codesesh 0.17.0 → 0.18.0

package/dist/{dist-KEPJFHOC.js → dist-DMGLFBW6.js}

@@ -16,15 +16,18 @@ import {
   deleteBookmark,
   deleteSessionAlias,
   diffSessionSources,
+  ensurePrivateDirectory,
   ensureSessionTagsSync,
   executeSessionSearch,
   filterSessionSearchCandidates,
   getAgentInfoMap,
   getAgentLastFullSyncAt,
   getCachePath2,
+  getPricingGeneration,
   getRegisteredAgents,
   getSessionActivityTime,
   getSmartTagSourceTimestamp,
+  hasPendingPricing,
   importBookmarks,
   isAgentCacheInitialized,
   isProjectIdentityKind,
@@ -41,20 +44,22 @@ import {
   mergeSearchQueryOptions,
   mergeSortedSessions,
   perf,
+  publishPendingPricing,
   refreshPricingCache,
   registerAgent,
+  restrictExistingPrivateFiles,
+  restrictPrivateFile,
   saveCachedSessionChanges,
   saveCachedSessions,
   scanSessions,
   sessionSignature,
   setCoreDiagnostics,
   sortSessions,
-  startOfLocalDay,
   syncSessionSearchIndex,
   syncSessionSearchIndexChanges,
   upsertBookmark,
   upsertSessionAlias
-} from "./chunk-7APNDHQ6.js";
+} from "./chunk-HIYT2ZJL.js";
 export {
   BaseAgent,
   StateStorageUnavailableError as BookmarkStorageUnavailableError,
@@ -73,15 +78,18 @@ export {
   deleteBookmark,
   deleteSessionAlias,
   diffSessionSources,
+  ensurePrivateDirectory,
   ensureSessionTagsSync,
   executeSessionSearch,
   filterSessionSearchCandidates,
   getAgentInfoMap,
   getAgentLastFullSyncAt,
   getCachePath2 as getCachePath,
+  getPricingGeneration,
   getRegisteredAgents,
   getSessionActivityTime,
   getSmartTagSourceTimestamp,
+  hasPendingPricing,
   importBookmarks,
   isAgentCacheInitialized,
   isProjectIdentityKind,
@@ -98,18 +106,20 @@ export {
   mergeSearchQueryOptions,
   mergeSortedSessions,
   perf,
+  publishPendingPricing,
   refreshPricingCache,
   registerAgent,
+  restrictExistingPrivateFiles,
+  restrictPrivateFile,
   saveCachedSessionChanges,
   saveCachedSessions,
   scanSessions,
   sessionSignature,
   setCoreDiagnostics,
   sortSessions,
-  startOfLocalDay,
   syncSessionSearchIndex,
   syncSessionSearchIndexChanges,
   upsertBookmark,
   upsertSessionAlias
 };
-//# sourceMappingURL=dist-KEPJFHOC.js.map
+//# sourceMappingURL=dist-DMGLFBW6.js.map

package/dist/index.js

@@ -2,16 +2,18 @@
 import {
   appLogger,
   logSearchIndexSync
-} from "./chunk-A4U2SMJJ.js";
+} from "./chunk-DHNP33L4.js";
 import {
   FileSystemSessionSource,
   SessionAliasValidationError,
   StateStorageUnavailableError,
+  addCalendarDays,
   attachMissingProjectIdentities,
   attachProjectMetrics,
   buildAgentCacheMeta,
   buildDashboard,
   computeSessionDiff,
+  countCalendarDays,
   createProjectScopeMatcher,
   createRegisteredAgents,
   deleteBookmark,
@@ -36,17 +38,20 @@ import {
   matchesProjectScope,
   materializeSessionDetailResponse,
   mergeSearchQueryOptions,
+  mergeSessionsUpdatedEvents,
   mergeSortedSessions,
   normalizeSessionReference,
   perf,
+  publishPendingPricing,
   refreshPricingCache,
   scanSessions,
+  sessionRoutePath,
   sessionSignature,
   sortSessions,
-  startOfLocalDay,
+  startOfCalendarDay,
   upsertBookmark,
   upsertSessionAlias
-} from "./chunk-7APNDHQ6.js";
+} from "./chunk-HIYT2ZJL.js";
 
