crewly 1.20.172 → 1.20.173

package/dist/cli/backend/src/services/harness/harness-relogin.service.js

@@ -1,64 +1,71 @@
 /**
- * Harness re-login coordinator — Phase 2 of onboarding: re-login over Slack.
- *
- * When a harness login expires, Crewly notices by itself, starts ONE login
- * broker session for that harness, DMs the owner what to do on their phone,
- * and resumes the agents that were stuck once the login succeeds. Nobody
- * has to touch the machine.
- *
- * Inputs:
- * - {@link HarnessReloginService.reportExpiry} — called by the OAuth
- *   re-login monitor when an agent's terminal output matches an expiry rule
- *   (login-expiry-rules.ts), and by the periodic status check of the
- *   orchestrator's harness ({@link HarnessReloginService.checkOrcHarness}).
- * - {@link HarnessReloginService.handleOwnerReply} — an owner's Slack DM
- *   reply. A reply is consumed only when it belongs to a flow: Claude's
- *   authorization code (while Claude's login is waiting for it and the reply
- *   looks like a code), the retry keyword, or a reply to an unrecognised
- *   login screen. Everything else goes through the normal chat path.
- * - The broker's `update` / `finished` events.
- * - {@link HarnessReloginService.startOwnerLogin} — the owner asked for a
- *   login: 「重新登录 claude」 in the orc DM (parsed by
- *   {@link HarnessReloginService.handleOwnerReply}, no LLM involved) or the
- *   orchestrator's `harness-login` skill. Such a flow is *forced*: it runs
- *   even when the harness is still logged in (switching accounts), skips the
- *   silent API-key path, and answers in the conversation it was asked in.
- *
- * Rules:
- * - One flow per harness. Repeated detections only add stuck sessions. A
- *   flow that failed is followed up by a new detection at most once per
- *   {@link HARNESS_CONSTANTS.RELOGIN.REMIND_INTERVAL_MS} (the re-reminder),
- *   or restarted at once when the owner replies `relogin` / `重新登录`.
- *   When the last link simply expired unused (`timed_out`), the reminder is
- *   a text DM asking the owner to reply when they are ready — it does NOT
- *   start a new login: a device code lives 15 minutes, so a link sent while
- *   the owner is away is wasted, and `codex login` revokes whatever
- *   credentials exist when it starts (steamfun-ops 2026-09-30: five links at
- *   night, all expired unused).
- * - A login is started only when the harness's own status says
- *   `logged_out`; `unknown` is not enough, for the same revocation reason.
- * - If Crewly holds an API key for the harness it is used silently (no DM).
- * - Claude → `subscription` (`claude setup-token`), Codex → `device`.
- * - Secrets: Claude's code is passed to the broker and never stored, logged
- *   or echoed; DMs are built from {@link LoginSession} snapshots, which never
- *   contain a token, and the screen text is redacted again.
+ * Harness re-login coordinator — re-login from the owner's phone, with no
+ * agent involved.
+ *
+ * The instance backend (never an agent: every agent may be stuck on the very
+ * login that expired) notices that a harness's login is gone, tells the owner
+ * once, runs the harness's login itself when the owner replies, relays the
+ * link and the code, and brings the agents back with the messages that
+ * waited for them.
+ *
+ * Flow per harness (at most one at a time):
+ *
+ * 1. **Detect.** {@link HarnessReloginService.reportExpiry} — an agent's
+ *    output or screen matched an expiry rule (login-expiry-rules.ts, via the
+ *    OAuth re-login monitor), or the periodic check
+ *    ({@link HarnessReloginService.checkHarnesses}) found a harness in use
+ *    signed out. The periodic check covers every harness the orchestrator or
+ *    a team member is configured on, so it works with zero agents running.
+ * 2. **Confirm.** The harness's status command, then — because Claude Code's
+ *    stored credential survives an expiry — a live probe
+ *    (harness-login-probe.ts). Only a confirmed `logged_out` goes on;
+ *    `unknown` never does (`codex login` revokes a working login).
+ * 3. **Tell the owner once.** A stored API key is used silently if Crewly has
+ *    one. Otherwise one DM — "Claude Code on <machine> is signed out, so N
+ *    agents can't work. Reply `login` …" — then re-reminders with backoff
+ *    (3 h, doubling, 24 h cap), persisted so restarts do not re-send it. No
+ *    login is started yet: a link sent while the owner is away expires unused.
+ * 4. **The owner replies `login`** (or 「重新登录」, `relogin claude`, …) in
+ *    the DM. The Slack bridge offers owner DMs to
+ *    {@link HarnessReloginService.handleOwnerReply} before anything else, so
+ *    this works with no agent awake. The login broker runs the harness's
+ *    login in its own PTY (`claude setup-token` / `codex login --device-auth`)
+ *    and the link (and Codex's one-time code) is sent back.
+ * 5. **The code.** For Claude the owner replies with the code from the page;
+ *    it is typed into the waiting login. A rejected code is reported once; an
+ *    expired link puts the flow back to "signed out" ("reply `login` for a
+ *    new link").
+ * 6. **Success** is confirmed with the probe, then the stuck agents are
+ *    restarted (conversation resumed) and the owner messages that waited are
+ *    re-delivered ({@link HarnessReloginDeps.onLoginRestored}). One DM says so.
+ *
+ * Owner-requested logins ({@link HarnessReloginService.startOwnerLogin}:
+ * 「重新登录 claude」 / "relogin codex" / the orchestrator's `harness-login`
+ * skill) start the broker at once, even while logged in (account switch).
+ *
+ * Secrets: Claude's code is passed to the broker and never stored, logged
+ * or echoed; DMs are built from {@link LoginSession} snapshots, which never
+ * contain a token, and the screen text is redacted again.
  *
  * @module services/harness/harness-relogin.service
  */
+import * as os from 'os';
 import { HARNESS_CONSTANTS } from '../../constants.js';
 import { LoggerService } from '../core/logger.service.js';
 import { getHarnessCredentialsStore } from './harness-credentials.store.js';
+import { createHarnessLoginProbe } from './harness-login-probe.js';
 import { getBrokerLoginMethod, getHarnessDefinition } from './harness-registry.js';
 import { getHarnessService } from './harness.service.js';
 import { SILENT_HARNESS_LOGGER, isHarnessId, isTerminalLoginState, } from './harness.types.js';
 import { LOGIN_BROKER_EVENTS } from './login-broker.service.js';
 import { redactSecrets } from './login-rules.js';
 import { parseOwnerLoginRequest } from './owner-login-request.js';
-/** A detected expiry: not forced, standard wording, master-bot DM. */
+import { MemoryReloginStateStore, createDefaultReloginStateStore } from './relogin-state.store.js';
+/** A detected expiry: not forced, standard wording, this machine's DM. */
 const EXPIRY_FLOW = { trigger: 'expiry', switchAccount: false, replyTarget: null };
 /** Harnesses the coordinator can log in (they have a broker method). */
 function hasBrokerLogin(harnessId) {
-    return getBrokerLoginMethod(harnessId) !== undefined;
+    return isHarnessId(harnessId) && getBrokerLoginMethod(harnessId) !== undefined;
 }
 /**
  * Display name of a harness.
@@ -69,6 +76,37 @@ function hasBrokerLogin(harnessId) {
 function displayName(harnessId) {
     return getHarnessDefinition(harnessId)?.displayName ?? harnessId;
 }
+/**
+ * The word the owner types after `relogin` for a harness.
+ *
+ * @param harnessId - Harness id
+ * @returns e.g. "claude"
+ */
+export function harnessCommandWord(harnessId) {
+    if (harnessId === HARNESS_CONSTANTS.IDS.CLAUDE_CODE)
+        return 'claude';
+    if (harnessId === HARNESS_CONSTANTS.IDS.CODEX_CLI)
+        return 'codex';
+    if (harnessId === HARNESS_CONSTANTS.IDS.ANTIGRAVITY_CLI)
+        return 'antigravity';
+    return 'gemini';
+}
+/**
+ * Normalise a short reply for keyword matching: trim, lower-case, drop
+ * surrounding quotes / backticks and trailing punctuation.
+ *
+ * @param text - Owner reply
+ * @returns Normalised text
+ */
+function normaliseKeyword(text) {
+    return text
+        .trim()
+        .replace(/^[`'"「“]+|[`'"」”]+$/g, '')
+        .replace(/[\s.!?。！？~～]+$/u, '')
+        .trim()
+        .toLowerCase()
+        .replace(/\s+/g, ' ');
+}
 /**
  * Whether a reply asks to start the login over.
