claudish 14.5.0 → 14.5.2

package/dist/index.js

@@ -5332,7 +5332,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "14.5.0";
+var VERSION = "14.5.2";
 
 // src/redact.ts
 function isPlaceholder(value) {
@@ -23245,7 +23245,12 @@ function syncRun(args, stdin) {
     });
     return normalizeResult(proc.exitCode, proc.signalCode, decode2(proc.stdout), decode2(proc.stderr));
   } catch (err) {
-    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+    return {
+      code: 1,
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err),
+      spawnError: true
+    };
   }
 }
 async function asyncRun(args, stdin) {
@@ -23263,7 +23268,12 @@ async function asyncRun(args, stdin) {
     ]);
     return normalizeResult(exitCode, proc.signalCode, stdout, stderr);
   } catch (err) {
-    return { code: 1, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+    return {
+      code: 1,
+      stdout: "",
+      stderr: err instanceof Error ? err.message : String(err),
+      spawnError: true
+    };
   }
 }
 function spawnAsyncRun(args, stdin) {
@@ -23280,7 +23290,8 @@ function spawnAsyncRun(args, stdin) {
     ]).then(([stdout, stderr, exitCode]) => normalizeResult(exitCode, proc.signalCode, stdout, stderr), (err) => ({
       code: 1,
       stdout: "",
-      stderr: err instanceof Error ? err.message : String(err)
+      stderr: err instanceof Error ? err.message : String(err),
+      spawnError: true
     }));
     return { done, pid: proc.pid };
   } catch (err) {
@@ -23288,12 +23299,38 @@ function spawnAsyncRun(args, stdin) {
       done: Promise.resolve({
         code: 1,
         stdout: "",
-        stderr: err instanceof Error ? err.message : String(err)
+        stderr: err instanceof Error ? err.message : String(err),
+        spawnError: true
       }),
       pid: undefined
     };
   }
 }
+function securityErrorDetail(res) {
+  if (res.spawnError) {
+    return res.stderr.trim().slice(0, SECURITY_DETAIL_MAX) || `security exited ${res.code}`;
+  }
+  const kept = [];
+  for (const raw of res.stderr.split(/\r?\n/)) {
+    const line = raw.trim();
+    if (!line || /unknown command/.test(line))
+      continue;
+    const returned = SECURITY_RETURNED_LINE.exec(line);
+    if (returned) {
+      if (KNOWN_SECURITY_SUBCOMMANDS.has(returned[1]))
+        kept.push(line);
+      continue;
+    }
+    if (SECURITY_FIXED_LINES.some((re) => re.test(line)))
+      kept.push(line);
+  }
+  if (res.code === -1 && !kept.some((line) => /killed by|timed out/.test(line))) {
+    kept.unshift("security killed by a signal / timed out");
+  }
+  const detail = kept.join(`
+`).slice(0, SECURITY_DETAIL_MAX);
+  return detail || `security exited ${res.code}`;
+}
 function decode2(buf) {
   return buf ? new TextDecoder().decode(buf) : "";
 }
@@ -23351,7 +23388,7 @@ function interpretRead(envVar, res) {
   }
   if (res.code === EXIT_ITEM_NOT_FOUND)
     return null;
-  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+  throw new KeychainError(`Keychain lookup for ${envVar} failed: ${securityErrorDetail(res)}`, res.code);
 }
 function readKeychainSecret(envVar) {
   return readKeychainItem(KEYCHAIN_SERVICE, envVar);
@@ -23411,7 +23448,7 @@ function interpretGenericPassword(res, withValue) {
   return {
     kind: "failed",
     code: res.code,
-    error: res.stderr.trim() || `security exited ${res.code}`
+    error: securityErrorDetail(res)
   };
 }
 async function findGenericPasswordPresence(query) {