 // src/index.ts
 import { defineCommand, runMain } from "citty";
@@ -58,6 +63,7 @@ import { compress } from "hono/compress";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 import { existsSync } from "fs";
+import { createServer as createHttpsServer } from "https";
 import { resolve, dirname } from "path";
 import { fileURLToPath } from "url";
 
@@ -65,7 +71,7 @@ import { fileURLToPath } from "url";
 import { Hono } from "hono";
 
 // src/time-window-resolution.ts
-var DAY_MS = 24 * 60 * 60 * 1e3;
+var ROLLING_DAY_MS = 24 * 60 * 60 * 1e3;
 var DEFAULT_DASHBOARD_DAYS = 30;
 function resolveTimeWindow(request) {
   return request.mode === "cli" ? resolveCliWindow(request) : resolveDashboardWindow(request);
@@ -78,7 +84,7 @@ function resolveCliWindow(request) {
   const days = parseDays(request.days);
   if (days === 0) return { to, days };
   if (days == null || days < 0) return { to };
-  const rollingFrom = now - days * DAY_MS;
+  const rollingFrom = now - days * ROLLING_DAY_MS;
   return Number.isFinite(rollingFrom) ? { from: rollingFrom, to, days } : { to };
 }
 function resolveDashboardWindow(request) {
@@ -90,19 +96,19 @@ function resolveDashboardWindow(request) {
   let days = parsedDays != null && parsedDays > 0 ? parsedDays : defaults.days;
   const queryFrom = parseOptionalDate(request.query.from);
   if (queryFrom != null) {
-    days ??= elapsedDays(queryFrom, to);
+    days ??= countCalendarDays(queryFrom, to);
     return { from: queryFrom, to, days };
   }
   if (parsedDays === 0 || !hasQueryDays && defaults.days === 0) {
     return { to, days: 0 };
   }
   if (defaults.from != null) {
-    days ??= elapsedDays(defaults.from, to);
+    days ??= countCalendarDays(defaults.from, to);
     return { from: defaults.from, to, days };
   }
   const resolvedDays = days != null && days > 0 ? days : DEFAULT_DASHBOARD_DAYS;
   return {
-    from: startOfLocalDay(to) - (resolvedDays - 1) * DAY_MS,
+    from: addCalendarDays(startOfCalendarDay(to), -(resolvedDays - 1)),
     to,
     days: resolvedDays
   };
@@ -121,10 +127,7 @@ function parseOptionalDate(value) {
 function parseDays(value) {
   if (value == null) return void 0;
   const days = Number.parseInt(value, 10);
-  return Number.isSafeInteger(days) && Number.isSafeInteger(days * DAY_MS) ? days : void 0;
-}
-function elapsedDays(from, to) {
-  return Math.max(1, Math.ceil((to - from) / DAY_MS));
+  return Number.isSafeInteger(days) && Number.isSafeInteger(days * ROLLING_DAY_MS) ? days : void 0;
 }
 
