "node:crypto";
-import { mkdirSync as mkdirSync17, rmSync as rmSync10, watch as fsWatch3 } from "node:fs";
+import { mkdirSync as mkdirSync17, rmSync as rmSync10, watch as fsWatch4 } from "node:fs";
 import path34 from "node:path";
 
 // src/menu.ts
@@ -95487,7 +95897,7 @@ import { accessSync, constants as constants2, readFileSync as readFileSync15 } f
 import path28 from "node:path";
 
 // src/version.ts
-var CLI_VERSION = true ? "0.4.20" : "0.0.0-checkout";
+var CLI_VERSION = true ? "0.4.22" : "0.0.0-checkout";
 var CLI_RELEASE_BUILD = true ? true : false;
 var CLI_PACKAGE_NAME = "@usepowerplant/cli";
 
@@ -96177,8 +96587,8 @@ function syncHeader(i) {
   if (i.credentials && (i.credentials.captureMode === "scope" || i.credentials.allowedRepos !== void 0 || i.credentials.scopePaths?.length || (i.credentials.workspacePolicies?.length ?? 0) > 1 || !i.credentials.allowedOwners?.length)) {
     details.push(describeStoredCaptureSummary(i.credentials));
   }
-  const lastSyncAt = "status" in i.daemon ? i.daemon.status.lastSyncAt : void 0;
-  if (!i.control.paused && (lastSyncAt === void 0 || i.now - Date.parse(lastSyncAt) > 36e5)) {
+  const uploadedAt = lastUploadTime(i);
+  if (!i.control.paused && (uploadedAt === void 0 || i.now - uploadedAt > 36e5)) {
     details.push(lastUploadLine(i));
   }
   return { type: "header", title, ...details.length > 0 && { subtitle: details.join(" \xB7 ") } };
@@ -96186,7 +96596,7 @@ function syncHeader(i) {
 var AGENT_TITLE_MAX = 48;
 function recentAgentItems(i) {
   if (i.memberSessions === null) return null;
-  const recent = i.memberSessions.filter((session) => i.now - Date.parse(session.lastActivityAt) < RECENT_SESSION_WINDOW_MS).filter((session) => session.archived !== true && session.subagent !== true && session.standaloneReview !== true).sort((a, b2) => Date.parse(b2.lastActivityAt) - Date.parse(a.lastActivityAt)).map((session) => agentRow(session, i));
+  const recent = i.memberSessions.filter((session) => i.now - Date.parse(session.lastActivityAt) < RECENT_SESSION_WINDOW_MS).filter((session) => session.archived !== true && session.subagent !== true && session.standaloneReview !== true).sort((a, b2) => Date.parse(b2.lastActivityAt) - Date.parse(a.lastActivityAt)).map((session) => agentRow(session, i)).filter((row) => row.agent?.status !== "ended").sort((a, b2) => Number(b2.agent?.status === "working") - Number(a.agent?.status === "working"));
   const rows = recent.length === 0 ? [{ type: "status", mark: "muted", title: i.memberSessionsIncomplete ? "No sessions found in the partial list" : "No eligible sessions in the latest results" }] : groupedAgentRows(recent.slice(0, RECENT_SESSION_VISIBLE_LIMIT));
   if (i.memberSessionsIncomplete) rows.push({
     type: "status",
@@ -96214,7 +96624,7 @@ function agentRow(session, i) {
   const harness = isLegacySessionSource(session.source) ? harnessFromLegacySessionSource(session.source) : null;
   const harnessName = harness?.kind === "harness" ? harness.harness : session.source;
   const status = localMachine && harness?.kind === "harness" && i.sessionStatus !== void 0 ? i.sessionStatus(harness.harness, session.externalId) ?? "unknown" : void 0;
-  const statusLabel = status === void 0 ? null : LOCAL_SESSION_STATUS_LABELS[status];
+  const statusLabel = status === "waiting" ? LOCAL_SESSION_STATUS_LABELS.waiting : null;
   const desktopSessionId = localMachine && session.source === "claude-code" ? i.claudeDesktopSessions?.get(session.externalId)?.sessionId : void 0;