@@ -23437,7 +23474,7 @@ function enumerateKeychainVars() {
   const value = res.code === 0 ? { names: parseDumpAccounts(res.stdout), failed: false } : {
     names: [],
     failed: true,
-    error: res.stderr.trim() || `security exited ${res.code}`
+    error: securityErrorDetail(res)
   };
   listMemo = { at, value };
   return value;
@@ -23472,6 +23509,9 @@ function toHex(value) {
 function quoteForStdin(value) {
   return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
 }
+function valueArgs(value) {
+  return PRINTABLE_ASCII.test(value) ? ["-w", quoteForStdin(value)] : ["-X", quoteForStdin(toHex(value))];
+}
 function writeKeychainSecret(envVar, value) {
   const unsupported = keychainUnavailableReason();
   if (unsupported)
@@ -23504,17 +23544,21 @@ function writeKeychainItem(service, account, value) {
     quoteForStdin("application password"),
     "-j",
     quoteForStdin("Stored by claudish"),
-    "-X",
-    quoteForStdin(toHex(value)),
+    ...valueArgs(value),
     "-U",
     "-T",
     quoteForStdin(SECURITY_BIN),
     ...keychainFileArgs().map(quoteForStdin)
   ].join(" ");
-  const res = deps.run(["-i"], `${cmd}
-`);
+  const line = `${cmd}
+`;
+  const lineBytes = Buffer.byteLength(line, "utf8");
+  if (lineBytes > MAX_STDIN_LINE) {
+    throw new KeychainError(`Cannot store ${account}: value is too large for the keychain write path ` + `(${lineBytes} bytes on the command line, limit ${MAX_STDIN_LINE})`);
+  }
+  const res = deps.run(["-i"], line);
   if (res.code !== 0) {
-    throw new KeychainError(`Failed to store ${account} in the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+    throw new KeychainError(`Failed to store ${account} in the keychain: ${securityErrorDetail(res)}`, res.code);
   }
   invalidateKeychainCache();
   const readBack = readKeychainItem(service, account, { uncached: true });
@@ -23542,14 +23586,14 @@ function deleteKeychainItem(service, account) {
     return true;
   if (res.code === EXIT_ITEM_NOT_FOUND)
     return false;
-  throw new KeychainError(`Failed to delete ${account} from the keychain: ${res.stderr.trim() || `security exited ${res.code}`}`, res.code);
+  throw new KeychainError(`Failed to delete ${account} from the keychain: ${securityErrorDetail(res)}`, res.code);
 }
 function valueTail2(value) {
   if (value.length <= 6)
     return "\u2022\u2022\u2022\u2022";
   return `\u2022\u2022\u2022\u2022${value.slice(-4)}`;
 }
-var KEYCHAIN_SERVICE = "claudish", KEYCHAIN_ACCOUNTS_SERVICE = "claudish-accounts", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, defaultDeps2, deps, listMemo = null, valueMemo, CONTROL_CHARS2, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH, KEYCHAIN_ACCOUNT_NAME;
+var KEYCHAIN_SERVICE = "claudish", KEYCHAIN_ACCOUNTS_SERVICE = "claudish-accounts", SECURITY_BIN = "/usr/bin/security", EXIT_ITEM_NOT_FOUND = 44, MEMO_TTL_MS = 3000, SPAWN_TIMEOUT_MS = 1e4, KeychainError, KNOWN_SECURITY_SUBCOMMANDS, SECURITY_RETURNED_LINE, SECURITY_FIXED_LINES, SECURITY_DETAIL_MAX = 300, defaultDeps2, deps, listMemo = null, valueMemo, CONTROL_CHARS2, ENV_VAR_NAME, ACCT_ATTR, SVCE_MATCH, MAX_STDIN_LINE = 4000, PRINTABLE_ASCII, KEYCHAIN_ACCOUNT_NAME;
 var init_keychain = __esm(() => {
   KeychainError = class KeychainError extends Error {
     exitCode;
@@ -23559,6 +23603,27 @@ var init_keychain = __esm(() => {
       this.name = "KeychainError";
     }
   };
+  KNOWN_SECURITY_SUBCOMMANDS = new Set([
+    "add-generic-password",