 // src/api/query-params.ts
@@ -398,6 +401,7 @@ function getSessionHeadReference(session) {
     sessionId: session.id
   };
 }
+var SESSION_DETAIL_STREAM_BATCH_CHARS = 64 * 1024;
 function createSessionDetailJsonResponse(data, messages) {
   const encoder = new TextEncoder();
   const headerJson = JSON.stringify(data);
@@ -412,14 +416,24 @@ function createSessionDetailJsonResponse(data, messages) {
           wroteHeader = true;
           return;
         }
-        const next = iterator.next();
-        if (!next.done) {
-          controller.enqueue(encoder.encode(`${wroteMessage ? "," : ""}${next.value}`));
+        const batch = [];
+        let batchLength = 0;
+        let next = iterator.next();
+        while (!next.done) {
+          const prefix = wroteMessage ? "," : "";
+          batch.push(prefix, next.value);
+          batchLength += prefix.length + next.value.length;
           wroteMessage = true;
+          if (batchLength >= SESSION_DETAIL_STREAM_BATCH_CHARS) break;
+          next = iterator.next();
+        }
+        if (next.done) {
+          batch.push("]}");
+          controller.enqueue(encoder.encode(batch.join("")));
+          controller.close();
           return;
         }
-        controller.enqueue(encoder.encode("]}"));
-        controller.close();
+        controller.enqueue(encoder.encode(batch.join("")));
       },
       cancel() {
         iterator.return?.();
@@ -757,7 +771,7 @@ function handleGetDashboard(c, scanSource, defaults = {}) {
       scope.projectKind,
       scope.projectKey,
       from,
-      fixedTo ?? startOfLocalDay(to)
+      fixedTo ?? startOfCalendarDay(to)
     ],
     () => {
       const agentInfo = getAgentInfoMap({});
@@ -888,8 +902,48 @@ function createApiRoutes(scanSource, eventSource, options = {}) {
 