   const app = desktopSessionId !== void 0 ? "Claude desktop" : isLegacySessionSource(session.source) ? describeSessionSource(session.source) : session.source;
   const links = sessionLinks(session, i.config.webUrl, {
@@ -96298,10 +96708,16 @@ function menuContentKey(payload) {
   });
   return JSON.stringify({ ...shown, desktopDiagnostic: void 0 });
 }
+function lastUploadTime(i) {
+  if (!("status" in i.daemon)) return void 0;
+  const { lastSyncAt, lastUploadAt } = i.daemon.status;
+  const times = [lastSyncAt, lastUploadAt].map((at) => Date.parse(at ?? "")).filter((at) => !Number.isNaN(at));
+  return times.length === 0 ? void 0 : Math.max(...times);
+}
 function lastUploadLine(i) {
-  const lastSyncAt = "status" in i.daemon ? i.daemon.status.lastSyncAt : void 0;
-  if (lastSyncAt === void 0) return "No successful upload yet";
-  return `Last upload ${ago(i.now - Date.parse(lastSyncAt))}`;
+  const uploadedAt = lastUploadTime(i);
+  if (uploadedAt === void 0) return "No successful upload yet";
+  return `Last upload ${ago(i.now - uploadedAt)}`;
 }
 function connectionRow(connection, envArgs, now) {
   const name = CLIENT_NAMES[connection.client];
@@ -97649,14 +98065,14 @@ function createMenuModel(deps) {
     renewDue ||= renew;
     if (stopped || sources === null || awaitingRefresh || renderPending) return;
     renderPending = true;
-    const run = () => {
+    const run2 = () => {
       renderPending = false;
       renderTimer = null;
       if (!stopped) renderNow();
     };
     const wait = lastContentWriteAt + MENU_WRITE_INTERVAL_MS - now();
-    if (wait <= 0) queueMicrotask(run);
-    else renderTimer = setTimeout(run, wait);
+    if (wait <= 0) queueMicrotask(run2);
+    else renderTimer = setTimeout(run2, wait);
   }
   function renderNow() {
     if (sources === null || awaitingRefresh) return;
@@ -97894,7 +98310,7 @@ function startMenuModel(sources) {
         const dir = path34.dirname(menuRefreshRequestPath(appEnv, host.home));
         mkdirSync17(dir, { recursive: true, mode: 448 });
         const openFile = path34.basename(menuOpenRequestPath(appEnv, host.home));
-        const watcher = fsWatch3(dir, (_event, filename) => onRequest(filename === openFile ? "menu-open" : "command"));
+        const watcher = fsWatch4(dir, (_event, filename) => onRequest(filename === openFile ? "menu-open" : "command"));
         watcher.on("error", onLost);
         return () => watcher.close();
       },
@@ -97906,12 +98322,12 @@ function startMenuModel(sources) {
 // src/cli.ts
 import { spawn as spawn4 } from "node:child_process";
 import { randomUUID as randomUUID6 } from "node:crypto";
-import { mkdirSync as mkdirSync20, openSync as openSync10, realpathSync as realpathSync5 } from "node:fs";
+import { mkdirSync as mkdirSync20, openSync as openSync11, realpathSync as realpathSync5 } from "node:fs";
 import path37 from "node:path";
 import { parseArgs } from "node:util";
 
 // src/doctor.ts
-import { closeSync as closeSync8, fstatSync as fstatSync3, openSync as openSync8, readSync as readSync6 } from "node:fs";
+import { closeSync as closeSync9, fstatSync as fstatSync4, openSync as openSync9, readSync as readSync7 } from "node:fs";
 var DOCTOR_LOG_TAIL_LINES = 50;
 var LOG_TAIL_READ_BYTES = 256 * 1024;
 function installLine(install) {
@@ -97927,23 +98343,23 @@ function redactedLogTail(raw) {
 function readDoctorLogTail(path38) {
   let fd;
   try {
-    fd = openSync8(path38, "r");
+    fd = openSync9(path38, "r");
   } catch (error63) {
     if (error63.code === "ENOENT") return { path: path38, lines: null };
