relay-codex 0.4.1 → 0.5.0

package/README.md

@@ -13,7 +13,7 @@ Python 3.11 or newer. If you use Homebrew, `brew install node python@3.13` insta
 Node and Python.
 
 ```sh
-npm install -g github:blackspider-ops/relay#v0.4.1
+npm install -g relay-codex
 relay setup --count 2
 relay run
 ```
@@ -28,19 +28,31 @@ Your usual `codex` command keeps working.
 Prefer trying it without a global install?
 
 ```sh
-npx --yes github:blackspider-ops/relay#v0.4.1 setup --count 2
-npx --yes github:blackspider-ops/relay#v0.4.1 run
+npx --yes relay-codex setup --count 2
+npx --yes relay-codex run
 ```
 
 ## Use it like Codex
 
 ```sh
 relay run -- resume --yolo
+relay run -- -C ~/projects/website resume
+relay run -- exec --json "Review this project"
 relay status --watch
+relay menubar
 ```
 
 `--yolo` keeps its usual full-access meaning. Without it, Relay keeps the task's
-permissions. Different terminals can work on different conversations at once.
+permissions. Resume starts with sessions from your current folder, just like
+`codex resume`. Add `--all` to browse every folder, or `-C PATH` to choose a folder.
+Different terminals can work on different conversations at once.
+
+Put native Codex commands and options after `relay run --`. Use `relay run --help`
+for the full Codex command and flag list, or `relay help` for Relay management.
+Profiles, extra writable directories, Git worktrees, and noninteractive tasks can
+use the account pool. `relay explain -- <arguments>` shows how a launch will run.
+Native utilities, external/local-provider endpoints, and a few native-only setup
+flags run directly; `--require-recovery` rejects a launch outside Relay recovery.
 
 If a conversation is already open in another app, close it there before resuming
 it here, or use Codex's `fork` command for a separate copy. To move a Relay task
@@ -50,6 +62,10 @@ between terminals:
 relay attach --takeover SESSION_ID
 ```
 
+Accounts show their saved email addresses. The watch view updates only when local
+status changes; it uses no model allowance. The menu bar uses an icon and opens
+at Mac login. `relay menubar --no-startup --configure-only` disables login startup.
+
 ## What happens when something stops?
 
 - **Account limit:** use an available account, or wait for the earliest usable reset.
@@ -69,9 +85,11 @@ relay attach SESSION_ID
 relay stop SESSION_ID
 ```
 
-Background tasks keep running after their terminal closes. They do not start
-automatically after a Mac reboot. Use `relay status --all` to find saved sessions
-and `relay restart SESSION_ID` to recover a stopped one.
+Background tasks keep running after their terminal closes. Use `relay status --all`
+to find saved sessions and `relay restart SESSION_ID` to recover a stopped one.
+Opt into task recovery at Mac login with `relay startup enable SESSION_ID`.
+`relay workspace save daily` and `relay workspace restore daily` retain the same
+conversations across several terminals.
 
 ## A few useful commands
 
@@ -92,6 +110,7 @@ in your private Application Support folder. Never share that folder.
 
 Relay checks the installed Codex version and keeps a working copy for running
 sessions. Future Codex changes may still need a Relay update.
+Update Relay with `npm install -g relay-codex@latest`.
 
 This is an independent tool, not an OpenAI product. Short local tests cover
 parallel tasks and recovery; they are not an overnight reliability guarantee.

package/docs/commands.md

@@ -1,5 +1,19 @@
 # Commands
 
+## Help
+
+```sh
+relay help
+relay help account
+relay help workspace
+relay run --help
+relay run -- exec --help
+relay help codex resume
+```
+
+`relay run --help` shows the installed Codex command and flag list, followed by
+Relay's launch options. Put native arguments after `relay run --`.
+
 ## Accounts
 
 ```sh
@@ -7,10 +21,11 @@ relay setup --count 1
 relay setup --count 6
 relay add personal
 relay list
+relay account identify
 relay refresh
-relay account rename account1 personal
-relay account enable personal
+relay account rename personal "My account"
 relay account disable personal
+relay account enable personal
 relay account priority personal 10
 relay account cap personal 2
 relay account models personal YOUR_MODEL
@@ -18,33 +33,98 @@ relay account reauth personal
 relay account remove personal
 ```
 
