fix(credits): keep cold-start account seed in the session profile

[poijygfdyy]

Invariant

A session-open credits seed must read the Nous account under the same routed profile context that owns the agent being hydrated. A fire-and-forget seed thread must not fall back to the process-launch HERMES_HOME / auth state.

Current-main RED

Current main (260da4ef6251b29aa830c8c949dbe7c92d58df5f) starts the cold-start portal lookup as a bare daemon thread:

def _bg_seed():
    ...
    info = get_nous_portal_account_info(force_fresh=True)
    ...
threading.Thread(target=_bg_seed, name="credits-seed", daemon=True).start()

HERMES_HOME routing is context-local. A fresh threading.Thread starts with an empty Context, so a served profile can enter seed_credits_at_session_start() under its own profile and then perform the account lookup under the launch profile instead.

The regression commit sets process HERMES_HOME to a launch home, binds a different served-profile override around the real seed_credits_at_session_start() call, replaces only the portal network lookup with a deterministic local fake, waits for the real background thread to finish, and asserts the lookup observed the served home. On current main that assertion is RED: the bare worker observes the launch home.

A standalone ContextVar/real-thread probe also reproduces the mechanism deterministically: caller=served, bare child thread=launch.

Fix

Capture the caller's full contextvars.Context at the existing spawn boundary and execute the unchanged _bg_seed body inside it:

threading.Thread(
    target=contextvars.copy_context().run,
    args=(_bg_seed,),
    name="credits-seed",
    daemon=True,
).start()

This matches the repository's existing profile-sensitive background-thread pattern. It changes no account mapping, notice policy, retry behavior, session lifecycle, or portal API behavior.

Collision audit

Re-ran mechanism-level collision checks immediately before marking this ready: current/recent PRs, issues, commits, exact function name, credits-seed, agent/credits_tracker.py, profile/context propagation, and account-lookup call sites.

• Current upstream main is still 260da4ef6251b29aa830c8c949dbe7c92d58df5f; the affected source has not moved since discovery.
• No competing open PR or recent commit was found implementing Context propagation for seed_credits_at_session_start() / the credits-seed thread.
• Served-profile children and background threads run with their own profile's env/scope; kanban never kills a recycled PID #111617 is already merged. Its exhaustive post-merge thread audit explicitly records this exact agent/credits_tracker.py residual: a served-profile agent can hydrate credit state from the launch profile's account. It did not modify this path.
• [Bug]: Desktop credits usage notice re-fires on every message — reap/resume re-mints the agent and the cold-start seed re-primes the band gate #101578 concerns notice-latch lifetime across agent re-minting; fix(conversation): guard system-prompt restore against concurrent reb… #47890 concerns repeated seeding from system-prompt rebuild concurrency; fix(credits): reintroduce grant_spent, gated on an in-session crossing #73634 concerns the grant-spent crossing gate; fix(credits): seed cold-start usage gauge from subscription.credits_remaining #41221 concerns gauge/account-field semantics; feat(credits): usage-aware credits — in-session notices, /usage view, dev readout #40011 is the credits feature foundation. They touch adjacent credits/session behavior but not this thread-context ownership invariant.
• Exact issue search found adjacent usage/delivery reports, but none for this profile-context propagation mechanism.

Final diff

• agent/credits_tracker.py: import contextvars and wrap the one existing background-thread hop in the copied caller Context.
• tests/agent/test_credits_seed_profile_scope.py: deterministic real-thread regression for launch-home vs served-profile routing.

No unrelated runtime behavior is included.

Validation

• Deterministic bare-thread Context loss reproduced with a real Python thread.
• Regression exercises the real seed_credits_at_session_start() spawn path; only the remote portal lookup is replaced with a local deterministic fake.
• The production fix follows the repository's established contextvars.copy_context().run thread-hop pattern.
• Exact-head hosted workflow runs for 26565332206fee4b86a9c627dc748438f6c3126b are currently action_required; the jobs did not execute behind the external-contributor approval gate, so CI is not claimed as passing.
• Repository pytest/Ruff could not be run in this execution environment because GitHub checkout/network access failed at DNS resolution; they are not claimed as passing.

[alt-glitch]

This was generated by AI during triage.

@rob-maron Tagging you on this credits-notice item as the soft maintainer (follow-up to #43669).