 // src/remote-access.ts
 import { randomBytes, timingSafeEqual } from "crypto";
+import { readFileSync } from "fs";
 import { isIP } from "net";
 var REMOTE_ACCESS_QUERY_PARAM = "access_token";
+var RemoteTransportError = class extends Error {
+};
+function resolveRemoteTransport(request) {
+  const hasCert = Boolean(request.tlsCertPath);
+  const hasKey = Boolean(request.tlsKeyPath);
+  if (hasCert !== hasKey) {
+    throw new RemoteTransportError("TLS requires both --tls-cert and --tls-key.");
+  }
+  if (hasCert && request.trustProxy) {
+    throw new RemoteTransportError(
+      "Use either --tls-cert/--tls-key or --trust-proxy, not both: only one of them terminates TLS."
+    );
+  }
+  if (hasCert) {
+    try {
+      return {
+        kind: "tls",
+        cert: readFileSync(request.tlsCertPath),
+        key: readFileSync(request.tlsKeyPath)
+      };
+    } catch (error) {
+      throw new RemoteTransportError(
+        `Unable to read the TLS certificate or key: ${error instanceof Error ? error.message : String(error)}`
+      );
+    }
+  }
+  if (request.trustProxy) return { kind: "trusted-proxy" };
+  return isLoopbackHostname(request.hostname) ? { kind: "loopback" } : { kind: "plaintext" };
+}
+var FORWARDED_PROTO_HEADER = "X-Forwarded-Proto";
+function requireProxyTls() {
+  return async (c, next) => {
+    const proto = c.req.header(FORWARDED_PROTO_HEADER)?.split(",")[0]?.trim().toLowerCase();
+    if (proto !== "https") {
+      return c.json({ error: "Requests must arrive over TLS through the trusted proxy" }, 403);
+    }
+    await next();
+  };
+}
 function createRemoteAccessToken() {
   return randomBytes(32).toString("base64url");
 }
@@ -969,6 +1023,7 @@ async function createServer(port, store, options = {}) {
   const app = new Hono2();
   const hostname = options.hostname ?? "127.0.0.1";
   const isLoopback = isLoopbackHostname(hostname);
+  const transport = options.transport ?? (isLoopback ? { kind: "loopback" } : { kind: "plaintext" });
   const remoteAccessToken = !isLoopback ? options.remoteAccessToken ?? (options.remoteAccess ? createRemoteAccessToken() : null) : null;
   if (!isLoopback && !remoteAccessToken) {
     throw new Error(
@@ -995,6 +1050,9 @@ async function createServer(port, store, options = {}) {
       });
     }
   });
+  if (transport.kind === "trusted-proxy") {
+    app.use("/api/*", requireProxyTls());
+  }
   if (remoteAccessToken) {
     app.use("/api/*", remoteAccessAuth(remoteAccessToken));
   }
@@ -1012,7 +1070,7 @@ async function createServer(port, store, options = {}) {
     defaultSessionDays: options.defaultSessionDays
   };
   app.route("/api", createApiRoutes(store, store, routeOptions));
-  const webDistPath = findWebDistPath();
+  const webDistPath = options.webDistPath ?? findWebDistPath();
   if (webDistPath) {
     app.use("/*", serveStatic({ root: webDistPath }));
     app.get("/*", serveStatic({ root: webDistPath, path: "index.html" }));
@@ -1022,7 +1080,15 @@ async function createServer(port, store, options = {}) {
   let actualPort = port;
   for (let offset = 0; offset < attempts; offset += 1) {
     const candidatePort = port + offset;
-    server = serve({ fetch: app.fetch, port: candidatePort, hostname });
+    server = serve({
+      fetch: app.fetch,
+      port: candidatePort,
+      hostname,
+      ...transport.kind === "tls" ? {
+        createServer: createHttpsServer,
+        serverOptions: { cert: transport.cert, key: transport.key }
+      } : {}
+    });
     try {
       await waitForListening(server);
       actualPort = getListeningPort(server, candidatePort);
@@ -1042,19 +1108,33 @@ async function createServer(port, store, options = {}) {
       throw new Error(getServerStartupErrorMessage(error, candidatePort));
     }
   }
-  const baseUrl = isLoopback ? `http://localhost:${actualPort}` : `http://${hostname}:${actualPort}`;
+  const scheme = transport.kind === "tls" ? "https" : "http";
+  const baseUrl = isLoopback ? `${scheme}://localhost:${actualPort}` : `${scheme}://${hostname}:${actualPort}`;
   const url = remoteAccessToken ? `${baseUrl}/?${REMOTE_ACCESS_QUERY_PARAM}=${encodeURIComponent(remoteAccessToken)}` : baseUrl;
   appLogger.info("server.listen", {
     port: actualPort,
     requested_port: port,
     hostname,
-    remote_access: Boolean(remoteAccessToken)
+    remote_access: Boolean(remoteAccessToken),
+    transport: transport.kind
   });
   if (!isLoopback) {
-    appLogger.warn("server.listen.remote_access", { hostname, port: actualPort });
+    appLogger.warn("server.listen.remote_access", {
+      hostname,
+      port: actualPort,
+      transport: transport.kind
+    });
     console.warn(`
 \u26A0 \u8FDC\u7A0B\u8BBF\u95EE\u5DF2\u542F\u7528\u3002\u4EFB\u4F55\u6301\u6709\u542F\u52A8 URL \u7684\u4EBA\u90FD\u53EF\u4EE5\u8BFB\u53D6\u4F60\u7684 AI \u4F1A\u8BDD\u8BB0\u5F55\u3002
 `);
+    if (transport.kind === "plaintext") {
+      appLogger.warn("server.listen.plaintext", { hostname, port: actualPort });
+      console.warn(
+        `\u26A0 \u4F20\u8F93\u672A\u52A0\u5BC6\u3002\u8BBF\u95EE\u4EE4\u724C\u4E0E\u5B8C\u6574\u4F1A\u8BDD\u5185\u5BB9\u4EE5\u660E\u6587\u7ECF\u8FC7\u7F51\u7EDC\uFF0CURL \u4E2D\u7684\u4EE4\u724C\u8FD8\u53EF\u80FD\u5199\u5165\u4EE3\u7406\u8BBF\u95EE\u65E5\u5FD7\u3002
+  \u4F7F\u7528 --tls-cert/--tls-key \u76F4\u63A5\u542F\u7528 TLS\uFF0C\u6216\u5728\u53D7\u4FE1\u53CD\u5411\u4EE3\u7406\u540E\u4F7F\u7528 --trust-proxy\u3002
+`
+      );
+    }
   }
   return {
     url,
@@ -1532,6 +1612,22 @@ var SearchIndexJobRunner = class {
         logSearchIndexSync(message.context, message.result);
         return;
       }
+      if (message.type === "persist-failed") {
+        appLogger.error("search_index.persist_failed", {
+          batch_id: batch.id,
+          context: message.context,
+          stage: message.stage,
+          agent: message.agentName,
+          sessions: message.sessions
+        });
+        this.settle(
+          batch,
+          new Error(
+            `Search index worker failed to persist ${message.stage} for ${message.agentName}`
+          )
+        );
+        return;
+      }
       if (message.type !== "done") return;
       appLogger.info(`${message.context}.done`, {
         duration_ms: Math.round(message.durationMs),
@@ -2040,8 +2136,22 @@ var AgentSyncEngine = class {
     });
     return "committed";
   }
+  /**
+   * An agent that cannot be reached was never scanned, so there is nothing to
+   * compare against. Publishing an empty result here would diff every known
+   * session into a removal — the same mistake as reading a failed query as an
+   * empty database.
+   */
   refreshUnavailableAgent(agentName) {
     this.lastRefreshAtByAgent.set(agentName, Date.now());
+    const previousSessions = this.sessionIndex.snapshot().byAgent[agentName] ?? [];
+    if (previousSessions.length > 0) {
+      appLogger.warn("scan.refresh.agent_unavailable", {
+        agent: agentName,
+        retained_sessions: previousSessions.length
+      });
+      return this.refreshStrategyResult(previousSessions, { status: "unchanged" });
+    }
     return this.refreshStrategyResult([]);
   }
   async initializeAgent(agent, previousSessions) {
@@ -2377,8 +2487,12 @@ function isSameOrChildPath(parentPath, childPath) {
   const path = relative(parentPath, childPath);
   return path === "" || !path.startsWith("..") && !isAbsolute(path);
 }
+var SQLITE_SIDECAR_SUFFIXES = ["-wal", "-journal"];
+function isSqliteSidecarOf(changedPath, targetPath) {
+  return SQLITE_SIDECAR_SUFFIXES.some((suffix) => changedPath === `${targetPath}${suffix}`);
+}
 function isRelatedPath(changedPath, targetPath) {
-  return isSameOrChildPath(targetPath, changedPath) || isSameOrChildPath(changedPath, targetPath);
+  return isSameOrChildPath(targetPath, changedPath) || isSameOrChildPath(changedPath, targetPath) || isSqliteSidecarOf(changedPath, targetPath);
 }
 function mergeScopes(target, scopes) {
   for (const scope of scopes) {
@@ -2772,36 +2886,6 @@ var ThreadWorkerRunner = class {
 