-Renaming changes the label, so saved logins stay usable. A cap of zero means no
-session cap. Removing an account keeps its login unless `--revoke` is requested.
-Switch active sessions away from an account before signing it out or replacing it.
+Accounts display their saved email addresses. `account identify` fills in emails
+for earlier installations without another sign-in. Commands accept an account's
+label, unique email, or chosen display name. Renaming keeps the login usable.
+A session cap of zero means unlimited. Removing an account retains its login
+unless you request `--revoke`.
 
-## Sessions
+## Launch and recovery
 
 ```sh
-relay run --name website -- --model YOUR_MODEL
+relay run
 relay run -- resume --yolo
-relay start --name website --cwd ~/projects/website --prompt "Run the checks"
+relay run -- -C ~/projects/website resume
+relay run -- -p work --add-dir ~/shared
+relay run -- --worktree "Try the next change"
+relay run -- exec --json "Run the checks"
+relay run -- review --uncommitted
+relay explain -- resume --yolo
+relay run --require-recovery -- resume
+```
+
+Resume defaults to the current folder. Add `--all` to browse other folders or
+`-C/--cd` to choose another working folder. Native profile files are read from
+`$CODEX_HOME/NAME.config.toml`; explicit config flags override the profile.
+Relay worktrees are detached Git worktrees under its private state folder. Their
+files are retained for review; cleanup does not delete worktrees.
+
+Interactive work, resume/fork, profiles, extra directories, worktrees, and supported
+noninteractive exec/review runs use the account pool. Exec supports text/stdin,
+images, JSON events, output schemas, last-message files, and resume/fork. Review
+supports the working tree, base branch, commit, or custom instructions.
+
+Native utility commands are forwarded unchanged. Local providers, explicitly
+remote servers, hook-trust bypass, and ignoring native config/rules use native
+Codex directly with its ordinary login. Help/version also run directly. These
+modes do not use Relay recovery. `--require-recovery` rejects such a launch, and
+`explain` shows which mode applies without making an inference request.
+
+Noninteractive runs cannot approve a tool request on your behalf. Use explicit
+native permissions such as `--yolo` only when intended, or resume interactively
+when input is required. Automatic review is supported by `--approve-for-me`.
+
+## Dashboard and session controls
+
+```sh
+relay status
 relay status --watch
 relay status --all
 relay status --json
+relay menubar
+relay menubar --no-startup
 relay attach SESSION_ID
-relay attach --takeover SESSION_ID
-relay pause SESSION_ID
-relay unpause SESSION_ID
-relay retry SESSION_ID
-relay switch SESSION_ID --account personal
-relay stop SESSION_ID
+relay attach SESSION_ID --takeover
+relay pause SESSION_ID --wait
+relay unpause SESSION_ID --wait
+relay retry SESSION_ID --wait
+relay switch SESSION_ID --account personal --wait
+relay stop SESSION_ID --wait
 relay restart SESSION_ID
 ```
 
-Session IDs can be shortened as long as the prefix is unique. `pause` pauses
-automatic recovery; it lets a command already running finish. `retry` explicitly
-overrides the retry timer. Switching waits for an idle task; it does not interrupt
-a command or invent an approval.
+The watch view waits for local file changes and redraws only when useful status
+changes. Heartbeats do not repeatedly print the table. Watching uses no model
+allowance and does not fetch account allowance. `refresh` explicitly checks it.
+The menu uses one local status stream, a template icon, and native session actions.
+It opens at Mac login after `relay menubar`; disable that in its menu or with
+`relay menubar --no-startup --configure-only`.
+
+IDs may be shortened to a unique prefix. Without `--wait`, controls are queued;
+with it, Relay waits for the worker's confirmation and reports a rejection.
+Pause stops automatic recovery after current work finishes. Retry clears a review
+hold: inspect an interrupted external action in the conversation first.
+
+## Background tasks and saved workspaces
+
+```sh
+relay start --name website --cwd ~/projects/website --prompt "Run the checks"
+relay workspace save daily
+relay workspace list
+relay workspace restore daily
+relay workspace remove daily
+relay startup enable SESSION_ID
+relay startup list
+relay startup disable SESSION_ID
+```
+
+A workspace saves the same supervised session IDs, rather than starting fresh
+conversations. Restore restarts stopped jobs and prints reconnect commands; live
+jobs are retained. Save specific sessions by appending their IDs to `workspace save`.
+
+The normal command remains available after reboot. Background task recovery at
+login is a separate opt-in setting; enabling the menu does not enable task startup.
+Uncertain work still pauses for review after recovery.
 
