@agentdeck/bridge 0.2.3 → 1.0.0

package/dist/daemon-server.js

@@ -23,11 +23,22 @@ import { PassiveSessionObserver } from './passive-observer.js';
 import { SessionTimelineRelay } from './session-timeline-relay.js';
 import { SessionFocusRelay } from './session-focus-relay.js';
 import { updatePushState } from './session-aggregator.js';
-import { setAwaitingOverlay, clearAwaitingOverlay, isPermissionNotification, applyAwaitingOverlayToObserved } from './awaiting-overlay.js';
-import { resolvePending, sweepStalePending, drainAllPending } from './permission-resolver.js';
+import { setAwaitingOverlay, clearAwaitingOverlay, getAwaitingOverlay, isPermissionNotification, applyAwaitingOverlayToObserved } from './awaiting-overlay.js';
+import { registerPending, resolvePending, sweepStalePending, drainAllPending, isPendingRequest } from './permission-resolver.js';
+import { shouldHoldPreToolUse, gateReleased, buildGateQuestion, consumeStop, requestStop, clearStop, STOP_DENY_REASON, queueDirective, takeDirective, clearOnUserPrompt, clearSession as clearSteeringSession, notePermissionPromptShown, noteToolEnd, steeringSnapshot, } from './observed-steering.js';
+import { enqueueOpenCodeCommand, pollOpenCodeCommands } from './opencode-steering.js';
+import { runSessionReview, reviewSnapshot } from './review-runner.js';
+/** Observed-session device approval gate (PreToolUse hold). Default ON — the
+ *  precision guards in observed-steering.ts/claude-permission-rules.ts ensure
+ *  only genuine would-prompt calls are held. Kill switch for field issues. */
+const OBSERVED_APPROVAL_ENABLED = process.env.AGENTDECK_OBSERVED_APPROVAL !== '0';
+/** How long a held gate waits for a device decision before releasing the tool
+ *  call to Claude's own permission flow. Must stay well under the hook curl's
+ *  --max-time 60 so the release reaches Claude before curl gives up. */
+const OBSERVED_APPROVAL_HOLD_MS = Math.min(50_000, Math.max(5_000, Number(process.env.AGENTDECK_APPROVAL_HOLD_MS) || 25_000));
 import { VoiceManager } from './voice.js';
 import { VoiceAssistantManager } from './voice-assistant.js';
-import { listActive as listActiveSessions, findAvailablePort, findExistingDaemon, DAEMON_DEFAULT_PORT, probeDaemonHealth, requestDaemonShutdown, scanDaemonPortWindow, shouldConcedePortToOccupant, waitForDaemonExit, writeDaemonInfo, removeDaemonInfo, readDaemonInfo, removeDaemonSession, getCandidateDataDirs, } from './session-registry.js';
+import { listActive as listActiveSessions, findAvailablePort, findExistingDaemon, DAEMON_DEFAULT_PORT, probeDaemonHealth, requestDaemonShutdown, scanDaemonPortWindow, shouldConcedePortToOccupant, waitForDaemonExit, writeDaemonInfo, removeDaemonInfo, readDaemonInfo, removeDaemonSession, getCandidateDataDirs, getOwnTimelineFile, } from './session-registry.js';
 import { fetchUsageFromApi, hasOAuthToken, resetConsecutiveFailures } from './usage-api.js';
 import { isLocalConnection, validateToken } from './auth.js';
 import { getLastFrame, renderPreviewFrame, onFrameRendered, offFrameRendered } from './pixoo/pixoo-bridge.js';
@@ -49,7 +60,7 @@ import { loadWifiConfig } from './wifi-config.js';
 import { getConnectedAdbDevices, hasAdb, getAdbDeviceCount } from './adb-reverse.js';
 import { getPixooDeviceDetails, pixooDeviceCount } from './pixoo/pixoo-bridge.js';
 import { loadTimeboxDevices } from './timebox/timebox-settings.js';
-import { getLanIp, stripUnsafeText, cleanRawText, prepareMarkdownDetail } from '@agentdeck/shared';
+import { getLanIp, stripUnsafeText, cleanRawText, prepareMarkdownDetail, normalizeCommandPrompt, formatDurationSec } from '@agentdeck/shared';
 import { injectOpenClawSession } from './openclaw-session.js';
 import { readFileSync, statSync } from 'fs';
 import { join } from 'path';
@@ -578,7 +589,7 @@ export function enrichGatewayTimelineEntry(entry) {
  * daemon change.