 // src/live-scan.ts
 var NEW_SESSION_EVENT_WINDOW_MS = 250;
-function mergeEvents(previous, next) {
-  const changedSessionHeads = /* @__PURE__ */ new Map();
-  const removedSessionRefs = /* @__PURE__ */ new Map();
-  const sessionKey = (agentName, sessionId) => `${agentName}\0${sessionId}`;
-  const addChanged = (item) => {
-    const key = sessionKey(item.reference.agentName, item.reference.sessionId);
-    removedSessionRefs.delete(key);
-    changedSessionHeads.set(key, item);
-  };
-  const addRemoved = (item) => {
-    const key = sessionKey(item.agentName, item.sessionId);
-    changedSessionHeads.delete(key);
-    removedSessionRefs.set(key, item);
-  };
-  for (const item of previous.changedSessionHeads) addChanged(item);
-  for (const item of previous.removedSessionRefs) addRemoved(item);
-  for (const item of next.changedSessionHeads) addChanged(item);
-  for (const item of next.removedSessionRefs) addRemoved(item);
-  return {
-    type: "sessions-updated",
-    changedAgents: Array.from(/* @__PURE__ */ new Set([...previous.changedAgents, ...next.changedAgents])),
-    newSessions: previous.newSessions + next.newSessions,
-    updatedSessions: previous.updatedSessions + next.updatedSessions,
-    removedSessions: previous.removedSessions + next.removedSessions,
-    totalSessions: next.totalSessions,
-    timestamp: next.timestamp,
-    changedSessionHeads: [...changedSessionHeads.values()],
-    removedSessionRefs: [...removedSessionRefs.values()]
-  };
-}
 var LiveScanStore = class {
   watchEnabled;
   scanOptions;
@@ -2854,7 +2938,11 @@ var LiveScanStore = class {
     });
     const snapshot = this.getSnapshot();
     const indexStartedAt = performance.now();
-    if (!this.deferInitialRefresh) await this.syncEngine.syncInitialIndex();
+    if (!this.deferInitialRefresh) {
+      await this.syncEngine.syncInitialIndex().catch((error) => {
+        appLogger.error("scan.initial.index_failed", { error });
+      });
+    }
     const indexDuration = performance.now() - indexStartedAt;
     appLogger.info("scan.initial.done", {
       duration_ms: Math.round(performance.now() - startedAt),
@@ -2928,7 +3016,7 @@ var LiveScanStore = class {
     for (const listener of this.listeners) listener(event);
   }
   queueEvent(event) {
-    this.pendingEvent = this.pendingEvent ? mergeEvents(this.pendingEvent, event) : event;
+    this.pendingEvent = this.pendingEvent ? mergeSessionsUpdatedEvents(this.pendingEvent, event) : event;
     if (this.pendingEventTimer) return;
     this.pendingEventTimer = setTimeout(() => {
       const pending = this.pendingEvent;
@@ -2952,11 +3040,11 @@ var LiveScanStore = class {
 import { consola } from "consola";
 