 ## Preferences
 
@@ -52,41 +132,45 @@ a command or invent an approval.
 relay config
 relay config notifications true
 relay config background_on_disconnect true
+relay config keep_awake true
 relay config retry_interval 300
 relay config retry_attempts 3
 relay config routing quota
-relay config preferred_accounts '["account1","account3"]'
+relay config preferred_accounts '["personal"]'
 relay config fallback_models '["YOUR_CHOSEN_MODEL"]'
 relay config retry_interval 60 --profile quick
 relay run --profile quick
 ```
 
-Available routing choices are `balanced`, `quota`, `priority`, and `round-robin`.
-No fallback model is selected by default. A capacity error preserves the selected
-model and account unless you have enabled a fallback. Setting `retry_attempts` to
-zero disables automatic capacity retries.
+Routing choices are `balanced`, `quota`, `priority`, and `round-robin`. Model
+fallback is opt-in. Capacity errors otherwise retain the selected model/account.
+Keep-awake prevents idle system sleep only while a managed task is active; it does
+not keep the display on. Project preferences may live in `.relay.toml` under
+`[settings]` or `[profiles.NAME]`. Legacy `.codex-accounts.toml` files still work.
+Relay recovery profiles go before `--`; native Codex profiles go after it.
 
-Project preferences can live in `.relay.toml`, under `[settings]` or
-`[profiles.NAME]`. Existing `.codex-accounts.toml` files are also supported. Native Codex
-profiles still go after the separator: `relay run -- -p work`.
-
-## Checks and extras
+## Diagnostics and cleanup
 
 ```sh
-relay check
-relay doctor --self-test --backup
+relay doctor --self-test
+relay doctor --backup
 relay doctor --restore-backup
+relay diagnostics relay-diagnostics.json
+relay clean
+relay clean --older-than 30
+relay clean --apply
 relay events --limit 30
 relay usage
 relay runtime list
-relay runtime preflight /path/to/candidate/codex
-relay runtime use installed
-relay menubar
-relay group save daily ~/projects/website ~/projects/api
-relay group start daily
+relay runtime preflight /path/to/codex
 ```
 
-Restore requires stopped Relay sessions and preserves a copy of the replaced
-database. It does not change Keychain logins. Usage forecasts are estimates based
-on local observations. Groups currently start separate tasks in saved folders;
-they do not restore a whole previous workspace.
+Diagnostics export allowlisted versions, event types, and counts without account
+emails, task names, project paths, prompts, or credentials. Review other files
+before sharing them; private state and connection files must stay private.
+
+Cleanup is a dry run unless `--apply` is given. It retains live/restartable runtime
+references and saved workspaces. `--jobs` also allows removal of old stopped-job
+records. Stop supervised jobs before applying cleanup. Worktrees and account
+logins are retained. Metadata restore also requires stopped tasks and preserves a
+copy of the replaced database. Usage forecasts are local estimates.

package/docs/publishing.md

@@ -1,33 +1,47 @@
 # Sharing Relay
 
+Relay is published on npm as [relay-codex](https://www.npmjs.com/package/relay-codex).
+Friends can run `npx relay-codex` or install it with `npm install -g relay-codex`.
+
 ## GitHub and npx
 
 The GitHub repository is enough for friends to install or try Relay:
 
