aegiscode 6.4.0 → 6.5.1

package/README.md

@@ -54,6 +54,10 @@ older AEGIS CLI left in `~/.aegiscode/config.json` is picked up and copied into
 the 0600 store automatically — `/cloud status` says so if the plaintext copy is
 still there.
 
+That one file is shared: the MCP plugin and AEGIS Desktop read the same store, so
+signing in here signs you in everywhere (see [One memory, shared with AEGIS
+Desktop](#one-memory-shared-with-aegis-desktop)).
+
 ## Use
 
 ```bash
@@ -139,7 +143,7 @@ a *provider* key, so that advice sent the AEGIS key into the wrong slot. It is
 now the in-band way to set the account key, and `/logout` removes it.
 
 Conversation sync is the same `conversationSyncPush/Pull` surface the desktop
-uses, over the sessions this host already keeps in `~/.aegiscode/history.jsonl`:
+uses, over the sessions this host keeps in `~/.aegiscode/history.jsonl`:
 
 ```bash
 /sync                 # push what is pending, then pull — the one you want
@@ -156,6 +160,31 @@ out, not as "sync failed". Imported remote sessions land in the same store
 `/resume` reads, and are marked `imported` with estimated token counts — never
 passed off as measured here.
 
+## One memory, shared with AEGIS Desktop
+
+`~/.aegiscode/` is the data dir for **every** AEGIS host — this CLI, AEGIS
+Desktop and the MCP plugin built on the same account:
+
+| File | What it holds | Written by |
+|---|---|---|
+| `credentials.json` | the account key, mode 0600 | `aegiscode login`, `/key`, the desktop's Settings pane |
+| `sessions.json` | every conversation, one record per session | both hosts, live |
+| `history.jsonl` | this host's per-exchange ledger (feeds `/cost`) | the CLI |
+| `config.json` | preferences, permissions | the CLI |
+
+Sign in once and all three hosts are signed in: they resolve the key with the
+same precedence (`$AEGIS_API_KEY` → `credentials.json` → an older `config.json`),
+and when two hosts hold a key the **most recently saved one wins** — so rotating
+it from the terminal does not leave the app 401-ing on a stale string.
+
+Sessions are shared too, and not only through the cloud. `/resume` lists a
+thread typed in the desktop, and the desktop's session list shows a thread typed
+here — same file, no sync and no network. An upgrade adopts a desktop install's
+private `sessions.json` into the shared store once, so no existing conversation
+is lost. Records carry `origin`, and terminal sessions are **not** enrolled in
+the desktop's push queue (that would spend the account's synced-token quota as a
+side effect of typing in a shell); this host's own `/sync` covers them.
+
 There are currently **no** `unavailable` commands: every entry in the registry
 either runs or is a real handler that says honestly what it cannot do.
 
@@ -216,9 +245,11 @@ What the loop does, in the order a turn happens:
   `/resume` the session list, `?` the shortcut grid, `ctrl+o` permissions, and a
   centred Yes/No dialog when a mutating tool needs approval. `Esc` closes an
   overlay, and clears the input line when nothing is open.
-- **Every turn is persisted** to `~/.aegiscode/history.jsonl`, with a transcript
-  checkpoint alongside it, so `/resume`, `/cost`, `/clear` and `/rewind` all have
-  something real to read. On exit the session prints how to come back to it.
+- **Every turn is persisted** to `~/.aegiscode/history.jsonl` and mirrored into
+  the shared `~/.aegiscode/sessions.json`, with a transcript checkpoint alongside
+  them, so `/resume`, `/cost`, `/clear` and `/rewind` all have something real to
+  read — and the desktop app sees the same conversations. On exit the session
+  prints how to come back to it.
 