 // src/version.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync2 } from "fs";
 import { resolve as resolve3, dirname as dirname3 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 var __dirname = dirname3(fileURLToPath4(import.meta.url));
-var pkg = JSON.parse(readFileSync(resolve3(__dirname, "../package.json"), "utf-8"));
+var pkg = JSON.parse(readFileSync2(resolve3(__dirname, "../package.json"), "utf-8"));
 var VERSION = pkg.version;
 
 // src/output.ts
@@ -2978,6 +3066,25 @@ function printScanResults(agents) {
   consola.log("");
 }
 
+// src/session-index-output.ts
+function buildSessionIndexOutput(snapshot, window = {}) {
+  const sessions = snapshot.sessions.filter((session) => {
+    const activity = session.time_updated ?? session.time_created;
+    if (window.from != null && activity < window.from) return false;
+    if (window.to != null && activity > window.to) return false;
+    return true;
+  });
+  const agents = getAgentInfoMap(
+    Object.fromEntries(Object.entries(snapshot.byAgent).map(([name, list]) => [name, list.length]))
+  ).map(({ name, displayName, count }) => ({
+    name,
+    displayName,
+    count,
+    available: count > 0
+  }));
+  return { agents, sessions };
+}
+
 // src/runtime-plan.ts
 function parseSessionUri(uri) {
   const match = uri.match(/^([a-z]+):\/\/(.+)$/i);
@@ -3003,7 +3110,10 @@ function buildCliRuntimePlan(input, environment) {
 function resolveStartupUrl(startupUrl, targetSession) {
   if (!targetSession) return startupUrl;
   const url = new URL(startupUrl);
-  url.pathname = `/${targetSession.agent.toLowerCase()}/${targetSession.sessionId}`;
+  url.pathname = sessionRoutePath({
+    agentName: targetSession.agent,
+    sessionId: targetSession.sessionId
+  });
   return url.toString();
 }
 function redactStartupUrl(startupUrl) {
@@ -3028,6 +3138,27 @@ function hasExplicitPortArg(argv) {
   });
 }
 