 ```sh
-npm install -g github:blackspider-ops/relay#v0.4.1
-npx --yes github:blackspider-ops/relay#v0.4.1 --version
+npm install -g github:blackspider-ops/relay#v0.5.0
+npx --yes github:blackspider-ops/relay#v0.5.0 --version
 ```
 
-`npx` runs packages. It is not a separate publishing service. Publishing the
-`relay-codex` package on npm would also make `npx relay-codex` available.
+`npx` runs packages; it is not a separate publishing service. Publishing
+`relay-codex` on npm also makes `npx relay-codex` available.
 
 ## Publish on npm
 
-Only a maintainer needs to do this:
+The repository includes `.github/workflows/publish.yml`. Configure a trusted
+publisher for `relay-codex` using GitHub user `blackspider-ops`, repository `relay`,
+and workflow filename `publish.yml`. Select direct `npm publish` permission if
+releases should publish automatically. No long-lived publishing token is needed.
+A new trusted publisher must complete its first publish within npm's validation
+window. Run the workflow for an existing reviewed version tag, or publish the
+GitHub release; the workflow runs checks before publishing. After the first
+successful trusted publish, set the repository variable
+`NPM_TRUSTED_PUBLISHING_READY=true` to enable automatic release publishing. Until
+then, releases do not launch a publishing attempt that requires authentication.
+
+Initial trust setup requires npm account verification. Interactive local
+`npm publish` also requires verification when package 2FA applies. Installing and
+running the public package does not require npm sign-in. An expired publishing
+prompt should be restarted once, rather than repeatedly running `npm login`.
+
+For a manual release, review and publish the exact packed artifact:
 
 ```sh
-npm login
 npm test
 npm run check
-npm pack --dry-run
-npm publish --access public
+npm pack --ignore-scripts
+npm publish ./relay-codex-VERSION.tgz --access public
 ```
 
-Use an npm account with publishing access and two-factor authentication, or the
-supported trusted-publishing setup. Package-name availability is checked again at
-publication; the GitHub repository does not reserve the npm name.
-
 After publishing, friends can use:
 
 ```sh
@@ -51,6 +65,8 @@ For a new release, update the package and Python versions together, run the chec
 tag it, upload the archive, then update the formula URL and checksum. Keep the
 previous release available for users who need to roll back.
 
-Official references: [npm publishing](https://docs.npmjs.com/creating-and-publishing-unscoped-public-packages),
+Official references: [trusted publishing](https://docs.npmjs.com/trusted-publishers/),
+[package publishing verification](https://docs.npmjs.com/requiring-2fa-for-package-publishing-and-settings-modification/),
+[npm publishing](https://docs.npmjs.com/creating-and-publishing-unscoped-public-packages),
 [npx](https://docs.npmjs.com/cli/v11/commands/npx/), and
 [Homebrew taps](https://docs.brew.sh/How-to-Create-and-Maintain-a-Tap).

package/docs/troubleshooting.md

@@ -24,9 +24,9 @@ Other accounts can keep working.
 
 **The terminal disconnected after a worker restart.**
 
-The background task may still be running. Check `relay status` and reattach with
-`relay attach SESSION_ID`. Automatic terminal reconnection across a full worker
-replacement is not guaranteed.
+Relay reconnects the terminal when a replacement worker publishes a recovered
+connection. If recovery requires review or the project folder is unavailable,
+check `relay status` and `relay events`, then reattach with `relay attach SESSION_ID`.
 