 Anything that is not a real terminal — a pipe, `-p`, a CI run — stays a linear
 transcript written once to scrollback, so output remains pipeable and

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "aegiscode",
   "productName": "AEGIS Code",
-  "version": "6.4.0",
+  "version": "6.5.1",
   "description": "aegiscode \u2014 the command-line version of AEGIS Desktop. The shared tool surface in your shell, over the same thin transport and tool registry as the MCP plugin and the desktop app. Ships transport + UI only; no brain.",
   "author": {
     "name": "AEGIS Code",

package/scripts/predist.mjs

@@ -38,6 +38,11 @@ const VENDOR = path.join(CLI_DIR, 'vendor');
 const FILES = [
   'client/aegis.js',
   'client/foreign-memory.js',
+  // The account credential store and the unified session store. Shared with the
+  // desktop app and the MCP plugin so all three see one key and one session
+  // list; `src/shared.js` resolves them from here in an installed package.
+  'client/credentials.js',
+  'client/session-store.js',
   'mcp/tools.js',
   'desktop/renderer/usage.js',
   // The agent-loop engine (persistent shell, editFile/grep/exec, Task

package/src/commands.js

@@ -726,7 +726,7 @@ const COMMANDS = [
     desc: 'Switch to a previous session',
     handler: async (c) => {
       const items = readResumeList();
-      if (!items.length) { note(c, 'No previous sessions found in ~/.aegiscode/history.jsonl'); c.render(); return true; }
+      if (!items.length) { note(c, 'No previous sessions found — conversations from this host and from AEGIS Desktop both land in ~/.aegiscode/sessions.json'); c.render(); return true; }
       c.openOverlay({ type: 'resume', items, sel: 0 });
       return true;
     },

package/src/config.js

@@ -13,14 +13,16 @@
  */
 
 const fs = require('node:fs');
-const os = require('node:os');
 const path = require('node:path');
 
-/** Data directory: $AEGISCODE_HOME or ~/.aegiscode. */
-function aegisDir() {
-  const override = process.env.AEGISCODE_HOME;
-  if (override && String(override).trim()) return path.resolve(String(override).trim());
-  return path.join(os.homedir(), '.aegiscode');
+// The data dir is defined once, in the shared credential module, because the
+// desktop app and the MCP plugin now read and write the same store: a second
+// definition here is how the hosts would drift back apart.
+const { credentials } = require('./shared.js');
+
+/** Data directory: $AEGISCODE_HOME or ~/.aegiscode (see client/credentials.js). */
+function aegisDir(env) {
+  return credentials.aegisHome(env);
 }
 
 function configPath() {

package/src/credentials.js

@@ -3,321 +3,28 @@
 /**
  * The AEGIS account credential store for the terminal host.
  *
- * Before this module the CLI had exactly one way to be given a key: an
- * `AEGIS_API_KEY` environment variable, checked as `process.env.AEGIS_API_KEY`
- * at five separate call sites. A shell export does not survive a new terminal,
- * a reboot, an SSH session or a desktop launcher, so every one of those turned
- * the product back into "no key — export one" with no in-band way to fix it:
- * `/byok-set` stores *provider* keys server-side and `/login` is one of the
- * reference commands this host deliberately marks unavailable. The only
- * credential the CLI could not accept was its own.
+ * The implementation moved to `client/credentials.js` — the tree every host in
+ * this repo already bundles — because the desktop app and the MCP plugin read
+ * the same file now. Before that move the MCP host took its key from the
+ * environment only (it ships as `mcp/` + `client/`, so it could not require this
+ * directory), which meant `aegiscode login` made the CLI work and left the
+ * plugin saying "No AEGIS_API_KEY is set".
  *
- * Resolution order, first hit wins:
+ * This module stays as the CLI's name for that store, so the resolution order,
+ * the 0600 write and the legacy-adoption behaviour are unchanged for every
+ * existing caller and test:
  *
- *   1. `AEGIS_API_KEY` — the environment, so CI and `--key` keep working and
- *      nothing written here can shadow an explicit export.
+ *   1. `AEGIS_API_KEY` — the environment, so CI and an explicit export keep
+ *      working and nothing written here can shadow them.
  *   2. `credentials.json` in the data dir, mode 0600. The writable store.
  *   3. `config.json`'s `aegiscloud.api_key` / `memory.token` — the shape an
- *      earlier AEGIS CLI left in the same data dir. Read, never written, and
- *      never deleted: it is another product's file and the user's key is in
- *      it. When one is found it is *also* copied into credentials.json so the
- *      next run reads the 0600 copy, and `/cloud status` says the plaintext
- *      copy is still there rather than silently leaving it.
+ *      earlier AEGIS CLI left in the same data dir. Read, never written or
+ *      deleted; adopted into the 0600 store once so the next run reads that.
  *
- * The key is never printed in full by anything in this package; callers mask it
- * with format.js's maskKey.
+ * A re-export, not a copy: two implementations is how the CLI and the plugin
+ * would come to disagree about which key is configured.
  */
 