+    "find-generic-password",
+    "delete-generic-password",
+    "add-internet-password",
+    "find-internet-password",
+    "delete-internet-password",
+    "dump-keychain",
+    "create-keychain",
+    "delete-keychain",
+    "unlock-keychain",
+    "lock-keychain",
+    "set-keychain-settings"
+  ]);
+  SECURITY_RETURNED_LINE = /^([\w-]+): returned -?\d+$/;
+  SECURITY_FIXED_LINES = [
+    /^security: Sec\w+( \([^)]*\))?: .+$/,
+    /^security (killed by \w+|terminated without an exit code)$/,
+    /^Unable to convert password data .+$/,
+    /^User interaction is not allowed\.?$/
+  ];
   defaultDeps2 = {
     platform: () => process.platform,
     run: syncRun,
@@ -23571,6 +23636,7 @@ var init_keychain = __esm(() => {
   ENV_VAR_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
   ACCT_ATTR = /"acct"<blob>=(?:0x[0-9A-Fa-f]*\s+)?"([^"]*)"/;
   SVCE_MATCH = `"svce"<blob>="${KEYCHAIN_SERVICE}"`;
+  PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
   KEYCHAIN_ACCOUNT_NAME = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/;
 });
 
@@ -93242,6 +93308,8 @@ function applyAssistantBlock(state, t, b, offset) {
     return;
   t.pending.set(b.id, String(b.name ?? ""));
   t.pendingInput.set(b.id, b.input);
+  if (b.name === "Write" && typeof b.input?.file_path === "string")
+    t.writes.push({ id: b.id, path: b.input.file_path, offset, ok: false });
   if (b.name === "Bash" && b.input?.run_in_background)
     t.shellToolIds.set(b.id, String(b.input?.command ?? ""));
   applyReadUse(state, t, b);
@@ -93253,6 +93321,7 @@ function applyToolResults(t, r, blocks, offset) {
       continue;
     t.pending.delete(b.tool_use_id);
     t.pendingInput.delete(b.tool_use_id);
+    markWriteResult(t, b);
     if (tur?.isAsync === true && typeof tur.agentId === "string")
       t.agents.add(tur.agentId);
     if (typeof tur?.backgroundTaskId === "string")
@@ -93260,6 +93329,13 @@ function applyToolResults(t, r, blocks, offset) {
     applyReadResult(t, r, b, offset);
   }
 }
+function markWriteResult(t, b) {
+  if (b.is_error === true)
+    return;
+  const w = t.writes.find((x) => x.id === b.tool_use_id);
+  if (w)
+    w.ok = true;
+}
 function applyLocalCommandRecord(t, text, offset) {
   if (t.witness.kind !== "command" || t.lastAssistant || t.localOutput)
     return;
@@ -93400,6 +93476,7 @@ function openTurnState(state, t) {
     acceptedAt: null,
     acceptedOffset: null,
     texts: [],
+    writes: [],
     lastAssistant: null,
     td: null,
     stopHookAfterLast: false,
@@ -93424,6 +93501,7 @@ function openTurnState(state, t) {
 function turnView(t) {
   const rs = t.read;
   let texts = t.texts;
+  let writes = t.writes;
   let preambleBytes = 0;
   if (rs) {
     const cut = rs.completedAtOffset ?? rs.lastReadOffset;
@@ -93431,6 +93509,7 @@ function turnView(t) {
       const before = texts.filter((x) => x.offset < cut);
       preambleBytes = before.reduce((n, x) => n + Buffer.byteLength(x.text), 0);
       texts = texts.filter((x) => x.offset > cut);
+      writes = writes.filter((x) => x.offset > cut);
     }
   }
   const pendingEntry = [...t.pending.entries()].pop();
@@ -93462,6 +93541,7 @@ function turnView(t) {
       completedAtOffset: rs.completedAtOffset
     } : { linesReturned: 0, complete: true, reads: 0, completedAtOffset: null },
     preambleBytes,
+    writtenFiles: [...new Set(writes.filter((x) => x.ok).map((x) => x.path))],
     lastChatOffset: t.lastChatOffset,