 **Something still seems wrong.**
 
@@ -35,3 +35,15 @@ a bug. Do not post auth files, tokens, connection files, or private task prompts
 
 Long runs, physical sleep/wake cycles, real revoked logins, and future Codex
 versions need broader live testing. The tests do not remove those limits.
+
+**The dashboard repeats or an email is missing.**
+
+Check `relay --version` and update Relay. Watch now prints only meaningful changes
+from local state, without using model allowance. Earlier enrolled accounts can be
+identified with `relay account identify`; this reads saved login metadata locally.
+
+**Why does npm ask for authentication?**
+
+That verification protects package publishing. Installing and running the public
+Relay package does not require npm sign-in. Maintainers can use the repository's
+trusted-publishing workflow once npm has authorized that workflow.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "relay-codex",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Keep your Codex sessions moving between your own accounts.",
   "license": "MIT",
   "author": "blackspider-ops",

package/python/Menu.swift

@@ -1,70 +1,188 @@
 import AppKit
 
-final class MenuController: NSObject, NSApplicationDelegate {
+final class MenuController: NSObject, NSApplicationDelegate, NSMenuDelegate {
     var item: NSStatusItem!
-    var timer: Timer?
-    var busy = false
-    let command = CommandLine.arguments.count > 1 ? CommandLine.arguments[1] : (Bundle.main.object(forInfoDictionaryKey: "RelayCommand") as? String ?? "/usr/bin/false")
+    var stream: Process?
+    var buffer = Data()
+    var current: [String: Any] = [:]
+    var message: String?
+    var reconnect: DispatchWorkItem?
+    var stopping = false
+    let command = Bundle.main.object(forInfoDictionaryKey: "RelayCommand") as? String ?? "/usr/bin/false"
+    let state = Bundle.main.object(forInfoDictionaryKey: "RelayState") as? String ?? ""
+
     func applicationDidFinishLaunching(_ notification: Notification) {
+        let others = NSRunningApplication.runningApplications(withBundleIdentifier: "local.relay.menu")
+        if others.contains(where: { $0.processIdentifier != ProcessInfo.processInfo.processIdentifier }) { NSApp.terminate(nil); return }
         NSApp.setActivationPolicy(.accessory)
-        item = NSStatusBar.system.statusItem(withLength: NSStatusItem.variableLength)
-        item.button?.title = "Relay"
-        refresh()
-        timer = Timer.scheduledTimer(withTimeInterval: 30, repeats: true) { [weak self] _ in self?.refresh() }
+        item = NSStatusBar.system.statusItem(withLength: NSStatusItem.squareLength)
+        item.button?.title = ""
+        item.button?.setAccessibilityLabel("Relay account and session status")
+        updateIcon(attention: false)
+        render()
+        startStream()
     }
-    @objc func refresh() {
-        if busy { return }; busy = true
-        DispatchQueue.global(qos: .utility).async { [weak self] in
-            guard let self = self else { return }
-            let process = Process(); process.executableURL = URL(fileURLWithPath: self.command)
-            process.arguments = ["status", "--json"]
-            let pipe = Pipe(); process.standardOutput = pipe; process.standardError = FileHandle.nullDevice
-            var value: [String: Any] = [:]
-            do {
-                try process.run()
-                let bytes = pipe.fileHandleForReading.readDataToEndOfFile(); process.waitUntilExit()
-                value = (try? JSONSerialization.jsonObject(with: bytes)) as? [String: Any] ?? [:]
-            } catch { }
-            let result = value
-            DispatchQueue.main.async { self.busy = false; self.render(result) }
+    func process(_ args: [String]) -> Process {
+        let proc = Process()
+        proc.executableURL = URL(fileURLWithPath: command)
+        proc.arguments = args
+        var env = ProcessInfo.processInfo.environment
+        let node = Bundle.main.object(forInfoDictionaryKey: "RelayNodeDirectory") as? String ?? "/opt/homebrew/bin"
+        env["PATH"] = node + ":/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:" + (env["PATH"] ?? "")
+        env["RELAY_STATE"] = state