     return { path: path38, lines: null, readError: error63 instanceof Error ? error63.message : String(error63) };
   }
   try {
-    const size = fstatSync3(fd).size;
+    const size = fstatSync4(fd).size;
     const offset = Math.max(0, size - LOG_TAIL_READ_BYTES);
     const buffer = Buffer.alloc(Math.min(size, LOG_TAIL_READ_BYTES));
-    readSync6(fd, buffer, 0, buffer.length, offset);
+    readSync7(fd, buffer, 0, buffer.length, offset);
     let text = buffer.toString("utf8");
     if (offset > 0) text = text.slice(text.indexOf("\n") + 1);
     return { path: path38, lines: redactedLogTail(text) };
   } catch (error63) {
     return { path: path38, lines: null, readError: error63 instanceof Error ? error63.message : String(error63) };
   } finally {
-    closeSync8(fd);
+    closeSync9(fd);
   }
 }
 function renderDoctorReport(i) {
@@ -97960,7 +98376,7 @@ function renderDoctorReport(i) {
   );
   const unsupported = unsupportedVersionNotice(i.cliVersion, i.oldestSupportedVersion);
   if (unsupported !== null) lines.push(unsupported);
-  lines.push(`Environment: ${i.config.appEnv} (API ${i.config.apiUrl})`);
+  lines.push(`Environment: ${i.config.appEnv} (API ${i.credentials?.apiUrl ?? i.config.apiUrl})`);
   lines.push(`Node: ${i.nodeVersion} (${i.platform})`);
   lines.push(installLine(i.install));
   lines.push(enrollmentLine(i));
@@ -98198,7 +98614,7 @@ function pausedSince(control, now) {
 }
 function pausedNotice(control, resumeCommand2, now) {
   if (!control.paused) return null;
-  return `! ${pausedSince(control, now)}. Nothing uploads until you run \`${resumeCommand2}\`.`;
+  return `! ${pausedSince(control, now)}. To resume sync, run \`${resumeCommand2}\`.`;
 }
 function pausedSyncNotice(control, resumeCommand2, now, dryRun) {
   if (!control.paused || dryRun) return pausedNotice(control, resumeCommand2, now);
@@ -98218,7 +98634,7 @@ async function offerResume(deps, options) {
     );
     return "resumed";
   }
-  output2.log(`Nothing uploads until you run \`${deps.resumeCommand}\``);
+  output2.log(`To resume sync, run \`${deps.resumeCommand}\``);
   return "still-paused";
 }
 async function confirmResume(deps, output2) {
@@ -98403,7 +98819,7 @@ async function runInit(deps) {
   if (pauseOffer === "still-paused") {
     command.log("! Syncing is paused");
     command.log("");
-    command.detail(`Nothing uploads until you run \`${deps.pause.resumeCommand}\``);
+    command.detail(`To resume sync, run \`${deps.pause.resumeCommand}\``);
     if (connectIncomplete) command.detail(`Finish MCP setup: \`${deps.connectCommand}\``);
     return "paused";
   }
@@ -98558,113 +98974,187 @@ function runResumeSession(source, sessionId, deps = {}) {
 }
 
 // src/statusReport.ts
-function automaticUpdatesLine(control) {
-  switch (automaticUpdatesChoice(control)) {
-    case "on":
-      return "Automatic updates: on, the background sync installs new releases within an hour.";
-    case "off":
-      return "Automatic updates: off, turn on with: powerplant update --automatic on";
-    case "not-chosen":
-      return "Automatic updates: not turned on yet, keep this CLI current with: powerplant update --automatic on";
-  }
+var block = (line, ...details) => ({ line, details });
+function run(i, args) {
+  return `\`powerplant ${args}${i.config.appEnv === "production" ? "" : ` --env ${i.config.appEnv}`}\``;
+}
+function renderStatus(i, out) {
+  const stopping = syncProblems(i);
+  const sections = [
+    ...stopping.map((problem) => [problem]),
+    machineBlock(i, stopping.length === 0),
+    ...warnings(i).map((warning2) => [warning2]),
