pa-types/pa-cli/pa-tui: daemon incident forensics — prime-agent incident CLI + agents-view incident notices (TS #2406 port)

crates/pa-cli/README.md

@@ -3,7 +3,7 @@
 The `prime-agent` binary.
 
 ## Scope
-Argument parsing matching the TS CLI exactly, mode selection (interactive/headless/json/daemon subcommands), binary wiring of crates into processes, exit codes and user-facing errors. Client-side MCP auth flows (`mcp_login.rs`): the `/mcp login`/`/mcp logout` hook the TUI calls — the TS interactive client's placement — resolving a server (settings `mcpServers` + the builtin catalog), running the pa-core OAuth login on the suspended terminal, and persisting through the shared auth store. The same placement serves the TUI's client-command hooks: provider auth (`provider_login.rs` — the `/login`/`/logout` catalog, the API-key store, the MCP device flow, the Prime Inference terminal login (`prime_inference_login.rs` — the API-key flow: prime-cli credential reuse, the paste prompt with the whoami access check, the numbered team selector); the subscription OAuth and the Prime browser challenge stay unported and report it), trace-sharing state (`client_traces.rs` — the settings flag writes and the credential resolution `/traces` shows; the upload subsystem stays unported), and the update child runner + post-update relaunch (`client_update.rs` — the split-CLI child invocations and the exec of the updated launcher from the managed install root).
+Argument parsing matching the TS CLI exactly, mode selection (interactive/headless/json/daemon subcommands), binary wiring of crates into processes, exit codes and user-facing errors. The daemon-forensics CLI (`incident.rs`, TS `src/cli/incident.ts`): the `prime-agent incident` timeline command — log-source discovery (agent.jsonl plus its `.old` rotation, falling back to the newest per-daemon log), `--since`/`--until` window and `--session` filter parsing, and the report rendering; the shared classifier lives in pa-types (`pa_types::incident`) and the agents-view notice in pa-tui. Client-side MCP auth flows (`mcp_login.rs`): the `/mcp login`/`/mcp logout` hook the TUI calls — the TS interactive client's placement — resolving a server (settings `mcpServers` + the builtin catalog), running the pa-core OAuth login on the suspended terminal, and persisting through the shared auth store. The same placement serves the TUI's client-command hooks: provider auth (`provider_login.rs` — the `/login`/`/logout` catalog, the API-key store, the MCP device flow, the Prime Inference terminal login (`prime_inference_login.rs` — the API-key flow: prime-cli credential reuse, the paste prompt with the whoami access check, the numbered team selector); the subscription OAuth and the Prime browser challenge stay unported and report it), trace-sharing state (`client_traces.rs` — the settings flag writes and the credential resolution `/traces` shows; the upload subsystem stays unported), and the update child runner + post-update relaunch (`client_update.rs` — the split-CLI child invocations and the exec of the updated launcher from the managed install root).
 
 ## Non-goals
 No business logic; it composes pa-daemon, pa-core, pa-tui, pa-ai via their public APIs only.

crates/pa-cli/src/command_registry.rs

@@ -1,4 +1,4 @@
 //! Command specs and help formatting, ported from `cli/command-registry.ts`.
 
 use crate::config::APP_NAME;
 
@@ -125,6 +125,23 @@
         "--fix   Remove stale sockets and stop idle orphaned services",
         "--json  Print JSON",
     ]),
+    CommandSpec::new(
+        &["incident"],
+        "incident [--since <time>] [--until <time>] [--session <id>]",
+        "Reconstruct a daemon incident from its logs",
+    )
+    .description(
+        "Summarizes the daemon logs for a time window into an operator timeline: supervisor and worker events, session anomalies, and recovery actions. Times without a timezone are read as UTC, matching the log; the default window is the last 24 hours.",
+    )
+    .options(&[
+        "--since <time>  Window start (ISO date/time, date, or HH:MM today; default: 24h ago)",
+        "--until <time>  Window end (default: now)",
+        "--session <id>  Only events naming this session id, worker id, or session name (prefix match)",
+    ])
+    .examples(&[
+        "incident --since \"2026-09-16T20:02\" --until \"2026-09-16T20:21\"",
+        "incident --session 2339fb7da605",
+    ]),
     CommandSpec::new(
         &["shutdown"],
         "shutdown [--force] [--json]",