+        proc.environment = env
+        return proc
+    }
+    func startStream() {
+        guard !stopping else { return }
+        let proc = process(["status", "--watch", "--json"])
+        let pipe = Pipe()
+        proc.standardOutput = pipe; proc.standardError = FileHandle.nullDevice
+        pipe.fileHandleForReading.readabilityHandler = { [weak self] handle in
+            let bytes = handle.availableData
+            guard !bytes.isEmpty else { handle.readabilityHandler = nil; return }
+            DispatchQueue.main.async { self?.receive(bytes) }
+        }
+        proc.terminationHandler = { [weak self] _ in
+            DispatchQueue.main.async {
+                guard let self = self, !self.stopping else { return }
+                self.message = "Status connection interrupted. Retrying in 30 seconds."
+                self.render()
+                let retry = DispatchWorkItem { [weak self] in self?.startStream() }
+                self.reconnect = retry
+                DispatchQueue.main.asyncAfter(deadline: .now() + 30, execute: retry)
+            }
+        }
+        do { buffer.removeAll(); try proc.run(); stream = proc }
+        catch { message = "Relay could not start. Open Terminal and run relay doctor."; render() }
+    }
+    func receive(_ bytes: Data) {
+        buffer.append(bytes)
+        while let newline = buffer.firstIndex(of: 10) {
+            let line = buffer.prefix(upTo: newline); buffer.removeSubrange(...newline)
+            if let value = (try? JSONSerialization.jsonObject(with: line)) as? [String: Any] {
+                current = value; message = nil; render()
+            }
+        }
+    }
+    func updateIcon(attention: Bool) {
+        let symbol = attention ? "exclamationmark.circle.fill" : "arrow.triangle.branch"
+        let image = NSImage(systemSymbolName: symbol, accessibilityDescription: attention ? "Relay needs attention" : "Relay")
+        image?.isTemplate = true
+        item.button?.image = image
+    }
+    func text(_ title: String, into menu: NSMenu) {
+        menu.addItem(NSMenuItem(title: title, action: nil, keyEquivalent: ""))
+    }
+    func action(_ title: String, args: [String], into menu: NSMenu) {
+        let entry = NSMenuItem(title: title, action: #selector(runAction(_:)), keyEquivalent: "")
+        entry.target = self; entry.representedObject = args; menu.addItem(entry)
+    }
+    func date(_ value: Any?) -> String {
+        guard let seconds = value as? Double else { return "unknown" }
+        return Date(timeIntervalSince1970: seconds).formatted(date: .abbreviated, time: .shortened)
+    }
+    func countdown(_ title: String, value: Any, into menu: NSMenu) {
+        let entry = NSMenuItem(title: title + ": " + date(value), action: nil, keyEquivalent: "")
+        entry.representedObject = ["label": title, "at": value]
+        menu.addItem(entry)
+    }
+    func updateTimes(_ menu: NSMenu) {
+        for entry in menu.items {
+            if let data = entry.representedObject as? [String: Any], let at = data["at"] as? Double, let label = data["label"] as? String {
+                let seconds = max(0, Int(at - Date().timeIntervalSince1970))
+                let remaining = seconds < 60 ? "under a minute" : seconds < 3600 ? "\(seconds / 60)m" : "\(seconds / 3600)h \((seconds % 3600) / 60)m"
+                entry.title = label + ": " + (seconds == 0 ? "due now" : "in " + remaining) + " · " + date(at)
+            }
+            if let child = entry.submenu { updateTimes(child) }
         }
     }
-    func render(_ value: [String: Any]) {
-        let sessions = value["sessions"] as? [[String: Any]] ?? []
-        let accounts = value["accounts"] as? [[String: Any]] ?? []
-        item.button?.title = "Relay \(sessions.count)"
-        let menu = NSMenu()
-        let heading = NSMenuItem(title: "\(sessions.count) sessions · \(accounts.count) accounts", action: nil, keyEquivalent: "")
-        menu.addItem(heading); menu.addItem(.separator())
+    func render() {
+        let sessions = current["sessions"] as? [[String: Any]] ?? []
+        let accounts = current["accounts"] as? [[String: Any]] ?? []