-const fs = require('node:fs');
-const path = require('node:path');
-const { aegisDir, configPath } = require('./config.js');
+const shared = require('./shared.js');
 
-const KEY_ENV = 'AEGIS_API_KEY';
-/** Optional override for the memory token (cloud sync's own credential). */
-const MEMORY_ENV = 'AEGIS_MEMORY_TOKEN';
-const CREDENTIALS_FILE = 'credentials.json';
-const FILE_MODE = 0o600;
-const DIR_MODE = 0o700;
-
-function credentialsPath() {
-  return path.join(aegisDir(), CREDENTIALS_FILE);
-}
-
-/**
- * Accept the key in the shapes a user actually pastes it.
- *
- * Copy-paste from a dashboard, a `.env` line, a shell profile or a chat message
- * are all realistic — and pasting `AEGIS_API_KEY=aegis_…` or `"aegis_…"` into a
- * prompt that stores the literal string produces an auth failure the user
- * cannot see the cause of, because the key *looks* right in the status line.
- */
-function normalizeApiKey(raw) {
-  let s = String(raw == null ? '' : raw).trim();
-  if (!s) return '';
-  s = s.replace(/^export\s+/i, '').trim();
-  const assignment = /^[A-Za-z_][A-Za-z0-9_]*\s*=\s*(.+)$/s.exec(s);
-  if (assignment) s = assignment[1].trim();
-  s = s.replace(/^["']|["']$/g, '').trim();
-  s = s.replace(/^Bearer\s+/i, '').trim();
-  return s;
-}
-
-/**
- * Shape check only — no network. Catches the two mistakes that are structural
- * (an empty paste, and a wrapped/truncated multi-line paste) so the caller can
- * refuse before spending a verification round trip.
- */
-function validateApiKey(raw) {
-  const key = normalizeApiKey(raw);
-  if (!key) return { ok: false, key, reason: 'empty', message: 'no key given' };
-  if (/\s/.test(key)) {
-    return {
-      ok: false,
-      key,
-      reason: 'whitespace',
-      message: 'that looks like more than one word — paste just the key',
-    };
-  }
-  if (key.length < 16) {
-    return {
-      ok: false,
-      key,
-      reason: 'too short',
-      message: `that key is ${key.length} characters — AEGIS keys are longer than that`,
-    };
-  }
-  return { ok: true, key, reason: null, message: null };
-}
-
-/** The stored credential object, or {} — never throws on a missing/corrupt file. */
-function readCredentials() {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(credentialsPath(), 'utf8'));
-    if (parsed && typeof parsed === 'object') return parsed;
-  } catch {}
-  return {};
-}
-
-/**
- * Merge a patch into the store, creating it 0600 (and tightening an existing
- * file that is wider — a key file that a previous run left 0644 is exactly the
- * leak this file exists to avoid).
- */
-function writeCredentials(patch) {
-  const next = { ...readCredentials(), ...patch, version: 1 };
-  try {
-    fs.mkdirSync(aegisDir(), { recursive: true, mode: DIR_MODE });
-    const target = credentialsPath();
-    const tmp = target + '.tmp';
-    fs.writeFileSync(tmp, JSON.stringify(next, null, 2) + '\n', { mode: FILE_MODE });
-    fs.renameSync(tmp, target);
-    try {
-      fs.chmodSync(target, FILE_MODE);
-    } catch {}
-  } catch (e) {
-    if (process.env.AEGIS_HIST_DEBUG) console.error('[credentials] write failed:', e);
-    return { ok: false, error: e, credentials: next };
-  }
-  return { ok: true, credentials: next };
-}
-
-/**