  *
@@ -76,9 +114,27 @@ function displayName(harnessId) {
  * @returns True for `relogin`, `re-login` or `重新登录`
  */
 export function isRetryKeyword(text) {
-    const normalized = text.trim().toLowerCase();
+    const normalized = normaliseKeyword(text);
     return HARNESS_CONSTANTS.RELOGIN.RETRY_KEYWORDS.some((keyword) => keyword.toLowerCase() === normalized);
 }
+/**
+ * Whether a bare reply asks to sign in (`login`, `sign in`, 「登录」, the retry keywords).
+ *
+ * @param text - Owner reply
+ * @returns True when the whole reply is a login keyword
+ *
+ * @example
+ * ```ts
+ * isLoginKeyword('Login!'); // true
+ * isLoginKeyword('login to gmail'); // false
+ * ```
+ */
+export function isLoginKeyword(text) {
+    if (typeof text !== 'string')
+        return false;
+    const normalized = normaliseKeyword(text);
+    return [...HARNESS_CONSTANTS.RELOGIN.LOGIN_KEYWORDS, ...HARNESS_CONSTANTS.RELOGIN.RETRY_KEYWORDS].some((keyword) => keyword.toLowerCase() === normalized);
+}
 /**
  * Strip formatting Slack clients add around a pasted value (backticks).
  *
@@ -100,18 +156,26 @@ export function looksLikeAuthCode(text) {
     return text.length >= CODE_MIN_LENGTH && text.length <= CODE_MAX_LENGTH && !/\s/.test(text);
 }
 /**
- * "2 agents are waiting: a, b" — capped list of waiting agents.
+ * "Ella, Rex and 3 more" — capped list of agent names.
  *
- * @param agents - Session names
- * @returns Sentence fragment
+ * @param agents - Agent names
+ * @returns List text ('' when empty)
  */
 export function describeWaitingAgents(agents) {
     if (agents.length === 0)
-        return '目前没有 agent 在用它。';
+        return '';
     const max = HARNESS_CONSTANTS.RELOGIN.DM_MAX_LISTED_AGENTS;
-    const listed = agents.slice(0, max).join('、');
-    const more = agents.length > max ? ` 等 ${agents.length} 个` : '';
-    return `${listed}${more} 在等它。`;
+    const listed = agents.slice(0, max).join(', ');
+    return agents.length > max ? `${listed} and ${agents.length - max} more` : listed;
+}
+/**
+ * "1 agent" / "3 agents".
+ *
+ * @param n - Count
+ * @returns Phrase
+ */
+function agentCount(n) {
+    return `${n} agent${n === 1 ? '' : 's'}`;
 }
 /**
  * Keep text safe for a DM: redact secrets, drop code fences, cap length (tail).
@@ -125,7 +189,7 @@ function safeForDm(text, max) {
     return redacted.length > max ? redacted.slice(redacted.length - max) : redacted;
 }
 /** Retry hint appended to failure DMs. */
-const RETRY_HINT = '回复「重新登录」（或 `relogin`）再试一次。';
+const RETRY_HINT = 'Reply `login` to try again.';
 /**
  * Prefix an owner reply needs before it is typed into an unrecognised login
  * screen. Without it, any one-line DM to the orc during the login would have
@@ -133,7 +197,7 @@ const RETRY_HINT = '回复「重新登录」（或 `relogin`）再试一次。';
  */
 export const SCREEN_REPLY_PREFIXES = ['输入', 'input'];
 /**
- * The text after a screen-reply prefix ("输入 1" → "1"), or null.
+ * The text after a screen-reply prefix ("input 1" → "1"), or null.
  *
  * @param reply - Owner reply (already unwrapped)
  * @returns Text to type, or null when the reply has no prefix
@@ -147,41 +211,66 @@ export function stripScreenReplyPrefix(reply) {
     return null;
 }
 /**
- * First line of a login DM.
+ * First line of a link DM.
  *
  * @param harnessId - Harness
- * @param waiting - Agents waiting on the login (expiry wording only)
- * @param wording - Owner-requested / account switch
+ * @param wording - Account switch / machine
  * @returns Slack mrkdwn line
  */
-function loginDmHeader(harnessId, waiting, wording) {
+function loginDmHeader(harnessId, wording) {
+    const name = displayName(harnessId);
+    const where = wording.machine ? ` on ${wording.machine}` : '';
+    return wording.switchAccount ? `*Switch the ${name} account${where}*` : `*Sign in to ${name}${where}*`;
+}
+/**
+ * The first "signed out" DM, a re-reminder, or the note after a link expired unused.
+ *
+ * @param harnessId - Harness
+ * @param machine - This machine's name
+ * @param agents - Names of the agents that run on it
+ * @param kind - `notice` (first), `reminder`, or `link_expired`
+ * @returns Slack mrkdwn text
+ *
+ * @example
+ * ```ts
+ * formatSignedOutDm('claude-code', 'iriss-air.lan', ['Ella', 'Rex'], 'notice');
+ * // "*Claude Code on iriss-air.lan is signed out*, so 2 agents can't work (Ella, Rex).\nReply `login` …"
+ * ```
+ */
+export function formatSignedOutDm(harnessId, machine, agents, kind = 'notice') {
     const name = displayName(harnessId);
-    if (!wording.ownerRequested)
-        return `*${name} 登录过期了。* ${describeWaitingAgents(waiting)}`;
-    return wording.switchAccount ? `*换账号登录 ${name}*` : `*登录 ${name}*`;
+    const reply = `Reply \`login\` here to sign in from your phone (or \`relogin ${harnessCommandWord(harnessId)}\`).`;
+    const listed = describeWaitingAgents(agents);
+    const who = agents.length > 0 ? `, so ${agentCount(agents.length)} can't work (${listed})` : '';
+    if (kind === 'link_expired') {
+        return `The sign-in link for ${name} on ${machine} expired before it was used${agents.length > 0 ? `; ${agentCount(agents.length)} still waiting` : ''}. Reply \`login\` when you're ready and I'll send a fresh one (it works for 15 minutes).`;
+    }
+    if (kind === 'reminder')
+        return `Reminder: ${name} on ${machine} is still signed out${who}.\n${reply}`;
+    return `*${name} on ${machine} is signed out*${who}.\n${reply}`;
 }
 /**
  * DM with the sign-in link (and Codex's one-time code on its own line).
  *
  * @param session - Broker session (never contains a secret)
- * @param waiting - Agents waiting on the login
- * @param wording - Owner-requested / account-switch wording (default: expiry)
+ * @param _waiting - Agents waiting on the login (unused; kept for callers)
+ * @param wording - Account switch / machine
  * @returns Slack mrkdwn text
  */
-export function formatLinkDm(session, waiting, wording = {}) {
-    const lines = [loginDmHeader(session.harnessId, waiting, wording), ''];
+export function formatLinkDm(session, _waiting = [], wording = {}) {
+    const lines = [loginDmHeader(session.harnessId, wording), ''];
     if (session.method === 'device') {
-        lines.push('1. 在手机上打开这个链接：', session.url ?? '', '', '2. 输入这个验证码：', session.userCode ?? '', '');
+        lines.push('1. Open this link on your phone:', session.url ?? '', '', '2. Enter this code:', session.userCode ?? '', '');
         if (wording.switchAccount)
-            lines.push('要换账号的话，先在打开的页面里切到要用的那个账号。');
-        lines.push('在手机上完成登录就行，这边会自动继续。');
+            lines.push('To use a different account, switch to it on that page first.');
+        lines.push('Finish signing in on your phone; Crewly continues by itself.');
     }
     else {
-        lines.push('1. 在手机上打开这个链接并授权：', session.url ?? '', '');
+        lines.push('1. Open this link on your phone and approve:', session.url ?? '', '');
         if (wording.switchAccount)
-            lines.push('   要换账号的话，先在打开的页面里切到要用的那个账号再授权。', '');
-        lines.push('2. 把授权后页面显示的代码直接回复在这里（只要代码）。', '');
-        lines.push('Crewly 会自动填进去，agent 自己接着干。');
+            lines.push('   To use a different account, switch to it on that page before approving.', '');
+        lines.push('2. Reply here with the code the page shows (just the code).', '');
+        lines.push('The link works for 15 minutes. Crewly enters the code and the agents carry on.');
     }
     return lines.join('\n');
 }
@@ -189,20 +278,20 @@ export function formatLinkDm(session, waiting, wording = {}) {
  * DM for a login screen the broker did not recognise.