+    i.connections.map((connection) => mcpBlock(i, connection)),
+    [cliBlock(i, stopping.length === 0)]
+  ];
+  sections.filter((section) => section.length > 0).forEach((section, index) => {
+    if (index > 0) out.log("");
+    for (const { line, details } of section) {
+      out.log(line);
+      details.forEach(out.detail);
+    }
+  });
 }
-function renderStatus(i) {
-  const lines = [];
-  if (i.config.appEnv !== "production") lines.push(`Environment: ${i.config.appEnv} (API ${i.config.apiUrl})`);
+function daemonStatus(i) {
+  return "status" in i.daemon ? i.daemon.status : null;
+}
+function syncProblems(i) {
   if (i.credentialsError !== void 0) {
-    lines.push(`\u2717 ${i.credentialsError}`);
-  } else if (!i.credentials) {
-    lines.push("Not enrolled, run: powerplant init");
-  } else {
-    const orgLine = i.credentials.orgName ? ` into org "${i.credentials.orgName}"` : " (org not recorded, re-enroll to see it)";
-    lines.push(
-      `Enrolled as "${i.credentials.machineName}" (${i.credentials.machineId})${orgLine} on ${i.credentials.enrolledAt}.`
+    return [block(`\u2717 ${i.credentialsError}`, `Run ${run(i, "init")} to enroll again.`)];
+  }
+  if (i.credentials === null) return [block("! Not enrolled", `Run ${run(i, "init")}.`)];
+  const problems = [];
+  if (i.control.paused) {
+    problems.push(block(`! ${pausedSince(i.control, i.now)}`, `To resume sync, run ${run(i, "resume")}.`));
+  }
+  const service = serviceProblem(i);
+  if (service !== null) problems.push(service);
+  const status = i.daemon.state === "running" && !i.control.paused ? i.daemon.status : null;
+  const lastPass = status?.lastPass;
+  if (status && lastPass && !lastPass.ok) {
+    const failures = status.consecutiveFailures;
+    problems.push(
+      block(
+        `\u2717 Last sync failed, ${lastPass.error ?? "unknown error"}`,
+        `${failures} failure${failures === 1 ? "" : "s"} in a row. Run ${run(i, "doctor")} for diagnostics.`
+      )
     );
-    lines.push(`${describeStoredCaptureSummary(i.credentials)}.`);
-    for (const entry of i.protectedSessions ?? []) {
-      const sessions = `${entry.sessionCount} recent agent session${entry.sessionCount === 1 ? "" : "s"}`;
-      lines.push(
-        protectedRootReview(i.credentials, entry.root) === "blocked" ? `! macOS is blocking Powerplant from reading ${entry.displayRoot} (${sessions}). Those sessions are staying local. ${MACOS_BLOCKED_FOLDER_REMEDY}` : `! Repository matching is not enabled for ${sessions} under ${entry.displayRoot}. Sessions outside folders you explicitly added are staying local, run \`powerplant init\` to review Git repository scanning.`
-      );
-    }
   }
-  const paused = pausedNotice(i.control, i.resumeCommand, i.now);
-  if (paused !== null) lines.push(paused);
-  lines.push(automaticUpdatesLine(i.control));
+  return problems;
+}
+function unavailableProbe(i) {
+  return block(
+    `! Background sync status unavailable${i.serviceError ? `, ${i.serviceError}` : ""}`,
+    `Run ${run(i, "doctor")} for diagnostics.`
+  );
+}
+function serviceProblem(i) {
   switch (i.service) {
     case "unavailable":
-      lines.push(`Background sync: status unavailable${i.serviceError ? `, ${i.serviceError}` : ""}. Run powerplant doctor${i.config.appEnv === "production" ? "" : ` --env ${i.config.appEnv}`} for diagnostics.`);
       break;
     case "unsupported":
-      lines.push(
-        "Background sync: unsupported on this platform (macOS-only for now), run `powerplant sync` on a schedule instead."