- * The key an earlier AEGIS CLI wrote into config.json (the `aegiscloud` /
- * `memory` blocks are not ours — config.js cannot produce them). Read-only.
- */
-function readLegacyConfig() {
-  try {
-    const parsed = JSON.parse(fs.readFileSync(configPath(), 'utf8'));
-    if (!parsed || typeof parsed !== 'object') return {};
-    const cloud = parsed.aegiscloud && typeof parsed.aegiscloud === 'object' ? parsed.aegiscloud : {};
-    const memory = parsed.memory && typeof parsed.memory === 'object' ? parsed.memory : {};
-    return {
-      apiKey: normalizeApiKey(cloud.api_key),
-      memoryToken: String(memory.token || '').trim(),
-      syncConversations: cloud.syncConversations === true ? true : undefined,
-      lastVerified: cloud.lastVerified || null,
-      memorySubscribed: memory.subscribed === true ? true : undefined,
-    };
-  } catch {
-    return {};
-  }
-}
-
-/** True when config.json still carries a plaintext copy of the account key. */
-function legacyKeyOnDisk() {
-  return !!readLegacyConfig().apiKey;
-}
-
-/**
- * Copy a legacy key/token into the 0600 store, once, without touching the file
- * it came from. Returns which fields were adopted so the caller can say so.
- */
-function adoptLegacy() {
-  const legacy = readLegacyConfig();
-  const creds = readCredentials();
-  const patch = {};
-  if (legacy.apiKey && !creds.aegisApiKey) patch.aegisApiKey = legacy.apiKey;
-  if (legacy.memoryToken && !creds.memoryToken) patch.memoryToken = legacy.memoryToken;
-  if (!Object.keys(patch).length) return { adopted: [] };
-  const written = writeCredentials({ ...patch, adoptedFrom: configPath() });
-  if (!written.ok) return { adopted: [] };
-  return { adopted: Object.keys(patch) };
-}
-
-/**
- * The key to use, and where it came from.
- *
- * @returns {{key:string, source:'env'|'credentials'|'config'|'none', from:string}}
- */
-function resolveApiKey(o = {}) {
-  const env = o.env || process.env;
-  const fromEnv = normalizeApiKey(env && env[KEY_ENV]);
-  if (fromEnv) return { key: fromEnv, source: 'env', from: KEY_ENV };
-
-  const creds = readCredentials();
-  const stored = normalizeApiKey(creds.aegisApiKey);
-  if (stored) return { key: stored, source: 'credentials', from: credentialsPath() };
-
-  const legacy = readLegacyConfig().apiKey;
-  if (legacy) return { key: legacy, source: 'config', from: configPath() };
-
-  return { key: '', source: 'none', from: '' };
-}
-
-/** Whether any credential is available (env, store or legacy config). */
-function hasApiKey(o = {}) {
-  return !!resolveApiKey(o).key;
-}
-
-/**
- * Persist a key.
- *
- * @returns {{ok:boolean, key:string, path:string, error?:Error, message?:string}}
- */
-function saveApiKey(raw) {
-  const v = validateApiKey(raw);
-  if (!v.ok) return { ok: false, key: v.key, path: credentialsPath(), message: v.message };
-  const written = writeCredentials({ aegisApiKey: v.key, savedAt: new Date().toISOString() });
-  if (!written.ok) {
-    return {
-      ok: false,
-      key: v.key,
-      path: credentialsPath(),
-      error: written.error,
-      message: `could not write ${credentialsPath()}`,
-    };
-  }
-  return { ok: true, key: v.key, path: credentialsPath() };
-}
-
-/**
- * Remove the stored key (and nothing else — the memory token stays, since a