     localCommandOutput: t.localOutput?.text ?? null,
     recent: [...t.steps],
@@ -95202,7 +95282,8 @@ ${screenTailOf(this.screen)}`
         linesRead: t.delivery ? t.readCoverage.linesReturned : null,
         complete: t.delivery && !unverified ? t.readCoverage.complete : null,
         preambleBytes: t.preambleBytes
-      }
+      },
+      writtenFiles: decision.by === "local_command" ? [] : t.writtenFiles
     };
   }
   settle(t, decision, exitCode) {
@@ -95271,10 +95352,12 @@ ${screenTailOf(this.screen)}`
       this.follower.markSettled();
     }
     const last = this.chain[this.chain.length - 1];
-    if (last && last.index === core.index)
+    const writtenFiles = core.writtenFiles ?? [];
+    if (last && last.index === core.index) {
       last.answer = core.answer;
-    else
-      this.chain.push({ index: core.index, answer: core.answer });
+      last.writtenFiles = writtenFiles;
+    } else
+      this.chain.push({ index: core.index, answer: core.answer, writtenFiles });
     if (!this.turnHookCaused)
       this.chainHead = core.delivery;
     const turn = {
@@ -95282,7 +95365,8 @@ ${screenTailOf(this.screen)}`
       chainAnswers: this.chain.slice(0, -1).map((c) => c.answer),
       chainDelivery: this.chainHead ?? core.delivery,
       hookTurns: this.hookTurns,
-      hookCaused: this.turnHookCaused
+      hookCaused: this.turnHookCaused,
+      writtenFiles: [...new Set(this.chain.flatMap((c) => c.writtenFiles))]
     };
     this.heldTurn = turn;
     try {
@@ -97141,6 +97225,9 @@ function snippetHeadAndTail(text) {
 
 ${tail}`;
 }
+function fileAnswerNote(path) {
+  return `answer was written to ${path}, not to the reply`;
+}
 function classifyRunOutput(input) {
   const v = classifyAnswer(input);
   if (v && input.stopReason === "max_tokens")
@@ -97193,9 +97280,55 @@ function classifyShape(answer, requirePattern, chainAnswers) {
   return {
     state: "EMPTY",
     reason: "shape_mismatch",
-    detail: `The answer (${Buffer.byteLength(answer, "utf8")} B of assistant text after the task was ` + `read) does not match the required pattern /${requirePattern}/. Every assistant message ` + "of the turn was read from the transcript, so nothing was lost: the model did not " + "produce the shape. Re-prompt it, or relax the contract."
+    detail: shapeDetail(answer, requirePattern, null)
   };
 }
+function shapeDetail(answer, requirePattern, files) {
+  const reply = `reply (${Buffer.byteLength(answer, "utf8")} B of assistant text after the task was read) does not match`;
+  const advice = "Re-prompt it, or relax the contract.";
+  if (!files)
+    return `The ${reply} the required pattern /${requirePattern}/. ${advice}`;
+  const wrote = files.length ? `the turn wrote ${files.join(", ")}` : "the turn wrote no file";
+  return `No reply text or written file matched /${requirePattern}/: the ${reply}, and ${wrote}. ${advice}`;
+}
+function answerFailureDetail(v, answer, requirePattern, outcomes) {
+  if (v.reason === "shape_mismatch" && requirePattern) {
+    const note = v.detail.endsWith(`(${TRUNCATION_NOTE})`) ? ` (${TRUNCATION_NOTE})` : "";
+    return `${shapeDetail(answer, requirePattern, outcomes)}${note}`;
+  }
+  if (outcomes.length)
+    return `${v.detail} The turn wrote ${outcomes.join(", ")}.`;
+  return v.detail;
+}
+function readWrittenFile(path, root) {
+  let realRoot;
+  try {
+    realRoot = realpathSync7(root);
+  } catch {
+    realRoot = resolve5(root);
+  }
+  let real;