+      return block(
+        "! Background sync is not supported on this platform yet",
+        `Run ${run(i, "sync")} on a schedule instead.`
       );
-      break;
     case "not-installed":
-      lines.push("Background sync: not installed, run: powerplant init");
-      break;
+      return block("! Background sync is not installed", `Run ${run(i, "init")}.`);
     case "not-loaded":
-      lines.push("Background sync: installed but not loaded, run: powerplant restart");
-      break;
+      return block("! Background sync is installed but not loaded", `Run ${run(i, "restart")}.`);
     case "loaded":
-      lines.push(...renderDaemon(i));
       break;
   }
-  lines.push(
-    `CLI: powerplant ${i.cliVersion}` + (isUpdateAvailable(i.cliVersion, i.latestVersion) ? `, ${i.latestVersion} is available: powerplant update` : "")
-  );
-  const unsupported = unsupportedVersionNotice(i.cliVersion, i.oldestSupportedVersion);
-  if (unsupported !== null) lines.push(unsupported);
-  return lines;
-}
-function renderDaemon(i) {
-  if (i.daemon.state === "unreadable") {
-    return [
-      "Background sync: loaded, but its status file is unreadable (written by a different version?), run: powerplant restart"
-    ];
-  }
-  if (i.daemon.state === "not-running") {
-    return [
-      `Background sync: loaded, but no background sync status is available, starting up, or running a version from before status reporting. If this persists: powerplant restart. Log: ${serviceLogPath(i.config.appEnv)}`
-    ];
+  switch (i.daemon.state) {
+    case "unreadable":
+      return block(
+        "! Background sync status file is unreadable",
+        `A different version may have written it. Run ${run(i, "restart")}.`
+      );
+    case "not-running":
+      if (i.service === "unavailable") return unavailableProbe(i);
+      return block(
+        "! Background sync has not reported its status",
+        `It may still be starting. If this persists, run ${run(i, "restart")}.`,
+        `The log is at ${serviceLogPath(i.config.appEnv)}.`
+      );
+    case "stalled":
+      return block(`\u2717 Background sync stalled, no heartbeat for ${duration3(i.daemon.staleMs)}`, `Run ${run(i, "restart")}.`);
+    case "running":
+      return null;
   }
-  const status = i.daemon.status;
-  const lines = [];
-  if (i.daemon.state === "stalled") {
-    lines.push(
-      `\u2717 Background sync stalled, no heartbeat for ${duration3(i.daemon.staleMs)} (pid ${status.pid}). Run: powerplant restart`
-    );
-  } else {
-    lines.push(
-      `Background sync: running${i.control.paused ? ", syncing paused" : ""} (version ${status.version}, pid ${status.pid}, started ${status.startedAt}).`
+}
+function machineBlock(i, syncing) {
+  const credentials = i.credentials;
+  if (credentials === null) return [];
+  const org = credentials.orgName;
+  const line = syncing ? `\u2713 Syncing ${credentials.machineName}${org ? ` to ${org}` : ""}` : `${credentials.machineName}${org ? ` in ${org}` : ""}`;
+  const details = [`${describeStoredCaptureSummary(credentials)}.`];
+  const status = daemonStatus(i);
+  if (status !== null) {
+    const signals = describeSyncSignals(
+      {
+        lastSessionActivityAt: status.lastUploadAt ?? null,
+        lastCheckedInAt: status.lastPass?.at ?? null,
+        syncPaused: null,
+        lastSyncErrorAt: status.lastPass && !status.lastPass.ok ? status.lastPass.at : null
+      },
+      new Date(i.now),
+      "last upload unmeasured"
     );
+    details.push(signals ?? "No sync has run since background sync started.");
   }
-  if (status.version !== i.cliVersion) {
-    lines.push(
-      `  The daemon is on ${status.version}, this CLI is ${i.cliVersion}, it restarts onto the installed version within minutes, or now via: powerplant restart`
+  return [block(line, ...details)];
+}
+function warnings(i) {
+  const found = [];
+  if (isUnsupportedVersion(i.cliVersion, i.oldestSupportedVersion)) {
+    found.push(
+      block(
+        `! powerplant ${i.cliVersion} is no longer supported, the oldest supported is ${i.oldestSupportedVersion}`,
+        `Run ${run(i, "update")} (or npm install -g @usepowerplant/cli). Unsupported versions can stop working without notice.`
+      )
     );
   }
-  const signals = describeSyncSignals(
-    {
-      lastSessionActivityAt: status.lastUploadAt ?? null,