- * key rotation should not silently unsubscribe cloud memory). config.json is
- * never touched: another product writes it.
- */
-function clearApiKey() {
-  const had = !!normalizeApiKey(readCredentials().aegisApiKey);
-  const written = writeCredentials({ aegisApiKey: '', adoptedFrom: '' });
-  return { cleared: had, ok: written.ok, path: credentialsPath() };
-}
-
-/** The memory token cloud sync authenticates with, from store or legacy. */
-function resolveMemoryToken(o = {}) {
-  const env = o.env || process.env;
-  const fromEnv = String((env && env[MEMORY_ENV]) || '').trim();
-  if (fromEnv) return { token: fromEnv, source: 'env' };
-  const creds = readCredentials();
-  const stored = String(creds.memoryToken || '').trim();
-  if (stored) return { token: stored, source: 'credentials' };
-  const legacy = readLegacyConfig().memoryToken;
-  if (legacy) return { token: legacy, source: 'config' };
-  return { token: '', source: 'none' };
-}
-
-function saveMemoryToken(token, extra = {}) {
-  return writeCredentials({ memoryToken: String(token || '').trim(), ...extra });
-}
-
-function clearMemoryToken() {
-  return writeCredentials({ memoryToken: '', memorySubscribed: false });
-}
-
-/**
- * Everything a status screen or a `doctor` line needs about the credential,
- * without ever exposing the key itself.
- */
-function keyStatus(o = {}) {
-  const { key, source, from } = resolveApiKey(o);
-  const creds = readCredentials();
-  let mode = null;
-  try {
-    mode = fs.statSync(credentialsPath()).mode & 0o777;
-  } catch {}
-  return {
-    configured: !!key,
-    key,
-    source,
-    from,
-    path: credentialsPath(),
-    fileMode: mode == null ? null : '0' + mode.toString(8),
-    stored: !!normalizeApiKey(creds.aegisApiKey),
-    legacyPlaintext: legacyKeyOnDisk(),
-    verifiedAt: creds.verifiedAt || null,
-    account: creds.account || null,
-    memoryToken: !!resolveMemoryToken(o).token,
-    memorySource: resolveMemoryToken(o).source,
-  };
-}
-
-/**
- * Client options for `createClient`: the resolved key plus the stored memory
- * token, so a restart does not re-exchange for a token it already has.
- */
-function clientOptions(o = {}) {
-  const { key } = resolveApiKey(o);
-  const { token } = resolveMemoryToken(o);
-  const opts = {};
-  if (key) opts.apiKey = key;
-  if (token) opts.memoryToken = token;
-  return opts;
-}
-
-/** Human label for a resolution source, for status lines. */
-const SOURCE_LABEL = {
-  env: `$${KEY_ENV}`,
-  credentials: 'saved key file',
-  config: 'config.json (aegis CLI)',
-  none: 'not set',
-};
-
-function sourceLabel(source) {
-  return SOURCE_LABEL[source] || SOURCE_LABEL.none;
-}
-
-/** One line telling the user how to supply a key, used by every error path. */
-const HOW_TO_SET = 'run `aegiscode login` (or /key inside a session) to save one';
-
-module.exports = {
-  KEY_ENV,
-  MEMORY_ENV,
-  CREDENTIALS_FILE,
-  credentialsPath,
-  normalizeApiKey,
-  validateApiKey,
-  readCredentials,
-  writeCredentials,
-  readLegacyConfig,
-  legacyKeyOnDisk,
-  adoptLegacy,
-  resolveApiKey,
-  hasApiKey,
-  saveApiKey,
-  clearApiKey,
-  resolveMemoryToken,
-  saveMemoryToken,
-  clearMemoryToken,
-  keyStatus,
-  clientOptions,
-  sourceLabel,
-  HOW_TO_SET,
-};
+module.exports = shared.credentials;