+  try {
+    real = realpathSync7(resolve5(root, path));
+  } catch {
+    return { skip: "missing" };
+  }
+  if (real !== realRoot && !real.startsWith(realRoot + sep))
+    return { skip: "outside the working directory" };
+  try {
+    const st = statSync17(real);
+    if (!st.isFile())
+      return { skip: "not a regular file" };
+    if (st.size > MAX_FILE_ANSWER_BYTES)
+      return { skip: "larger than 1 MiB" };
+    const buf = readFileSync42(real);
+    if (buf.includes(0))
+      return { skip: "binary" };
+    return { text: buf.toString("utf8") };
+  } catch {
+    return { skip: "missing" };
+  }
+}
 function classifyAnswer(input) {
   const signal = classifyTurnSignals(input);
   if (signal)
@@ -97417,6 +97550,7 @@ async function startModelsIn(flight, sessionPath, opts) {
   }
   const minOutputBytes = opts.minOutputBytes ?? DEFAULT_MIN_OUTPUT_BYTES;
   const requirePattern = opts.requirePattern;
+  const cwd = opts.cwd ?? process.cwd();
   mkdirSync24(statsDir(path), { recursive: true });
   const entries = new Map;
   let run = null;
@@ -97450,10 +97584,36 @@ async function startModelsIn(flight, sessionPath, opts) {
       return e.session.chainText();
     return e.session?.turnAnswer(index) ?? "";
   }
+  function fileAnswerOf(turn, reason) {
+    if (reason !== "shape_mismatch" && reason !== "empty_output")
+      return { file: null, outcomes: [] };
+    if (!requirePattern)
+      return { file: null, outcomes: turn.writtenFiles ?? [] };
+    const outcomes = [];
+    for (const written of turn.writtenFiles ?? []) {
+      const path = resolve5(cwd, written);
+      const r = readWrittenFile(path, cwd);
+      if ("skip" in r) {
+        outcomes.push(`${path} (skipped: ${r.skip})`);
+        continue;
+      }
+      const fv = classifyRunOutput({
+        answer: r.text,
+        apiError: null,
+        stopReason: turn.stopReason,
+        promptRead: turn.chainDelivery,
+        minOutputBytes,
+        requirePattern
+      });
+      if (!fv)
+        return { file: { path, text: r.text }, outcomes };
+      outcomes.push(`${path} (no match)`);
+    }
+    return { file: null, outcomes };
+  }
   function teamDecide(e, turn) {
     e.stopReason = turn.stopReason;
     const answer = chainAnswerOf(turn);
-    writeResponse(e, answer);
     const v = classifyRunOutput({
       answer,
       chainAnswers: [...turn.chainAnswers, turn.answer],
@@ -97464,11 +97624,24 @@ async function startModelsIn(flight, sessionPath, opts) {
       requirePattern
     });
     const shells = (e.session?.snapshot().anomalies ?? []).filter((a) => a.startsWith("background_shell_open"));
+    const truncated = turn.stopReason === "max_tokens" ? [TRUNCATION_NOTE] : [];
     if (!v) {
-      const notes = [...shells, ...turn.stopReason === "max_tokens" ? [TRUNCATION_NOTE] : []];
+      e.answerSource = "reply";
+      writeResponse(e, answer);
+      const notes = [...shells, ...truncated];
       return notes.length ? { state: "COMPLETED", detail: notes.join(" \xB7 ") } : { state: "COMPLETED" };
     }
-    return { state: v.state, reason: v.reason, detail: [v.detail, ...shells].join(" \xB7 ") };
+    const { file, outcomes } = fileAnswerOf(turn, v.reason);
+    if (file) {
+      e.answerSource = `file:${file.path}`;
+      writeResponse(e, file.text);
+      const notes = [fileAnswerNote(file.path), ...shells, ...truncated];
+      return { state: "COMPLETED", detail: notes.join(" \xB7 ") };