+        let attention = message != nil || sessions.contains { ($0["state"] as? String) == "needs_attention" }
+        updateIcon(attention: attention)
+        item.button?.toolTip = "Relay · \(sessions.count) sessions · \(accounts.count) accounts"
+        let menu = NSMenu(); menu.delegate = self
+        text("Relay · \(sessions.count) sessions", into: menu)
+        if let message = message { text(message, into: menu) }
+        if accounts.isEmpty { text("Add an account with relay setup in Terminal.", into: menu) }
         for account in accounts {
             let name = account["name"] as? String ?? "Account"
             let primary = account["primary"] as? [String: Any]
-            let used = (primary?["usedPercent"] as? NSNumber)?.intValue
-            let remaining = used.map { "\(max(0,100-$0))% left" } ?? "usage unknown"
-            let enabled = account["enabled"] as? Bool ?? true
-            menu.addItem(NSMenuItem(title: "\(name): \(enabled ? remaining : "disabled")", action: nil, keyEquivalent: ""))
+            let remaining = (primary?["usedPercent"] as? NSNumber).map { "\(max(0, 100 - $0.intValue))% left" } ?? "allowance unknown"
+            let label = (account["enabled"] as? Bool ?? true) ? remaining : "disabled"
+            let submenu = NSMenu()
+            if let email = account["email"] as? String { text(email, into: submenu) }
+            text("Short window: \(remaining)", into: submenu)
+            if let secondary = account["secondary"] as? [String: Any], let used = secondary["usedPercent"] as? NSNumber { text("Weekly window: \(max(0, 100 - used.intValue))% left", into: submenu) }
+            if let reset = account["next_check"] { countdown("Next check", value: reset, into: submenu) }
+            text("Last checked: \(date(account["usage_checked_at"]))", into: submenu)
+            let entry = NSMenuItem(title: "\(name) · \(label)", action: nil, keyEquivalent: ""); entry.submenu = submenu; menu.addItem(entry)
         }
+        menu.addItem(.separator())
         for session in sessions {
-            let name = session["name"] as? String ?? String((session["id"] as? String ?? "").prefix(10))
-            let state = session["state"] as? String ?? "unknown"
-            menu.addItem(NSMenuItem(title: "\(name) — \(state)", action: nil, keyEquivalent: ""))
+            let id = session["id"] as? String ?? ""
+            let name = session["name"] as? String ?? String(id.prefix(10))
+            let status = (session["state"] as? String ?? "unknown").replacingOccurrences(of: "_", with: " ")
+            let submenu = NSMenu()
+            text("Account: \(session["account"] as? String ?? "unknown")", into: submenu)
+            text("Model: \(session["model"] as? String ?? "unknown")", into: submenu)
+            if let next = session["next_wake"] { countdown("Next action", value: next, into: submenu) }
+            if let reason = session["reason"] as? String { text(reason.replacingOccurrences(of: "_", with: " "), into: submenu) }
+            action("Copy reconnect command", args: ["copy", "relay attach " + id], into: submenu)
+            action("Pause recovery", args: ["pause", id, "--wait"], into: submenu)
+            action("Resume recovery", args: ["unpause", id, "--wait"], into: submenu)
+            action("Review and retry…", args: ["confirm-retry", id], into: submenu)
+            let entry = NSMenuItem(title: "\(name) · \(status)", action: nil, keyEquivalent: ""); entry.submenu = submenu; menu.addItem(entry)
         }
         menu.addItem(.separator())
-        let copy = NSMenuItem(title: "Copy dashboard command", action: #selector(copyDashboard), keyEquivalent: ""); copy.target=self; menu.addItem(copy)
-        let update = NSMenuItem(title: "Refresh allowance", action: #selector(refreshAllowance), keyEquivalent: ""); update.target=self; menu.addItem(update)
-        let reload = NSMenuItem(title: "Refresh menu", action: #selector(refresh), keyEquivalent: ""); reload.target=self; menu.addItem(reload)
-        let quit = NSMenuItem(title: "Quit menu", action: #selector(quitMenu), keyEquivalent: "q"); quit.target=self; menu.addItem(quit)
-        item.menu=menu