  *
  * @param session - Broker session
- * @param waiting - Agents waiting on the login
- * @param wording - Owner-requested / account-switch wording (default: expiry)
+ * @param _waiting - Agents waiting on the login (unused; kept for callers)
+ * @param wording - Account switch / machine
  * @returns Slack mrkdwn text
  */
-export function formatScreenDm(session, waiting, wording = {}) {
+export function formatScreenDm(session, _waiting = [], wording = {}) {
     const screen = safeForDm(session.screen, HARNESS_CONSTANTS.RELOGIN.DM_SCREEN_MAX_CHARS) || '(empty screen)';
     return [
-        loginDmHeader(session.harnessId, waiting, wording),
+        loginDmHeader(session.harnessId, wording),
         '',
-        'Crewly 已经启动了登录，但没认出它的界面。现在显示的是：',
+        "Crewly started the sign-in but doesn't recognise its screen. It shows:",
         '```',
         screen,
         '```',
-        '要往这个终端里输入，回复「输入 <内容>」（例如「输入 1」）。其他消息照常发给 Orc。',
+        'To type into it, reply `input <text>` (for example `input 1`). Other messages go to the Orc as usual.',
     ].join('\n');
 }
 /**
@@ -213,22 +302,34 @@ export function formatScreenDm(session, waiting, wording = {}) {
  */
 export function formatRejectedDm(session) {
     const reason = safeForDm(session.message ?? '', HARNESS_CONSTANTS.RELOGIN.DM_MESSAGE_MAX_CHARS);
-    const what = session.method === 'subscription' ? '代码' : '输入';
-    return `这个${what}没通过${reason ? `（${reason}）` : ''}。再回复一次${what}，或者${RETRY_HINT}`;
+    const what = session.method === 'subscription' ? 'code' : 'input';
+    return `That ${what} didn't work${reason ? ` (${reason})` : ''}. Reply with it again, or reply \`login\` for a fresh link.`;
 }
 /**
- * DM after the login succeeded and the agents were restarted.
+ * "; 2 waiting messages re-delivered".
+ *
+ * @param redelivered - Count
+ * @returns Clause ('' for none)
+ */
+function redeliveredClause(redelivered) {
+    if (redelivered <= 0)
+        return '';
+    return `; ${redelivered} waiting message${redelivered === 1 ? '' : 's'} re-delivered`;
+}
+/**
+ * DM after a login came back and the agents were restarted.
  *
  * @param harnessId - Harness
  * @param result - Resume result
+ * @param redelivered - Owner messages re-delivered to them
+ * @param machine - This machine's name
  * @returns Slack mrkdwn text
  */
-export function formatSuccessDm(harnessId, result) {
-    const count = result.resumed.length;
-    let text = `好了：${displayName(harnessId)} 已重新登录，${count} 个 agent 已恢复。`;
-    if (result.failed.length > 0) {
-        text += ` 没能重启：${result.failed.join('、')}。`;
-    }
+export function formatSuccessDm(harnessId, result, redelivered = 0, machine) {
+    const where = machine ? ` on ${machine}` : '';
+    let text = `Done: ${displayName(harnessId)}${where} is signed in again. ${agentCount(result.resumed.length)} resumed${redeliveredClause(redelivered)}.`;
+    if (result.failed.length > 0)
+        text += ` Could not restart: ${result.failed.join(', ')}.`;
     return text;
 }
 /**
@@ -236,18 +337,19 @@ export function formatSuccessDm(harnessId, result) {
  *
  * @param harnessId - Harness
  * @param result - Which agents were restarted onto the new login
+ * @param redelivered - Owner messages re-delivered to them
  * @returns Slack mrkdwn text
  */
-export function formatOwnerSuccessDm(harnessId, result) {
-    let text = `好了：${displayName(harnessId)} 已登录。`;
+export function formatOwnerSuccessDm(harnessId, result, redelivered = 0) {
+    let text = `Done: ${displayName(harnessId)} is signed in.`;
     if (result.resumed.length > 0)
-        text += ` ${result.resumed.length} 个 agent 已重启，用上了新登录。`;
+        text += ` ${agentCount(result.resumed.length)} restarted on the new login${redeliveredClause(redelivered)}.`;
     if (result.failed.length > 0)
-        text += ` 没能重启：${result.failed.join('、')}。`;
+        text += ` Could not restart: ${result.failed.join(', ')}.`;
     return text;
 }
 /** Harness names the owner can type, for the "which one?" reply. */
-const WHICH_HARNESS_HINT = '回复「重新登录 claude」或「重新登录 codex」（要换账号就说「换个账号登录 claude」）。';
+const WHICH_HARNESS_HINT = 'Reply `relogin claude` or `relogin codex` (to switch accounts: `switch claude account`).';
 /**
  * Reply to a login request that named no harness Crewly can log in.
  *
@@ -255,7 +357,7 @@ const WHICH_HARNESS_HINT = '回复「重新登录 claude」或「重新登录 co
  * @returns Slack mrkdwn text
  */
 export function formatWhichHarnessDm(name) {
-    return name ? `Crewly 没有「${name}」这个编程助手。要登录哪个？${WHICH_HARNESS_HINT}` : `要登录哪个？${WHICH_HARNESS_HINT}`;
+    return name ? `Crewly doesn't run "${name}". Which one should I sign in? ${WHICH_HARNESS_HINT}` : `Which one should I sign in? ${WHICH_HARNESS_HINT}`;
 }
 /**
  * Reply for a harness that has no link login.
@@ -266,15 +368,15 @@ export function formatWhichHarnessDm(name) {
 export function formatNoBrokerLoginDm(harnessId) {
     const name = displayName(harnessId);
     if (harnessId === HARNESS_CONSTANTS.IDS.ANTIGRAVITY_CLI) {
-        return `${name} 用的是 Gemini API key，不走链接登录。在电脑上运行 \`crewly login antigravity\`，或者在 Crewly 设置页（Setup → 登录）填 key。`;
+        return `${name} uses a Gemini API key, not a sign-in link. Run \`crewly login antigravity\` on the machine, or enter the key in Crewly Setup → Sign in.`;
     }
     if (harnessId === HARNESS_CONSTANTS.IDS.GEMINI_CLI) {
-        return `${name} 只给企业版用，Crewly 没法帮它登录。${WHICH_HARNESS_HINT}`;
+        return `${name} is enterprise-only; Crewly can't sign it in. ${WHICH_HARNESS_HINT}`;
     }
-    return `${name} 没有链接登录，Crewly 帮不了它。${WHICH_HARNESS_HINT}`;
+    return `${name} has no sign-in link Crewly can use. ${WHICH_HARNESS_HINT}`;
 }
 /**
- * DM after the login failed or timed out (sent once per failure).
+ * DM after the login failed (sent once per failure).
  *
  * @param harnessId - Harness
  * @param reason - Broker message (redacted here)
@@ -282,41 +384,56 @@ export function formatNoBrokerLoginDm(harnessId) {
  */
 export function formatFailureDm(harnessId, reason) {
     const detail = safeForDm(reason ?? '', HARNESS_CONSTANTS.RELOGIN.DM_MESSAGE_MAX_CHARS);
-    return `${displayName(harnessId)} 登录没完成${detail ? `：${detail}` : '。'}${RETRY_HINT}`;
+    const clause = detail ? `: ${detail.replace(/[.!?。！？]+$/u, '')}.` : '.';
+    return `Signing in to ${displayName(harnessId)} didn't finish${clause} ${RETRY_HINT}`;
 }
 /**
- * Re-reminder text for a login whose last link expired unused. It carries no
- * link: a new one is made when the owner replies, so it is fresh when used.
+ * Re-reminder text for a login whose last link expired unused.