+    }
+    e.answerSource = "reply";
+    writeResponse(e, answer);
+    const detail = answerFailureDetail(v, answer, requirePattern, outcomes);
+    return { state: v.state, reason: v.reason, detail: [detail, ...shells].join(" \xB7 ") };
   }
   function teamOnBlocked(e, b) {
     const index = (e.session?.snapshot().turnsCompleted ?? 0) + 1;
@@ -97504,6 +97677,7 @@ async function startModelsIn(flight, sessionPath, opts) {
     const answer = e.answer ?? writeResponse(e, unsettledAnswer(e, index));
     const anomalies = [
       ...notableAnomalies(snap),
+      ...snap.state === "COMPLETED" && e.answerSource?.startsWith("file:") ? [fileAnswerNote(e.answerSource.slice("file:".length))] : [],
       ...snap.state === "COMPLETED" && e.stopReason === "max_tokens" ? [TRUNCATION_NOTE] : []
     ];
     const base = {
@@ -97511,7 +97685,8 @@ async function startModelsIn(flight, sessionPath, opts) {
       exitCode: snap.exitCode,
       outputSize: Buffer.byteLength(answer, "utf8"),
       stopReason: e.stopReason,
-      anomalies
+      anomalies,
+      ...e.answerSource ? { answerSource: e.answerSource } : {}
     };
     if (snap.state === "COMPLETED")
       return { ...base, error: undefined };
@@ -97576,7 +97751,6 @@ async function startModelsIn(flight, sessionPath, opts) {
     });
     notifyStatus(e.id);
   }
-  const cwd = process.cwd();
   const projects = projectsDir(parentEnv);
   function bindingFor(e, uuid) {
     const session = {
@@ -98040,7 +98214,7 @@ function formatVerdict(verdict, sessionPath) {
   }
   return output;
 }
-var startsInFlight, teamRuns, newestRunByPath, SETTLED_RUN_RETENTION_MS, MAX_SETTLED_RUNS = 20, BOOT_STAGGER_MS = 300, STDOUT_TAIL_LIMIT = 4000, SNIPPET_LIMIT = 2000, SNIPPET_HEAD = 600, DEFAULT_MIN_OUTPUT_BYTES = 0, TRUNCATION_NOTE = "the turn ended on stop_reason max_tokens, so the answer may be truncated", CANCELLED_DETAIL;
+var startsInFlight, teamRuns, newestRunByPath, SETTLED_RUN_RETENTION_MS, MAX_SETTLED_RUNS = 20, BOOT_STAGGER_MS = 300, STDOUT_TAIL_LIMIT = 4000, SNIPPET_LIMIT = 2000, SNIPPET_HEAD = 600, DEFAULT_MIN_OUTPUT_BYTES = 0, TRUNCATION_NOTE = "the turn ended on stop_reason max_tokens, so the answer may be truncated", MAX_FILE_ANSWER_BYTES, CANCELLED_DETAIL;
 var init_team_orchestrator = __esm(() => {
   init_prehydrate();
   init_config();
@@ -98060,6 +98234,7 @@ var init_team_orchestrator = __esm(() => {
   teamRuns = new Map;
   newestRunByPath = new Map;
   SETTLED_RUN_RETENTION_MS = 30 * 60000;
+  MAX_FILE_ANSWER_BYTES = 1024 * 1024;
   CANCELLED_DETAIL = `Stopped on the caller's instruction via team(mode:"cancel"). ` + "Whatever the child had written up to that point is in its response file.";
 });
 
@@ -101928,7 +102103,7 @@ var init_mcp_server = __esm(() => {
     api_error: "retry once, or route via a different provider (or@<model>)",
     refused: "the model refused \u2014 rephrase or drop the model",
     empty_output: "retry once; if it repeats, drop the model",
-    shape_mismatch: "the answer (assistant text after the task was read) did not match. Every assistant " + "message of the turn was read from the transcript, so nothing was lost in transit \u2014 " + "the model did not produce it. Re-prompt with the required format restated; do NOT " + "count this slot as a vote"
+    shape_mismatch: "neither the reply (assistant text after the task was read) nor any file the slot wrote " + "with Write matched \u2014 the model did not produce it. Re-prompt with the required format " + "restated; do NOT count this slot as a vote"