-      lastCheckedInAt: status.lastPass?.at ?? null,
-      syncPaused: null,
-      lastSyncErrorAt: status.lastPass && !status.lastPass.ok ? status.lastPass.at : null
-    },
-    new Date(i.now),
-    "last upload unmeasured"
-  );
-  lines.push(signals === null ? "  No pass has run yet in this run." : `  ${signals}`);
-  if (status.lastPass && !status.lastPass.ok) {
-    lines.push(
-      `  \u2717 Last pass failed: ${status.lastPass.error ?? "unknown error"} (${status.consecutiveFailures} consecutive failure${status.consecutiveFailures === 1 ? "" : "s"}).`
+  for (const entry of i.protectedSessions ?? []) {
+    const sessions = `${entry.sessionCount} recent agent session${entry.sessionCount === 1 ? "" : "s"}`;
+    const staying = entry.sessionCount === 1 ? "is staying local" : "are staying local";
+    found.push(
+      i.credentials !== null && protectedRootReview(i.credentials, entry.root) === "blocked" ? block(
+        `! macOS is blocking Powerplant from reading ${entry.displayRoot}`,
+        `${sessions} ${staying}. ${MACOS_BLOCKED_FOLDER_REMEDY}`
+      ) : block(
+        `! ${sessions} under ${entry.displayRoot} ${staying}`,
+        `Run ${run(i, "init")} to review Git repository scanning.`
+      )
     );
   }
-  for (const hook of status.hooks ?? []) {
+  if (i.service === "unavailable" && i.daemon.state !== "not-running") found.push(unavailableProbe(i));
+  if (i.mcpPreferencesError !== void 0) found.push(block("! MCP choices can't be read", i.mcpPreferencesError));
+  for (const hook of daemonStatus(i)?.hooks ?? []) {
     const silence = hookWarning(hook, i.now);
-    if (silence) lines.push(`  ! ${silence.problem}. ${silence.fix}`);
+    if (silence) found.push(block(`! ${silence.problem}`, silence.fix));
   }
-  return lines;
+  return found;
+}
+function mcpBlock(i, connection) {
+  const name = `${AGENT_DISPLAY_NAMES[connection.client]}${connection.target ? ` (${connection.target})` : ""}`;
+  const fix = `Run ${run(i, `connect --client ${connection.client}`)}.`;
+  const current = connectionIsCurrent(connection, i.now);
+  const checked = current ? "" : `, checked ${ago(i.now - Date.parse(connection.checkedAt))}`;
+  switch (connection.state) {
+    case "signed-in":
+      return block(`${current ? "\u2713 " : ""}${name}: MCP connected${checked}`);
+    case "sign-in-needed":
+      return block(`! ${name}: MCP sign-in needed${checked}`, fix);
+    case "different-url":
+      return block(
+        `! ${name}: MCP points at a different Powerplant${connection.registeredUrl ? `, ${connection.registeredUrl}` : ""}`,
+        fix
+      );
+    case "not-connected":
+      return i.mcpPreferences?.clients[connection.client]?.optedIn === true ? block(`! ${name}: MCP not connected`, fix) : block(`${name}: MCP not connected`);
+    case "configured":
+      return block(`${name}: MCP configured, sign-in unknown`);
+    case "check-failed":
+      return block(`${name}: MCP check failed${connection.detail ? `, ${connection.detail}` : ""}`);
+  }
+}
+function cliBlock(i, syncing) {
+  const details = [];
+  if (i.daemon.state === "running" && i.daemon.status.version !== i.cliVersion) {
+    details.push(
+      `Background sync is on ${i.daemon.status.version}. It restarts onto the installed version within minutes, or now with ${run(i, "restart")}.`
+    );
+  }
+  const automatic = automaticUpdatesChoice(i.control);
+  const version2 = `powerplant ${i.cliVersion}`;
+  if (isUpdateAvailable(i.cliVersion, i.latestVersion) && !isUnsupportedVersion(i.cliVersion, i.oldestSupportedVersion)) {
+    return block(`${version2}, ${i.latestVersion} is available`, ...details, `Run ${run(i, "update")}.`);
+  }
+  if (automatic === "not-chosen" && syncing) {
+    details.push(`Turn them on with ${run(i, "update --automatic on")}.`);
+  }
+  return block(`${version2}, automatic updates ${automatic === "on" ? "on" : "off"}`, ...details);
 }
 function statusJson(i) {
   return {
@@ -98702,7 +99192,9 @@ function statusJson(i) {
     daemon: "status" in i.daemon ? { state: i.daemon.state, ...i.daemon.status } : { state: i.daemon.state },
     paused: i.control.paused,
     automaticUpdates: automaticUpdatesChoice(i.control),
-    pausedAt: i.control.pausedAt ?? null
+    pausedAt: i.control.pausedAt ?? null,
+    // The same saved checks the human rendering reads, each with when it ran.