  *
  * @param harnessId - Harness
  * @param waiting - Agents waiting on the login
+ * @param machine - This machine's name
  * @returns DM text
  */
-export function formatReminderDm(harnessId, waiting) {
-    const who = waiting.length > 0 ? `${waiting.join(', ')} ${waiting.length === 1 ? 'is' : 'are'} still waiting on it. ` : '';
-    return `${displayName(harnessId)} still isn't signed in again, and the last sign-in link has expired. ${who}When it suits you, reply \`relogin\` and I'll send a new link right away (valid for 15 minutes).`;
+export function formatReminderDm(harnessId, waiting, machine = os.hostname()) {
+    return formatSignedOutDm(harnessId, machine, waiting, 'link_expired');
 }
-/** Coordinates Slack re-login flows, one per harness. */
+/** Coordinates re-login flows, one per harness. */
 export class HarnessReloginService {
     broker;
     credentials;
     apiKeys;
     checkLoginState;
+    verifyLogin;
     getOrcHarness;
+    listAgents;
+    sessionNeedsLogin;
+    onLoginRestored;
+    machineName;
+    state;
     notifier;
     resumer;
     now;
     logger;
     flows = new Map();
+    /** Harnesses whose expiry is being confirmed → sessions reported meanwhile */
+    confirming = new Map();
+    /** Harnesses whose re-reminder is being prepared */
+    reminding = new Set();
     /** Expiry reports are ignored until then (resumed transcripts repeat old errors) */
     quietUntil = new Map();
     /** Last silent API-key recovery per harness */
     silentKeyAt = new Map();
     /** Sessions restarted after a login: screen-sweep reports are ignored until live output reports again */
     mutedScreens = new Set();
-    /** Harnesses the status check has seen logged in */
-    seenLoggedIn = new Set();
+    /** Last probe result per harness */
+    probeCache = new Map();
+    /** Probes in flight per harness */
+    probeInFlight = new Map();
+    /** Agents configured on this machine, from the last {@link listAgents} */
+    agents = [];
     statusTimer = null;
+    firstCheckTimer = null;
     statusCheckInFlight = false;
     /**
      * @param deps - Dependencies
@@ -326,7 +443,13 @@ export class HarnessReloginService {
         this.credentials = deps.credentials;
         this.apiKeys = deps.apiKeys;
         this.checkLoginState = deps.checkLoginState;
+        this.verifyLogin = deps.verifyLogin ?? null;
         this.getOrcHarness = deps.getOrcHarness;
+        this.listAgents = deps.listAgents ?? null;
+        this.sessionNeedsLogin = deps.sessionNeedsLogin ?? null;
+        this.onLoginRestored = deps.onLoginRestored ?? null;
+        this.machineName = deps.machineName ?? (() => os.hostname());
+        this.state = deps.state ?? new MemoryReloginStateStore();
         this.notifier = deps.notifier ?? null;
         this.resumer = deps.resumer ?? null;
         this.now = deps.now ?? Date.now;
@@ -350,6 +473,30 @@ export class HarnessReloginService {
     setResumer(resumer) {
         this.resumer = resumer;
     }
+    /**
+     * Set what re-delivers the owner messages that waited for a login.
+     *
+     * @param handler - Handler, or null
+     */
+    setLoginRestoredHandler(handler) {
+        this.onLoginRestored = handler ?? null;
+    }
+    /**
+     * Set how the configured agents (running or not) are listed.
+     *
+     * @param lister - Lister, or null
+     */
+    setAgentLister(lister) {
+        this.listAgents = lister ?? null;
+    }
+    /**
+     * Set the per-session sign-in flag lookup (OAuth monitor).
+     *
+     * @param lookup - Lookup, or null
+     */
+    setSessionNeedsLogin(lookup) {
+        this.sessionNeedsLogin = lookup ?? null;
+    }
     /**
      * Report an expired harness login.
      *
@@ -375,43 +522,66 @@ export class HarnessReloginService {
                 this.mutedScreens.delete(sessionName);
         }
         const existing = this.flows.get(harnessId);
-        if (existing) {
+        if (existing && (existing.phase === 'running' || existing.remind)) {
             if (sessionName)
                 existing.stuck.add(sessionName);
-            if (existing.phase === 'failed' && this.now() - (existing.lastDmAt ?? 0) >= HARNESS_CONSTANTS.RELOGIN.REMIND_INTERVAL_MS) {
-                this.logger.info('Re-login: reminding the owner', { harnessId, source, lastOutcome: existing.lastOutcome });
-                if (existing.lastOutcome === 'timed_out')
-                    void this.remind(existing);
-                else
-                    this.restart(existing);
-            }
+            if (existing.phase === 'signed_out')
+                void this.maybeRemind(existing);
             return true;
         }
-        this.logger.warn('Harness login expired — starting a Slack re-login', { harnessId, sessionName, source });
-        this.begin(harnessId, new Set(sessionName ? [sessionName] : []));
+        const confirming = this.confirming.get(harnessId);
+        if (confirming) {
+            if (sessionName)
+                confirming.add(sessionName);
+            return true;
+        }
+        // An owner flow that failed (e.g. an account switch) was not a confirmed
+        // expiry; this report is — confirm it like any other.
+        const stuck = new Set(existing ? existing.stuck : []);
+        if (sessionName)
+            stuck.add(sessionName);
+        this.confirming.set(harnessId, stuck);
+        this.logger.warn('Harness login looks expired — confirming before telling the owner', { harnessId, sessionName, source });
+        void this.confirmExpiry(harnessId);
         return true;
     }
     /**
      * Offer an owner's Slack DM to the re-login coordinator.
      *
-     * Consumed, in this order: the retry keyword (while a flow exists), a
-     * login code or screen reply for a running flow, and finally an owner
-     * login request (「重新登录 claude」, "relogin codex" — see
+     * Consumed, in this order: a login keyword (`login`, 「重新登录」…) while a
+     * harness is signed out or signing in; a login code or screen reply for a
+     * running flow (only in the conversation the link went to); and finally an
+     * owner login request (「重新登录 claude」, "relogin codex" — see
      * {@link parseOwnerLoginRequest}), which starts a forced login answered in
      * `target`.
      *
+     * In another agent's bot DM (`scope: 'agent'`) only a request that names a
+     * harness, or a reply to a flow, is taken — the rest is that agent's mail.
+     *
      * @param text - Reply text (never logged)
      * @param target - Conversation the owner wrote in (answers go there)
+     * @param scope - `orc` (orc / master DM) or `agent` (another agent's bot DM)
      * @returns True when consumed; the caller must then NOT pass it on as a chat message
      */
-    handleOwnerReply(text, target = null) {
+    handleOwnerReply(text, target = null, scope = 'orc') {
         if (typeof text !== 'string')
             return false;
-        if (this.flows.size > 0 && this.consumeFlowReply(text))
+        if (this.flows.size > 0 && this.consumeFlowReply(text, target))
             return true;
+        // `login` in an agent's DM while that agent sits at a sign-in screen:
+        // sign in its harness (the watchdog's note asks for exactly this).
+        if (scope === 'agent' && isLoginKeyword(text) && target?.agentSession) {
+            const harnessId = this.harnessOfSession(target.agentSession);
+            if (harnessId && hasBrokerLogin(harnessId) && (this.isSignedOut(harnessId) || this.sessionNeedsLogin?.(target.agentSession))) {
+                this.startOwnerLogin(harnessId, { replyTarget: target, requestedBy: 'owner_dm' });
+                return true;
+            }
+        }
         const request = parseOwnerLoginRequest(text);
         if (!request)
             return false;
+        if (scope === 'agent' && request.kind !== 'harness')
+            return false;
         void this.handleOwnerLoginRequest(request, target);
         return true;
     }
@@ -430,29 +600,41 @@ export class HarnessReloginService {
             return { status: 'no_broker_login', harnessId, message: formatNoBrokerLoginDm(harnessId) };
         }
         const existing = this.flows.get(harnessId);
-        const stuck = existing ? new Set(existing.stuck) : new Set();
-        if (existing) {
-            this.clearScreenTimer(existing);
-            this.cancelOwnSession(existing);
-            if (this.flows.get(harnessId) === existing)
-                this.flows.delete(harnessId);
-        }
-        // The owner asked: a quiet period after the last login must not swallow it.
-        this.quietUntil.delete(harnessId);
+        const restarted = Boolean(existing && existing.phase === 'running');
         this.logger.info('Owner-requested login started', {
             harnessId,
             requestedBy: options.requestedBy,
             switchAccount: options.switchAccount === true,
-            restarted: Boolean(existing),
+            restarted,
             answersInThread: Boolean(options.replyTarget),
         });
-        this.begin(harnessId, stuck, {
+        this.replaceAndStart(harnessId, existing ?? null, {
             trigger: 'owner',
             switchAccount: options.switchAccount === true,
-            replyTarget: options.replyTarget ?? null,
+            replyTarget: options.replyTarget ?? existing?.replyTarget ?? null,
         });
         const dmAvailable = this.notifier ? (this.notifier.isAvailable?.() ?? true) : false;
-        return { status: existing ? 'restarted' : 'started', harnessId, dmAvailable };
+        return { status: restarted ? 'restarted' : 'started', harnessId, dmAvailable };
+    }
+    /**
+     * Harnesses confirmed signed out on this machine (persisted).
+     *
+     * @param harnessId - Harness
+     * @returns True while the owner has not signed it in again
+     */
+    isSignedOut(harnessId) {
+        return this.state.get(harnessId).signedOutSince !== undefined;
+    }
+    /**
+     * The signed-out harness an agent is waiting on, if any — for the
+     * owner-message watchdog, which must not wake an agent onto a dead login.
+     *
+     * @param sessionName - Agent session
+     * @returns The harness, or null when its harness is not signed out
+     */
+    signedOutHarnessOf(sessionName) {
+        const harnessId = this.harnessOfSession(sessionName);
+        return harnessId && this.isSignedOut(harnessId) ? harnessId : null;
     }
     /**
      * Act on a parsed owner login request from the DM.