package/src/history.js

@@ -5,6 +5,17 @@
  * (or $AEGISCODE_HOME). Keeps the file bounded (oldest entries dropped past
  * HISTORY_LIMIT lines).
  *
+ * history.jsonl is this host's *ledger*: one record per exchange, carrying the
+ * token/cost numbers `/cost` aggregates. It stays the CLI's own format.
+ *
+ * What changed with the shared store (`client/session-store.js`) is that every
+ * recorded exchange is ALSO mirrored into `<dir>/sessions.json`, the store the
+ * desktop app and the MCP plugin read. That file is what makes a terminal turn
+ * show up in the GUI's session list — and, in the other direction, what lets
+ * `/resume` open a session that was typed in the desktop, without cloud sync
+ * and without a key. `readResumeList` merges both sources by id, so no session
+ * is listed twice.
+ *
  * Ported from aegiscodex-dev/src/history.js (ESM → CommonJS). The data dir now
  * comes from config.js's shared `aegisDir()` helper.
  */
@@ -13,9 +24,12 @@ const fs = require('node:fs');
 const os = require('node:os');
 const path = require('node:path');
 const { aegisDir } = require('./config.js');
+const { sessionStore } = require('./shared.js');
 const { estimateTokens } = require('./tokens.js');
 
 const HISTORY_LIMIT = 500;
+/** Which host wrote a mirrored record, so either side can tell them apart. */
+const SOURCE = 'aegiscode-cli';
 
 function historyPath() {
   return path.join(aegisDir(), 'history.jsonl');
@@ -82,6 +96,7 @@ function appendHistoryEntries(entries) {
     const lines = [...prev, ...list.map((e) => JSON.stringify(e))];
     const trimmed = lines.slice(Math.max(0, lines.length - HISTORY_LIMIT));
     fs.writeFileSync(p, trimmed.join('\n') + '\n');
+    mirrorToSharedStore(list);
     return list.length;
   } catch (e) {
     // Persistence is best-effort; never crash the session over it.
@@ -90,6 +105,35 @@ function appendHistoryEntries(entries) {
   }
 }
 
+/**
+ * Mirror freshly-recorded exchanges into the shared session store, so the
+ * desktop and the MCP plugin can see this host's sessions.
+ *
+ * Only *writes* mirror — a read of history.jsonl never re-imports itself, which
+ * is what would otherwise duplicate every exchange on every launch. A mirror
+ * failure must never cost the user the history line it accompanies, so this is
+ * called after the ledger write and swallows its own errors.
+ */
+function mirrorToSharedStore(entries) {
+  for (const e of entries) {
+    try {
+      sessionStore.recordExchange(aegisDir(), {
+        sessionId: e.sessionId,
+        prompt: e.prompt,
+        reply: e.reply,
+        status: e.status,
+        cwd: e.cwd,
+        ts: e.ts,
+        tokens: e.tokens,
+        costUsd: e.costUsd,
+        origin: SOURCE,
+      });
+    } catch (err) {
+      if (process.env.AEGIS_HIST_DEBUG) console.error('[history] mirror failed:', err);
+    }
+  }
+}
+
 function readEntries() {
   try {
     const raw = fs.readFileSync(historyPath(), 'utf8');
@@ -129,14 +173,36 @@ function readOwnSessions(limit = 8) {
   return items;
 }
 
-/** Rebuild the transcript (user/assistant pairs) of a session, oldest first. */
+/**
+ * Rebuild the transcript (user/assistant pairs) of a session, oldest first.
+ *
+ * history.jsonl wins when it has records for the id (this host's own ledger,
+ * complete with the exchanges the shared store may have trimmed). Otherwise the
+ * session came from another host — a desktop thread — and the shared store is
+ * the only place its messages exist, so /resume can open it too.
+ */
 function readSessionTranscript(sessionId) {
-  return readEntries()
+  const own = readEntries()
     .filter((e) => e.sessionId === sessionId)
     .flatMap((e) => [
       { role: 'user', text: e.prompt },
       { role: 'assistant', text: e.reply || '(no response)' },
     ]);
+  if (own.length) return own;
+  try {
+    return sessionStore.readTranscript(aegisDir(), sessionId);
+  } catch {
+    return [];
+  }
+}
+
+/** Sessions in the shared store written by another host (the desktop app). */
+function readSharedStoreSessions(limit = 8) {
+  try {
+    return sessionStore.listSummaries(aegisDir(), limit);
+  } catch {
+    return [];
+  }
 }
 
 /** All history records for one session, oldest first (power /cost). */
@@ -190,11 +256,22 @@ function aggregateSessionUsage(sessionId) {
 }
 