+        action("Copy dashboard command", args: ["copy", "relay status --watch"], into: menu)
+        action("Check allowance now", args: ["refresh"], into: menu)
+        let login = NSMenuItem(title: "Open at login", action: #selector(toggleLogin), keyEquivalent: ""); login.target = self
+        login.state = FileManager.default.fileExists(atPath: NSHomeDirectory() + "/Library/LaunchAgents/local.relay.menu.plist") ? .on : .off
+        menu.addItem(login)
+        let quit = NSMenuItem(title: "Quit Relay menu", action: #selector(quitMenu), keyEquivalent: "q"); quit.target = self; menu.addItem(quit)
+        item.menu = menu
     }
-    @objc func copyDashboard() {
-        NSPasteboard.general.clearContents(); NSPasteboard.general.setString("relay status --watch", forType: .string)
+    func menuWillOpen(_ menu: NSMenu) {
+        updateTimes(menu)
+        for entry in menu.items where entry.title == "Open at login" {
+            entry.state = FileManager.default.fileExists(atPath: NSHomeDirectory() + "/Library/LaunchAgents/local.relay.menu.plist") ? .on : .off
+        }
     }
-    @objc func refreshAllowance() {
-        let process=Process(); process.executableURL=URL(fileURLWithPath:command);process.arguments=["refresh"]
-        process.standardOutput=FileHandle.nullDevice;process.standardError=FileHandle.nullDevice
-        try? process.run()
+    @objc func runAction(_ sender: NSMenuItem) {
+        guard var args = sender.representedObject as? [String], !args.isEmpty else { return }
+        if args[0] == "copy" { NSPasteboard.general.clearContents(); NSPasteboard.general.setString(args[1], forType: .string); return }
+        if args[0] == "confirm-retry" {
+            let alert = NSAlert(); alert.messageText = "Continue this task?"; alert.informativeText = "Review any interrupted command or external action in the conversation before continuing."
+            alert.addButton(withTitle: "Continue task"); alert.addButton(withTitle: "Cancel")
+            NSApp.activate(ignoringOtherApps: true)
+            guard alert.runModal() == .alertFirstButtonReturn else { return }
+            args = ["retry", args[1], "--wait"]
+        }
+        let proc = process(args); let pipe = Pipe(); proc.standardOutput = FileHandle.nullDevice; proc.standardError = pipe
+        DispatchQueue.global(qos: .utility).async { [weak self] in
+            do {
+                try proc.run(); let bytes = pipe.fileHandleForReading.readDataToEndOfFile(); proc.waitUntilExit()
+                if proc.terminationStatus != 0 { DispatchQueue.main.async { self?.message = String(data: bytes, encoding: .utf8)?.trimmingCharacters(in: .whitespacesAndNewlines) ?? "Action failed. Check relay events."; self?.render() } }
+            } catch { DispatchQueue.main.async { self?.message = "Could not run that action."; self?.render() } }
+        }
     }
-    @objc func quitMenu() { NSApp.terminate(nil) }
+    @objc func toggleLogin() {
+        let enabled = FileManager.default.fileExists(atPath: NSHomeDirectory() + "/Library/LaunchAgents/local.relay.menu.plist")
+        runCommand(enabled ? ["menubar", "--no-startup", "--configure-only"] : ["menubar", "--configure-only"])
+    }
+    func runCommand(_ args: [String]) { let proc = process(args); proc.standardOutput = FileHandle.nullDevice; proc.standardError = FileHandle.nullDevice; try? proc.run() }
+    @objc func quitMenu() { stopping = true; reconnect?.cancel(); stream?.terminate(); NSApp.terminate(nil) }
+    func applicationWillTerminate(_ notification: Notification) { stopping = true; stream?.terminate() }
+}
+if CommandLine.arguments.contains("--self-check") {
+    let normal = NSImage(systemSymbolName: "arrow.triangle.branch", accessibilityDescription: "Relay")
+    let attention = NSImage(systemSymbolName: "exclamationmark.circle.fill", accessibilityDescription: "Relay needs attention")
+    print("Relay menu symbols available: \(normal != nil && attention != nil)")
+    exit(normal != nil && attention != nil ? 0 : 1)
+} else {
+    let app = NSApplication.shared
+    let delegate = MenuController(); app.delegate = delegate; app.run()
 }
-let app=NSApplication.shared
-let delegate=MenuController(); app.delegate=delegate; app.run()