+// src/pricing-refresh.ts
+var REFRESH_TIMEOUT_MS = 1e4;
+function startPricingRefresh(timeoutMs = REFRESH_TIMEOUT_MS) {
+  const controller = new AbortController();
+  const completion = refreshPricingCache({ signal: controller.signal, timeoutMs }).catch(
+    (error) => {
+      appLogger.warn("pricing.refresh.error", { error });
+      return false;
+    }
+  );
+  return {
+    publish() {
+      if (publishPendingPricing()) appLogger.info("pricing.refresh.published", {});
+    },
+    async cancel() {
+      controller.abort();
+      await completion;
+    }
+  };
+}
+
 // src/index.ts
 var main = defineCommand({
   meta: {
@@ -3052,6 +3183,19 @@ var main = defineCommand({
       description: "Allow authenticated access when binding to a non-loopback address",
       default: false
     },
+    "tls-cert": {
+      type: "string",
+      description: "Path to a TLS certificate; serve remote access over HTTPS"
+    },
+    "tls-key": {
+      type: "string",
+      description: "Path to the TLS private key matching --tls-cert"
+    },
+    "trust-proxy": {
+      type: "boolean",
+      description: "A reverse proxy in front of CodeSesh terminates TLS",
+      default: false
+    },
     agent: {
       type: "string",
       alias: "a",
@@ -3124,6 +3268,18 @@ var main = defineCommand({
       );
       process.exit(1);
     }
+    let transport;
+    try {
+      transport = resolveRemoteTransport({
+        hostname,
+        tlsCertPath: args["tls-cert"],
+        tlsKeyPath: args["tls-key"],
+        trustProxy: args["trust-proxy"]
+      });
+    } catch (error) {
+      console.error(error instanceof Error ? error.message : String(error));
+      process.exit(1);
+    }
     if (trace) {
       perf.enable();
     }
@@ -3137,12 +3293,12 @@ var main = defineCommand({
       log_path: appLogger.getLogPath()
     });
     if (clearCache) {
-      const { clearCache: clear } = await import("./dist-KEPJFHOC.js");
+      const { clearCache: clear } = await import("./dist-DMGLFBW6.js");
       clear();
       appLogger.info("cache.clear");
       console.log("Cache cleared.");
     }
-    void refreshPricingCache();
+    const pricingRefresh = startPricingRefresh();
     let targetSession = null;
     if (args.session) {
       targetSession = parseSessionUri(args.session);
@@ -3186,26 +3342,10 @@ var main = defineCommand({
       console.log(perf.getReport());
     }
     if (jsonOnly) {
-      const windowed = result.sessions.filter((s) => {
-        const activity = s.time_updated ?? s.time_created;
-        if (listDefaultFrom != null && activity < listDefaultFrom) return false;
-        if (listDefaultTo != null && activity > listDefaultTo) return false;
-        return true;
-      });
-      const info = getAgentInfoMap(
-        Object.fromEntries(Object.entries(result.byAgent).map(([k, v]) => [k, v.length]))
-      );
-      const output = {
-        agents: info.map(({ name, displayName, count }) => ({
-          name,
-          displayName,
-          count,
-          available: count > 0
-        })),
-        sessions: windowed
-      };
+      await pricingRefresh.cancel();
+      const output = buildSessionIndexOutput(result, { from: listDefaultFrom, to: listDefaultTo });
       appLogger.info("cli.json_output", {
-        sessions: windowed.length,
+        sessions: output.sessions.length,
         duration_ms: Math.round(performance.now() - startedAt)
       });
       console.log(JSON.stringify(output, null, 2));
@@ -3221,7 +3361,8 @@ var main = defineCommand({
         defaultSessionDays: listDefaultDays,
         portFallbackAttempts: explicitPort ? 1 : DEFAULT_PORT_FALLBACK_ATTEMPTS,
         hostname,
-        remoteAccess
+        remoteAccess,
+        transport
       });
     } catch (error) {
       console.error(getServerStartupErrorMessage(error, port));
@@ -3229,6 +3370,7 @@ var main = defineCommand({
     }
     const { url } = app;
     if (!jsonOnly) {
+      pricingRefresh.publish();
       store.startBackgroundRefresh();
     }
     let shuttingDown = false;
@@ -3236,6 +3378,7 @@ var main = defineCommand({
       if (shuttingDown) return;
       shuttingDown = true;
       appLogger.info("cli.shutdown", { signal });
+      await pricingRefresh.cancel();
       await app.shutdown();
       process.exit(0);
     };