+    mcpConnections: i.connections
   };
 }
 function supportedFlag(cliVersion2, oldestSupportedVersion) {
@@ -98864,7 +99356,7 @@ function createTerminalOutput(options) {
 
 // src/credentialUpgrade.ts
 import { spawn as spawn3 } from "node:child_process";
-import { closeSync as closeSync9, mkdirSync as mkdirSync18, openSync as openSync9 } from "node:fs";
+import { closeSync as closeSync10, mkdirSync as mkdirSync18, openSync as openSync10 } from "node:fs";
 import path35 from "node:path";
 async function prepareCredentialUpgrade(deps) {
   if (!deps.needsMigration() || !deps.serviceExists() || deps.ready()) return "ready";
@@ -98899,7 +99391,7 @@ async function prepareCredentialUpgrade(deps) {
 }
 async function tryCredentialUpgradeLock(file2) {
   mkdirSync18(path35.dirname(file2), { recursive: true, mode: 448 });
-  closeSync9(openSync9(file2, "a", 384));
+  closeSync10(openSync10(file2, "a", 384));
   const child = spawn3("/usr/bin/lockf", ["-k", "-s", "-t", "0", file2, "/bin/sh", "-c", "printf 'ready\\n'; exec /bin/cat >/dev/null"], {
     detached: true,
     stdio: ["pipe", "pipe", "ignore"]
@@ -99639,12 +100131,12 @@ The access you granted these agents stays on your Powerplant account until you r
         latestVersion,
         oldestSupportedVersion,
         protectedSessions,
-        resumeCommand: pause.resumeCommand,
+        connections: readHarnessConnections(config2.appEnv, realReadTextFile),
+        ...readMcpPreferencesForMenu(config2.appEnv),
         now: Date.now()
       };
-      console.log(
-        values.json ? JSON.stringify(statusJson(inputs), null, 2) : renderStatus(inputs).map(styledFor(process.stdout)).join("\n")
-      );
+      if (values.json) console.log(JSON.stringify(statusJson(inputs), null, 2));
+      else renderStatus(inputs, terminal.command);
       return;
     }
     case "doctor": {
@@ -99979,7 +100471,7 @@ function startBackgroundUpdate(config2, target) {
     writeProgress: updateProgress.write,
     spawnChild: () => {
       mkdirSync20(path37.dirname(updateLogPath()), { recursive: true });
-      const log3 = openSync10(updateLogPath(), "a");
+      const log3 = openSync11(updateLogPath(), "a");
       const child = spawn4(process.execPath, [entryPath(), "update", ...envArgsFor(config2)], {
         detached: true,
         stdio: ["ignore", log3, log3],
@@ -100093,4 +100585,4 @@ undici/lib/web/websocket/frame.js:
   (*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> *)
 */
 
-//# debugId=9f447c4d-0ccb-5f45-8960-6853e28aadfb
+//# debugId=91b4b5e6-fdd5-5127-9372-913ad2bc7af5