@@ -470,26 +652,33 @@ export class HarnessReloginService {
             await this.notify(result.message, target);
     }
     /**
-     * Offer a DM to the running flows: the retry keyword, a login code, or a
-     * reply to an unrecognised screen.
+     * Offer a DM to the flows: a login keyword, a login code, or a reply to
+     * an unrecognised screen.
      *
      * @param text - Reply text (never logged)
+     * @param target - Conversation it was written in
      * @returns True when consumed
      */
-    consumeFlowReply(text) {
-        if (isRetryKeyword(text)) {
+    consumeFlowReply(text, target) {
+        if (isLoginKeyword(text)) {
             const flows = [...this.flows.values()];
-            const failed = flows.filter((flow) => flow.phase === 'failed');
-            const targets = failed.length > 0 ? failed : flows;
-            for (const flow of targets)
-                this.restart(flow);
-            this.logger.info('Re-login restarted on the owner\'s request', { harnessIds: targets.map((flow) => flow.harnessId) });
+            for (const flow of flows) {
+                this.replaceAndStart(flow.harnessId, flow, {
+                    trigger: flow.trigger,
+                    switchAccount: flow.switchAccount,
+                    replyTarget: target ?? flow.replyTarget,
+                });
+            }
+            this.logger.info('Sign-in started on the owner\'s reply', { harnessIds: flows.map((flow) => flow.harnessId) });
             return true;
         }
         const reply = unwrapReply(text);
         for (const flow of this.flows.values()) {
             if (flow.phase !== 'running' || !flow.sessionId)
                 continue;
+            // The code belongs in the conversation the link went to.
+            if (flow.linkChannelId && target && target.channelId !== flow.linkChannelId)
+                continue;
             const session = this.readSession(flow.sessionId);
             if (!session || isTerminalLoginState(session.state))
                 continue;
@@ -532,32 +721,40 @@ export class HarnessReloginService {
         return { harnessId, sessionId: flow.sessionId, startedAt: new Date(flow.startedAt).toISOString() };
     }
     /**
-     * Check the orchestrator's harness with its own status command, and
-     * report an expiry when it says logged out. Only a harness that was seen
-     * logged in, or that agents are running on, counts (a machine that was
-     * never logged in is onboarding's job, not a re-login).
+     * Check every harness in use on this machine — the orchestrator's and every
+     * configured agent's, running or not — and report the ones that are signed
+     * out. A harness the status command calls logged in is probed for real now
+     * and then ({@link HARNESS_CONSTANTS.RELOGIN.PROBE_INTERVAL_MS}), because a
+     * stored Claude credential survives its expiry. Signed-out harnesses get
+     * their (backed-off) re-reminder here.
      *
      * @returns Resolves when the check is done; never rejects
      */
-    async checkOrcHarness() {
+    async checkHarnesses() {
         if (this.statusCheckInFlight)
             return;
         this.statusCheckInFlight = true;
         try {
-            const orc = await this.getOrcHarness();
-            if (!isHarnessId(orc) || !hasBrokerLogin(orc))
-                return;
-            const state = await this.checkLoginState(orc);
-            if (state === 'logged_in') {
-                this.seenLoggedIn.add(orc);
-                return;
+            const orc = await this.getOrcHarness().catch(() => null);
+            const agents = await this.refreshAgents();
+            const configured = new Map();
+            for (const agent of agents) {
+                if (hasBrokerLogin(agent.harnessId))
+                    configured.set(agent.harnessId, (configured.get(agent.harnessId) ?? 0) + 1);
+            }
+            const harnesses = new Set(configured.keys());
+            if (orc && hasBrokerLogin(orc))
+                harnesses.add(orc);
+            for (const harnessId of harnesses) {
+                const flow = this.flows.get(harnessId);
+                if (flow?.phase === 'running' || this.confirming.has(harnessId))
+                    continue;
+                if (flow?.phase === 'signed_out' && flow.remind) {
+                    await this.maybeRemind(flow);
+                    continue;
+                }
+                await this.checkOne(harnessId, (configured.get(harnessId) ?? 0) > 0 || harnessId === orc);
             }
-            if (state !== 'logged_out')
-                return;
-            const running = this.resumer?.listSessions(orc) ?? [];
-            if (!this.seenLoggedIn.has(orc) && running.length === 0)
-                return;
-            this.reportExpiry({ harnessId: orc, sessionName: null, source: 'status' });
         }
         catch (error) {
             this.logger.warn('Harness status check failed', { error: error instanceof Error ? error.message : String(error) });
@@ -567,35 +764,263 @@ export class HarnessReloginService {
         }
     }
     /**
-     * Start the periodic status check of the orchestrator's harness.
+     * Compatibility name of {@link checkHarnesses}.
+     *
+     * @returns Resolves when the check is done
+     */
+    async checkOrcHarness() {
+        await this.checkHarnesses();
+    }
+    /**
+     * One harness of the periodic check.
+     *
+     * @param harnessId - Harness
+     * @param inUse - The orchestrator or a configured agent runs on it
+     */
+    async checkOne(harnessId, inUse) {
+        const passive = await this.checkLoginState(harnessId).catch(() => 'unknown');
+        if (passive === 'logged_out') {
+            const running = this.resumer?.listSessions(harnessId) ?? [];
+            // A machine that was never logged in is onboarding's job, not a re-login.
+            if (this.state.get(harnessId).seenLoggedInAt === undefined && running.length === 0 && !inUse)
+                return;
+            this.reportExpiry({ harnessId, sessionName: null, source: 'status' });
+            return;
+        }
+        if (passive === 'logged_in')
+            this.markSeenLoggedIn(harnessId);
+        if (!this.verifyLogin || !inUse)
+            return;
+        const last = this.probeCache.get(harnessId);
+        if (last && this.now() - last.at < HARNESS_CONSTANTS.RELOGIN.PROBE_INTERVAL_MS)
+            return;
+        const probed = await this.probe(harnessId, true);
+        if (probed === 'logged_out')
+            this.reportExpiry({ harnessId, sessionName: null, source: 'status' });
+    }
+    /**
+     * Start the periodic check (first run shortly after boot, so a machine
+     * that comes up signed out says so without waiting a full interval).
      *
      * @param intervalMs - Cadence (defaults to STATUS_CHECK_INTERVAL_MS)
+     * @param firstDelayMs - Delay of the first check (default 60 s)
      */
-    start(intervalMs = HARNESS_CONSTANTS.RELOGIN.STATUS_CHECK_INTERVAL_MS) {
+    start(intervalMs = HARNESS_CONSTANTS.RELOGIN.STATUS_CHECK_INTERVAL_MS, firstDelayMs = 60_000) {
         if (this.statusTimer)
             return;
-        this.statusTimer = setInterval(() => void this.checkOrcHarness(), intervalMs);
+        this.statusTimer = setInterval(() => void this.checkHarnesses(), intervalMs);
         this.statusTimer.unref?.();
+        this.firstCheckTimer = setTimeout(() => void this.checkHarnesses(), firstDelayMs);
+        this.firstCheckTimer.unref?.();
     }
     /** Stop the periodic check and forget every flow's timers. */
     stop() {
         if (this.statusTimer)
             clearInterval(this.statusTimer);
+        if (this.firstCheckTimer)
+            clearTimeout(this.firstCheckTimer);
         this.statusTimer = null;
+        this.firstCheckTimer = null;
         for (const flow of this.flows.values())
             this.clearScreenTimer(flow);
     }
     /**
-     * Start a flow: silent API key if Crewly holds one, else a broker login.
+     * Confirm a suspected expiry, then tell the owner (or use a stored key).
+     *
+     * @param harnessId - Harness
+     */
+    async confirmExpiry(harnessId) {
+        try {
+            const state = await this.currentState(harnessId);
+            const stuck = this.confirming.get(harnessId) ?? new Set();
+            if (state !== 'logged_out') {
+                // An agent's "401" is not proof the login expired — a bad API key
+                // or text typed into the sign-in screen gives one too, and
+                // `codex login` revokes a working login when it starts (2026-09-26,
+                // Nova). `unknown` (probe failed) is not proof either.
+                this.quietUntil.set(harnessId, this.now() + HARNESS_CONSTANTS.RELOGIN.NOT_EXPIRED_QUIET_MS);
+                this.logger.warn(state === 'logged_in'
+                    ? 'Re-login skipped: the harness is still signed in (the error was not an expired login)'
+                    : 'Re-login skipped: the harness could not be confirmed as signed out', { harnessId, state, stuck: [...stuck] });
+                return;
+            }
+            this.markSignedOut(harnessId);
+            // Names for the notice ("so 2 agents can't work (Crewly Orc, Ella)").