 /**
- * Sessions for the /resume overlay: own Aegiscode sessions merged with real
- * Claude Code sessions from ~/.claude/history.jsonl, newest first.
+ * Sessions for the /resume overlay: own Aegiscode sessions, sessions written
+ * into the shared store by another host (the desktop app), and real Claude Code
+ * sessions from ~/.claude/history.jsonl — newest first, deduplicated by id.
+ *
+ * The dedup matters: an own session is mirrored into the shared store, so
+ * without it every terminal session would be listed twice, once from each
+ * source.
  */
 function readResumeList(limit = 8, ownLimit = 5, claudeLimit = 8) {
   const items = readOwnSessions(ownLimit);
+  const seen = new Set(items.map((i) => i.id));
+  const sharedItems = readSharedStoreSessions(ownLimit).filter((i) => {
+    if (seen.has(i.id)) return false;
+    seen.add(i.id);
+    return true;
+  });
   const claudeItems = [];
   const histPath = `${os.homedir()}/.claude/history.jsonl`;
   try {
@@ -204,7 +281,8 @@ function readResumeList(limit = 8, ownLimit = 5, claudeLimit = 8) {
       try {
         const j = JSON.parse(l);
         const meta = j.extra && JSON.parse(j.extra);
-        if (meta && meta.sessionId) {
+        if (meta && meta.sessionId && !seen.has(meta.sessionId)) {
+          seen.add(meta.sessionId);
           const c = (j.cwd || '').split('/').filter(Boolean).pop() || '~';
           const t = (j.summary || '').slice(0, 60);
           claudeItems.push({ id: meta.sessionId, cwd: c, summary: t, time: j.timestamp, own: false });
@@ -212,13 +290,14 @@ function readResumeList(limit = 8, ownLimit = 5, claudeLimit = 8) {
       } catch {}
     }
   } catch {}
-  return [...items, ...claudeItems]
+  return [...items, ...sharedItems, ...claudeItems]
     .sort((a, b) => (String(a.time || '') < String(b.time || '') ? 1 : -1))
     .slice(0, limit);
 }
 
 module.exports = {
   HISTORY_LIMIT,
+  SOURCE,
   historyPath,
   ensureHistoryDir,
   appendHistory,
@@ -226,6 +305,7 @@ module.exports = {
   readHistoryEntries,
   readOwnSessions,
   readSessionTranscript,
+  readSharedStoreSessions,
   sessionHistoryEntries,
   pruneSessionHistory,
   aggregateSessionUsage,

package/src/shared.js

@@ -0,0 +1,45 @@
+'use strict';
+
+/**
+ * Where the CLI finds the modules it shares with the other hosts.
+ *
+ * `src/deps.js` does this for the transport/engine/registry trio, but it pulls
+ * the whole agent loop in at require time — far too heavy for `config.js` and
+ * `history.js`, which every command and every launch touches. This module
+ * resolves the two *pure* shared modules those files need, with the same
+ * two-layout rule and the same by-existence lookup:
+ *
+ *   in-repo   <repo>/cli/src/shared.js  -> <repo>/client/*.js
+ *   npm       <pkg>/src/shared.js       -> <pkg>/vendor/client/*.js
+ *
+ * A missing module is a loud error rather than a silent fallback to a second
+ * copy: a duplicate credential store or session store is exactly the drift this
+ * whole arrangement exists to prevent.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+function candidates(name) {
+  return [
+    path.join(__dirname, '..', '..', 'client', name), // repo checkout
+    path.join(__dirname, '..', 'vendor', 'client', name), // staged package
+  ];
+}
+
+function resolveClientModule(name) {
+  const tried = candidates(name);
+  for (const candidate of tried) {
+    if (fs.existsSync(candidate)) return candidate;
+  }
+  throw new Error(
+    `aegiscode: cannot find client/${name}. Expected it beside cli/ (in the repo) ` +
+      'or under cli/vendor/client/ (installed package). Reinstall the package, or ' +
+      'run `node scripts/predist.mjs` from cli/ if this is a source checkout.'
+  );
+}
+
+const credentials = require(resolveClientModule('credentials.js'));
+const sessionStore = require(resolveClientModule('session-store.js'));
+
+module.exports = { credentials, sessionStore, resolveClientModule };