   };
   USER_REQUIRED_MODEL_DESCRIPTION = "True only when the USER named this exact model: it then runs even when it is not in the " + "recommended list. Never set it for a model you chose yourself.";
   sanitize2 = sanitizeForReport;
@@ -104019,10 +104194,12 @@ function vendorOf(provider) {
 function pct(fraction) {
   return `${Math.round(fraction * 100)}%`;
 }
-function renderWindows(row, pool) {
-  const windows = row.state.usage?.windows ?? [];
-  if (windows.length === 0)
-    return dim4("usage unknown");
+function renderWindows(row, pool, now) {
+  const usage = row.state.usage ?? null;
+  const windows = liveWindows(usage, now);
+  if (windows.length === 0) {
+    return dim4(usage && usage.windows.length > 0 ? "refilled since last seen" : "usage unknown");
+  }
   return windows.map((w) => {
     const threshold = pool.switchAtByWindow[w.slot] ?? pool.switchAt;
     const text = `${w.displayId} ${pct(w.usedFraction)}`;
@@ -104035,7 +104212,7 @@ function renderRow2(row, pool, now) {
   const legacy = row.record.legacy ? dim4(" (legacy file)") : "";
   const disabled = row.record.enabled ? "" : dim4(" disabled");
   const plan = row.record.identity.plan ? dim4(` ${row.record.identity.plan}`) : "";
-  lines.push(`  ${marker} ${strong2(row.record.label)}${legacy}${plan}${disabled}  ${renderWindows(row, pool)}` + (row.isActive ? dim4("  active") : ""));
+  lines.push(`  ${marker} ${strong2(row.record.label)}${legacy}${plan}${disabled}  ${renderWindows(row, pool, now)}` + (row.isActive ? dim4("  active") : ""));
   if (row.stateFailed) {
     lines.push(`      ${warn2("state unreadable \u2014 ranked last, never assumed fresh")}`);
   }
@@ -104118,7 +104295,7 @@ ${strong2(vendorOf(report.provider))}`);
   if (!any) {
     console.log(`
 No subscription accounts are configured.`);
-    console.log(dim4("A Codex login (`claudish login codex`) is shown here as `default (legacy file)` " + "once it exists; multi-account commands arrive with the pool."));
+    console.log(dim4("A Codex login (`claudish login codex`) is shown here as `default (legacy file)` " + "once it exists; add an account with `claudish account add codex --label <label>`."));
   }
   console.log("");
 }
@@ -104326,6 +104503,7 @@ The allowance trajectory, alerts and sessions of a claudish provider's account p
   --horizon <h|d>     how far ahead to project, 1h to 7d (default 7d)
   --provider codex    the claudish provider (openai-codex); the only one with a model today`;
 var init_account_command = __esm(() => {
+  init_policy2();
   init_pool();
   init_registry();
   init_state_store();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudish",
-  "version": "14.5.0",
+  "version": "14.5.2",
   "description": "Run Claude Code with any model - OpenRouter, Ollama, LM Studio & local models",
   "type": "module",
   "main": "./dist/index.js",
@@ -71,10 +71,10 @@
     "ai"
   ],
   "optionalDependencies": {
-    "@claudish/magmux-darwin-arm64": "14.5.0",
-    "@claudish/magmux-darwin-x64": "14.5.0",
-    "@claudish/magmux-linux-arm64": "14.5.0",
-    "@claudish/magmux-linux-x64": "14.5.0"
+    "@claudish/magmux-darwin-arm64": "14.5.2",
+    "@claudish/magmux-darwin-x64": "14.5.2",
+    "@claudish/magmux-linux-arm64": "14.5.2",
+    "@claudish/magmux-linux-x64": "14.5.2"
   },
   "author": "Jack Rudenko <i@madappgang.com>",
   "license": "MIT",