+            await this.refreshAgents();
+            const current = this.flows.get(harnessId);
+            if (current && (current.phase === 'running' || current.remind)) {
+                for (const name of stuck)
+                    current.stuck.add(name);
+                return;
+            }
+            const flow = this.newFlow(harnessId, stuck, EXPIRY_FLOW, 'signed_out');
+            flow.remind = true;
+            if (current) {
+                flow.replyTarget = current.replyTarget;
+                flow.lastOutcome = current.lastOutcome;
+            }
+            this.flows.set(harnessId, flow);
+            if (await this.tryStoredApiKey(flow))
+                return;
+            if (this.flows.get(harnessId) !== flow)
+                return;
+            this.logger.warn('Harness is signed out — telling the owner', { harnessId, stuck: [...flow.stuck] });
+            await this.sendSignedOutNotice(flow, 'notice');
+        }
+        catch (error) {
+            this.logger.warn('Confirming a harness expiry failed', { harnessId, error: error instanceof Error ? error.message : String(error) });
+        }
+        finally {
+            this.confirming.delete(harnessId);
+        }
+    }
+    /**
+     * Login state: the status command, then the live probe when the status
+     * command cannot see an expiry (it says logged in / unknown).
+     *
+     * @param harnessId - Harness
+     * @param fresh - Ignore a cached probe result
+     * @returns The best-known state
+     */
+    async currentState(harnessId, fresh = false) {
+        const passive = await this.checkLoginState(harnessId).catch(() => 'unknown');
+        if (passive === 'logged_out')
+            return 'logged_out';
+        const probed = await this.probe(harnessId, fresh);
+        return probed === 'unknown' ? passive : probed;
+    }
+    /**
+     * Run (or reuse) the live probe.
+     *
+     * @param harnessId - Harness
+     * @param fresh - Ignore a cached result
+     * @returns Probe result (`unknown` when there is no probe)
+     */
+    async probe(harnessId, fresh) {
+        if (!this.verifyLogin)
+            return 'unknown';
+        const cached = this.probeCache.get(harnessId);
+        if (!fresh && cached && this.now() - cached.at < HARNESS_CONSTANTS.RELOGIN.PROBE_CACHE_MS)
+            return cached.state;
+        const inFlight = this.probeInFlight.get(harnessId);
+        if (inFlight)
+            return inFlight;
+        const verify = this.verifyLogin;
+        const run = (async () => {
+            try {
+                const state = await verify(harnessId).catch(() => 'unknown');
+                this.probeCache.set(harnessId, { at: this.now(), state });
+                if (state === 'logged_in')
+                    this.markSeenLoggedIn(harnessId);
+                this.logger.info('Harness sign-in probe', { harnessId, state });
+                return state;
+            }
+            finally {
+                this.probeInFlight.delete(harnessId);
+            }
+        })();
+        this.probeInFlight.set(harnessId, run);
+        return run;
+    }
+    /**
+     * Re-remind the owner of a signed-out harness once its backoff elapsed. If
+     * the harness is signed in again by then (the owner did it on the
+     * machine or in Setup), the flow finishes and the agents resume instead.
+     *
+     * @param flow - A signed-out flow
+     */
+    async maybeRemind(flow) {
+        const { harnessId } = flow;
+        if (!flow.remind || this.reminding.has(harnessId) || !this.noticeDue(harnessId))
+            return;
+        this.reminding.add(harnessId);
+        try {
+            const state = await this.currentState(harnessId);
+            if (this.flows.get(harnessId) !== flow || flow.phase !== 'signed_out')
+                return;
+            if (state === 'logged_in') {
+                this.logger.info('Re-login: the harness is signed in again; resuming the waiting agents', { harnessId });
+                await this.succeed(flow, true);
+                return;
+            }
+            if (state !== 'logged_out')
+                return;
+            this.logger.info('Re-login: reminding the owner', { harnessId, lastOutcome: flow.lastOutcome });
+            await this.sendSignedOutNotice(flow, flow.lastOutcome === 'timed_out' ? 'link_expired' : 'reminder');
+        }
+        finally {
+            this.reminding.delete(harnessId);
+        }
+    }
+    /**
+     * Whether the backoff allows another "signed out" DM for a harness.
+     *
+     * @param harnessId - Harness
+     * @returns True when no notice was sent yet, or the backoff elapsed
+     */
+    noticeDue(harnessId) {
+        const record = this.state.get(harnessId);
+        if (record.lastNoticeAt === undefined)
+            return true;
+        const count = Math.max(1, record.noticeCount ?? 1);
+        const { REMIND_BACKOFF_BASE_MS, REMIND_BACKOFF_MAX_MS } = HARNESS_CONSTANTS.RELOGIN;
+        const gap = Math.min(REMIND_BACKOFF_BASE_MS * 2 ** (count - 1), REMIND_BACKOFF_MAX_MS);
+        return this.now() - record.lastNoticeAt >= gap;
+    }
+    /**
+     * Send the "signed out" DM (first notice or re-reminder), within the backoff.
+     *
+     * @param flow - The flow
+     * @param kind - Which text
+     */
+    async sendSignedOutNotice(flow, kind) {
+        const { harnessId } = flow;
+        if (!this.noticeDue(harnessId)) {
+            this.logger.debug('Re-login: owner already told; next reminder after the backoff', { harnessId });
+            return;
+        }
+        const record = this.state.get(harnessId);
+        // A restart forgets the flow but not the notice: the next one is a reminder.
+        const text = formatSignedOutDm(harnessId, this.machineName(), this.agentNamesOn(flow), kind === 'notice' && record.lastNoticeAt ? 'reminder' : kind);
+        const delivered = await this.dm(flow, text);
+        if (!delivered)
+            return;
+        this.state.update(harnessId, { lastNoticeAt: this.now(), noticeCount: (record.noticeCount ?? 0) + 1 });
+    }
+    /**
+     * Replace a harness's flow with a new one and start its broker session.
+     *
+     * @param harnessId - Harness
+     * @param previous - The flow it replaces (its stuck agents are kept), or null
+     * @param options - Trigger, wording and reply target
+     */
+    replaceAndStart(harnessId, previous, options) {
+        if (previous) {
+            this.clearScreenTimer(previous);
+            this.cancelOwnSession(previous);
+            if (this.flows.get(harnessId) === previous)
+                this.flows.delete(harnessId);
+        }
+        // The owner asked: a quiet period after the last login must not swallow it.
+        this.quietUntil.delete(harnessId);
+        const flow = this.newFlow(harnessId, new Set(previous?.stuck ?? []), options, 'running');
+        flow.remind = previous?.remind ?? false;
+        this.flows.set(harnessId, flow);
+        this.startBrokerSession(flow);
+    }
+    /**
+     * A new flow record.
      *
      * @param harnessId - Harness
      * @param stuck - Sessions known to be stuck
-     * @param options - Trigger, wording and reply target (default: a detected expiry)
+     * @param options - Trigger, wording and reply target
+     * @param phase - Initial phase
+     * @returns The flow (not registered)
      */
-    begin(harnessId, stuck, options = EXPIRY_FLOW) {
-        const flow = {
+    newFlow(harnessId, stuck, options, phase) {
+        return {
             harnessId,
-            phase: 'running',
+            phase,
             sessionId: null,
             startedAt: this.now(),
             stuck,
@@ -608,45 +1033,11 @@ export class HarnessReloginService {
             trigger: options.trigger,
             switchAccount: options.switchAccount,
             replyTarget: options.replyTarget,
+            linkChannelId: null,
             lastOutcome: null,
+            remind: false,
+            restartAll: true,
         };
-        // Registered synchronously: this is the per-harness debounce.
-        this.flows.set(harnessId, flow);
-        void this.run(flow);
-    }
-    /**
-     * Body of a flow (async part of {@link begin}).
-     *
-     * @param flow - The flow
-     */
-    async run(flow) {
-        // The owner asked for this login (possibly to switch accounts): no
-        // "still logged in" check and no silent API key — they want the link.
-        if (flow.trigger === 'owner') {
-            this.startBrokerSession(flow);
-            return;
-        }
-        // An agent's "401" is not proof the login expired — a bad API key or
-        // text typed into the sign-in screen gives one too. Starting a login
-        // then *logs the harness out* (`codex login` clears its credentials):
-        // that is how a fresh ChatGPT sign-in was wiped twice in a row
-        // (2026-09-26, Nova). Only a harness that is not logged in gets one.
-        const state = await this.checkLoginState(flow.harnessId).catch(() => 'unknown');
-        if (state !== 'logged_out') {
-            // `unknown` (status probe failed or timed out) is not proof either:
-            // starting `codex login` would revoke a login that may still work.
-            this.flows.delete(flow.harnessId);
-            this.quietUntil.set(flow.harnessId, this.now() + HARNESS_CONSTANTS.RELOGIN.NOT_EXPIRED_QUIET_MS);
-            this.logger.warn(state === 'logged_in'
-                ? 'Re-login skipped: the harness is still logged in (the error was not an expired login)'
-                : 'Re-login skipped: the harness login state could not be confirmed as logged out', { harnessId: flow.harnessId, state, stuck: [...flow.stuck] });
-            return;
-        }
-        if (await this.tryStoredApiKey(flow))
-            return;
-        if (this.flows.get(flow.harnessId) !== flow)
-            return;
-        this.startBrokerSession(flow);
     }
     /**
      * Start (or adopt) the harness's broker login session for a flow.
@@ -664,8 +1055,8 @@ export class HarnessReloginService {
         catch (error) {
             const reason = error instanceof Error ? error.message : String(error);
             this.logger.warn('Re-login: could not start the login', { harnessId: flow.harnessId, error: reason });
-            flow.phase = 'failed';
-            void this.dm(flow, formatFailureDm(flow.harnessId, `Crewly 没能启动登录（${reason}）`));
+            flow.phase = 'signed_out';
+            void this.dm(flow, formatFailureDm(flow.harnessId, `Crewly could not start the sign-in (${reason})`));
             return;
         }
         flow.sessionId = session.id;
@@ -733,7 +1124,12 @@ export class HarnessReloginService {
         if (flow.dm !== 'link' && linkReady) {
             flow.dm = 'link';
             this.clearScreenTimer(flow);
-            void this.dm(flow, formatLinkDm(session, this.waitingAgents(flow), this.wordingOf(flow)));
+            void this.dm(flow, formatLinkDm(session, [], this.wordingOf(flow))).then((delivered) => {
+                if (typeof delivered === 'object' && delivered)
+                    flow.linkChannelId = delivered.channelId;
+                else if (delivered && flow.replyTarget)
+                    flow.linkChannelId = flow.replyTarget.channelId;
+            });
             return;
         }
         if (flow.replied && session.state === 'awaiting_user' && session.message && session.message !== flow.lastRejection) {
@@ -749,8 +1145,13 @@ export class HarnessReloginService {
      */
     handleFinished(session) {
         const flow = this.flows.get(session.harnessId);
-        if (!flow)
+        if (!flow) {
+            // Signed in from the dashboard / Setup with no flow here: the agents
+            // parked on a sign-in screen still hold the dead login.
+            if (session.state === 'succeeded')
+                void this.adoptOutsideLogin(session.harnessId);
             return;
+        }
         if (flow.sessionId !== session.id) {
             // The owner logged in another way (web / phone app) while a flow waited.
             if (session.state === 'succeeded') {
@@ -760,37 +1161,93 @@ export class HarnessReloginService {
             }
             return;
         }
-        if (flow.phase !== 'running')
+        if (flow.phase !== 'running' || flow.cancelledByUs)
             return;
         this.clearScreenTimer(flow);
         flow.lastOutcome = session.state;
         if (session.state === 'succeeded') {
-            void this.succeed(flow, true);
+            void this.confirmAndSucceed(flow);
             return;
         }
-        flow.phase = 'failed';
-        if (flow.cancelledByUs)
-            return;
+        flow.phase = 'signed_out';
+        flow.sessionId = null;
+        flow.dm = 'none';
+        flow.remind = flow.remind || this.isSignedOut(flow.harnessId);
         if (session.state === 'cancelled') {
             // Cancelled on the web or by a shutdown: the owner knows; stay quiet.
             this.logger.info('Re-login cancelled', { harnessId: flow.harnessId, sessionId: session.id });
             return;
         }
         this.logger.warn('Re-login did not finish', { harnessId: flow.harnessId, sessionId: session.id, state: session.state });
-        void this.dm(flow, formatFailureDm(flow.harnessId, session.message));
+        const text = session.state === 'timed_out'
+            ? formatSignedOutDm(flow.harnessId, this.machineName(), this.agentNamesOn(flow), 'link_expired')
+            : formatFailureDm(flow.harnessId, session.message);
+        void this.dm(flow, text);
     }
     /**
-     * The login is back: restart the stuck agents and tell the owner.
+     * A login finished outside any flow (dashboard chip, Setup, CLI): restart
+     * only the sessions that sit at a sign-in screen and re-deliver what
+     * waited for them. Working agents of the harness are left alone.
+     *
+     * @param harnessId - Harness that was signed in
+     */
+    async adoptOutsideLogin(harnessId) {
+        if (!hasBrokerLogin(harnessId))
+            return;
+        let live = [];
+        try {
+            live = this.resumer?.listSessions(harnessId) ?? [];
+        }
+        catch {
+            live = [];
+        }
+        const waiting = live.filter((name) => this.sessionNeedsLogin?.(name) === true);
+        const wasSignedOut = this.isSignedOut(harnessId);
+        if (waiting.length === 0 && !wasSignedOut) {
+            this.markSeenLoggedIn(harnessId);
+            return;
+        }
+        const flow = this.newFlow(harnessId, new Set(waiting), { trigger: 'expiry', switchAccount: false, replyTarget: null }, 'running');
+        flow.restartAll = false;
+        this.logger.info('Signed in outside Slack; resuming the agents that waited', { harnessId, waiting });
+        await this.succeed(flow, wasSignedOut);
+    }
+    /**
+     * The broker reported success: confirm it with the probe, then finish.
+     *
+     * @param flow - The flow
+     */
+    async confirmAndSucceed(flow) {
+        const state = await this.probe(flow.harnessId, true);
+        if (this.flows.get(flow.harnessId) !== flow)
+            return;
+        if (state === 'logged_out') {
+            this.logger.warn('Re-login: the sign-in finished but the harness still cannot reach its API', { harnessId: flow.harnessId });
+            flow.phase = 'signed_out';
+            flow.sessionId = null;
+            flow.dm = 'none';
+            flow.remind = true;
+            this.markSignedOut(flow.harnessId);
+            await this.dm(flow, formatFailureDm(flow.harnessId, 'the sign-in finished, but it still does not work'));
+            return;
+        }
+        await this.succeed(flow, true);
+    }
+    /**
+     * The login is back: restart the stuck agents, re-deliver what waited,
+     * and tell the owner.
      *
      * @param flow - The flow
      * @param notify - DM the owner (false for the silent API-key path)
      */
     async succeed(flow, notify) {
-        if (this.flows.get(flow.harnessId) === flow)
-            this.flows.delete(flow.harnessId);
-        this.quietUntil.set(flow.harnessId, this.now() + HARNESS_CONSTANTS.RELOGIN.POST_SUCCESS_QUIET_MS);
-        this.seenLoggedIn.add(flow.harnessId);
-        const sessions = this.waitingAgents(flow);
+        const { harnessId } = flow;
+        if (this.flows.get(harnessId) === flow)
+            this.flows.delete(harnessId);
+        this.quietUntil.set(harnessId, this.now() + HARNESS_CONSTANTS.RELOGIN.POST_SUCCESS_QUIET_MS);
+        this.probeCache.set(harnessId, { at: this.now(), state: 'logged_in' });
+        this.state.update(harnessId, { signedOutSince: undefined, lastNoticeAt: undefined, noticeCount: undefined, seenLoggedInAt: this.now() });
+        const sessions = this.sessionsToRestart(flow);
         let result = { resumed: [], failed: [] };
         if (this.resumer && sessions.length > 0) {
             try {
@@ -803,57 +1260,117 @@ export class HarnessReloginService {
         }
         for (const name of result.resumed)
             this.mutedScreens.add(name);
-        this.logger.info('Re-login finished', { harnessId: flow.harnessId, resumed: result.resumed.length, failed: result.failed.length });
+        let redelivered = 0;
+        if (this.onLoginRestored) {
+            try {
+                redelivered = (await this.onLoginRestored(harnessId, result.resumed)) || 0;
+            }
+            catch (error) {
+                this.logger.warn('Re-login: re-delivering waiting messages failed', { error: error instanceof Error ? error.message : String(error) });
+            }
+        }
+        this.logger.info('Re-login finished', { harnessId, resumed: result.resumed.length, failed: result.failed.length, redelivered });
         if (notify) {
-            const text = flow.trigger === 'owner' ? formatOwnerSuccessDm(flow.harnessId, result) : formatSuccessDm(flow.harnessId, result);
+            const text = flow.trigger === 'owner'
+                ? formatOwnerSuccessDm(harnessId, result, redelivered)
+                : formatSuccessDm(harnessId, result, redelivered, this.machineName());
             await this.dm(flow, text);
         }
     }
     /**
-     * Re-reminder after a link expired unused: if the harness is logged in by
-     * now (the owner signed in another way), finish the flow and resume the
-     * stuck agents; otherwise send a text reminder. No login is started here —
-     * the owner's `relogin` reply starts one while they are there to use it.
+     * Sessions to restart after a login: the ones whose output matched plus
+     * every live session of the harness (they all hold the dead login).
      *
-     * @param flow - A failed flow whose last session timed out
+     * @param flow - The flow
+     * @returns Session names
      */
-    async remind(flow) {
-        // Set first: this is the reminder debounce while the check runs.
-        flow.lastDmAt = this.now();
-        const state = await this.checkLoginState(flow.harnessId).catch(() => 'unknown');
-        if (this.flows.get(flow.harnessId) !== flow || flow.phase !== 'failed')
-            return;
-        if (state === 'logged_in') {
-            this.logger.info('Re-login: the harness is logged in again; resuming the waiting agents', { harnessId: flow.harnessId });
-            await this.succeed(flow, true);
-            return;
+    sessionsToRestart(flow) {
+        let live = [];
+        try {
+            live = this.resumer?.listSessions(flow.harnessId) ?? [];
         }
-        await this.dm(flow, formatReminderDm(flow.harnessId, this.waitingAgents(flow)));
+        catch {
+            live = [];
+        }
+        if (!flow.restartAll)
+            return [...flow.stuck];
+        return [...new Set([...flow.stuck, ...live])];
     }
     /**
-     * Start a flow over (retry keyword or re-reminder).
+     * Names of the agents that run on a flow's harness, for the owner: every
+     * configured agent on it, else the stuck / live ones.
      *
-     * @param flow - The flow to replace
+     * @param flow - The flow
+     * @returns Display names
      */
-    restart(flow) {
-        this.clearScreenTimer(flow);
-        this.cancelOwnSession(flow);
-        if (this.flows.get(flow.harnessId) === flow)
-            this.flows.delete(flow.harnessId);
-        this.begin(flow.harnessId, new Set(flow.stuck), {
-            trigger: flow.trigger,
-            switchAccount: flow.switchAccount,
-            replyTarget: flow.replyTarget,
-        });
+    agentNamesOn(flow) {
+        const configured = this.agents.filter((agent) => agent.harnessId === flow.harnessId);
+        if (configured.length > 0)
+            return configured.map((agent) => agent.displayName || agent.sessionName);
+        const byName = new Map(this.agents.map((agent) => [agent.sessionName, agent.displayName || agent.sessionName]));
+        return this.sessionsToRestart(flow).map((name) => byName.get(name) ?? name);
+    }
+    /**
+     * Re-read the configured agents.
+     *
+     * @returns The agents (the last known list when the read fails)
+     */
+    async refreshAgents() {
+        if (!this.listAgents)
+            return this.agents;
+        try {
+            this.agents = await this.listAgents();
+        }
+        catch (error) {
+            this.logger.debug('Listing configured agents failed', { error: error instanceof Error ? error.message : String(error) });
+        }
+        return this.agents;
+    }
+    /**
+     * Harness an agent session runs on.
+     *
+     * @param sessionName - Agent session
+     * @returns Harness id, or null when unknown
+     */
+    harnessOfSession(sessionName) {
+        const configured = this.agents.find((agent) => agent.sessionName === sessionName);
+        if (configured && isHarnessId(configured.harnessId))
+            return configured.harnessId;
+        for (const flow of this.flows.values())
+            if (flow.stuck.has(sessionName))
+                return flow.harnessId;
+        return null;
+    }
+    /**
+     * Record that a harness is signed out (first time only keeps the date).
+     *
+     * @param harnessId - Harness
+     */
+    markSignedOut(harnessId) {
+        if (this.state.get(harnessId).signedOutSince === undefined)
+            this.state.update(harnessId, { signedOutSince: this.now() });
+    }
+    /**
+     * Remember that a harness was seen signed in (written at most hourly).
+     *
+     * @param harnessId - Harness
+     */
+    markSeenLoggedIn(harnessId) {
+        const record = this.state.get(harnessId);
+        if (record.signedOutSince !== undefined)
+            return;
+        if (record.seenLoggedInAt !== undefined && this.now() - record.seenLoggedInAt < HARNESS_CONSTANTS.RELOGIN.PROBE_INTERVAL_MS)
+            return;
+        this.state.update(harnessId, { seenLoggedInAt: this.now() });
     }
     /**
      * DM wording for a flow.
      *
      * @param flow - The flow
-     * @returns Owner-requested / account-switch flags
+     * @returns Account-switch flag and machine name
      */
     wordingOf(flow) {
-        return { ownerRequested: flow.trigger === 'owner', switchAccount: flow.switchAccount };
+        return { ownerRequested: flow.trigger === 'owner', switchAccount: flow.switchAccount, machine: this.machineName() };
     }
     /**
      * Cancel the flow's live broker session, marking it as cancelled by the
@@ -886,56 +1403,50 @@ export class HarnessReloginService {
             return;
         flow.dm = 'screen';
         this.logger.warn('Re-login: login screen not recognised, sending it to the owner', { harnessId: flow.harnessId, sessionId: session.id });
-        await this.dm(flow, formatScreenDm(session, this.waitingAgents(flow), this.wordingOf(flow)));
-    }
-    /**
-     * Agents waiting on a flow: the stuck ones, else every session of the harness.
-     *
-     * @param flow - The flow
-     * @returns Session names
-     */
-    waitingAgents(flow) {
-        if (flow.stuck.size > 0)
-            return [...flow.stuck];
-        try {
-            return this.resumer?.listSessions(flow.harnessId) ?? [];
-        }
-        catch {
-            return [];
-        }
+        const delivered = await this.dm(flow, formatScreenDm(session, [], this.wordingOf(flow)));
+        if (typeof delivered === 'object' && delivered)
+            flow.linkChannelId = delivered.channelId;
     }
     /**
-     * DM the owner (logs when no notifier is wired; never logs the text).
+     * DM the owner in the flow's conversation, and remember where it landed
+     * so later DMs (the link, the result) follow it.
      *
      * @param flow - The flow
      * @param text - DM text
+     * @returns The delivery
      */
     async dm(flow, text) {
         flow.lastDmAt = this.now();
-        await this.notify(text, flow.replyTarget, flow.harnessId);
+        const delivered = await this.notify(text, flow.replyTarget, flow.harnessId);
+        if (typeof delivered === 'object' && delivered && !flow.replyTarget)
+            flow.replyTarget = delivered;
+        return delivered;
     }
     /**
      * Send a message to the owner (logs when no notifier is wired; never logs the text).
      *
      * @param text - DM text
-     * @param target - Conversation to answer in (null = master-bot DM)
+     * @param target - Conversation to answer in (null = this machine's DM)
      * @param harnessId - Harness, for logs
+     * @returns The delivery (false when not delivered)
      */
     async notify(text, target, harnessId) {
         if (!this.notifier) {
             this.logger.warn('Re-login: no Slack DM path to the owner; finish the login from Setup', { harnessId });
-            return;
+            return false;
         }
         try {
             const delivered = await this.notifier.sendToOwner(text, target);
             if (!delivered)
                 this.logger.warn('Re-login: the owner DM was not delivered', { harnessId });
+            return delivered;
         }
         catch (error) {
             this.logger.warn('Re-login: sending the owner DM failed', {
                 harnessId,
                 error: error instanceof Error ? error.message : String(error),
             });
+            return false;
         }
     }
     /**
@@ -967,8 +1478,9 @@ export class HarnessReloginService {
 let instance = null;
 /**
  * The backend's re-login coordinator, bound to the backend harness service
- * (its broker, credentials, API keys and status). Registers itself as the
- * `reloginPending` source of `GET /api/harness`.
+ * (its broker, credentials, API keys and status), the live sign-in probe and
+ * the persisted notice state. Registers itself as the `reloginPending`
+ * source of `GET /api/harness`.
  *
  * @returns The singleton
  */
@@ -988,7 +1500,9 @@ export function getHarnessReloginService() {
                     return 'unknown';
                 return (await harness.status.getLoginInfo(def, installed.path)).loginState;
             },
+            verifyLogin: createHarnessLoginProbe(),
             getOrcHarness: () => harness.orc.get(),
+            state: createDefaultReloginStateStore(),
             logger: LoggerService.getInstance().createComponentLogger('HarnessRelogin'),
         });
         harness.setReloginPendingProvider((harnessId) => service.getPending(harnessId));