  */
 export function classifyObservedHookEvent(eventName, mapped) {
-    const prefixed = /^(codex|opencode|antigravity)_(session_start|session_end|user_prompt_submit|tool_start|tool_end|stop|turn_complete|notification)$/
+    const prefixed = /^(codex|opencode|antigravity)_(session_start|session_end|user_prompt_submit|tool_start|tool_end|stop|turn_complete|notification|permission_asked|permission_replied)$/
         .exec(eventName);
     if (!prefixed)
         return { boundary: mapped, agentType: 'claude-code' };
@@ -692,7 +703,7 @@ function buildNodeModuleHealth(startedModules) {
 // ===== startDaemon =====
 export async function startDaemon(opts) {
     if (opts.debug) {
-        enableDebugLog('/tmp/agentdeck-debug.log');
+        enableDebugLog();
         log('[agentdeck] Debug logging enabled');
     }
     // CLI --wake-word flag OR settings.json wakeWord: true
@@ -793,6 +804,11 @@ export async function startDaemon(opts) {
     // Fallback task-row emitter, created only when initApme() returns null —
     // keeps task_start/task_end rows on the timeline without the collector.
     let fallbackTasks = null;
+    // Sessions that posted any hook since this daemon started — the delayed
+    // orphan-chat reaper must never force-close a turn belonging to a session
+    // that is provably alive (agentic turns regularly outlive any fixed age
+    // threshold). Declared before the HTTP handlers that populate it.
+    const hookSessionsSeen = new Set();
     // Declare early — HTTP /health handler references this in its closure.
     // Must be declared before the HTTP server so it's initialized (not in TDZ)
     // when the first /health request arrives.
@@ -1108,6 +1124,10 @@ export async function startDaemon(opts) {
                         const message = typeof json.message === 'string' ? json.message : '';
                         const notificationType = typeof json.notification_type === 'string' ? json.notification_type : undefined;
                         if (isPermissionNotification(notificationType, message)) {
+                            // A genuine terminal prompt appeared — recent undecided gate
+                            // releases were real prompts, so nothing gets learned as
+                            // auto-approved (observed-steering learner).
+                            notePermissionPromptShown(claudeSid);
                             setAwaitingOverlay(claudeSid, message);
                             // Broadcast immediately rather than waiting for the 2s debounce
                             // or the 5s observer tick, so the prompt surfaces within one frame.
@@ -1117,10 +1137,31 @@ export async function startDaemon(opts) {
                     else if (mapped === 'tool_start' || mapped === 'tool_end' ||
                         mapped === 'user_prompt_submit' || mapped === 'stop' ||
                         mapped === 'session_start' || mapped === 'session_end') {
+                        // Steering lifecycle: a PostToolUse right after an undecided gate
+                        // release (no permission_prompt Notification in between) means
+                        // Claude auto-approved the call — learn the signature so it is
+                        // never held again this session. User prompt / session end clear
+                        // pending STOP + queued directives (the user took over).
+                        if (mapped === 'tool_end') {
+                            noteToolEnd(claudeSid, typeof json.tool_name === 'string' ? json.tool_name : undefined);
+                        }
+                        else if (mapped === 'user_prompt_submit') {
+                            if (clearOnUserPrompt(claudeSid))
+                                core.broadcastSessionsList().catch(() => { });
+                        }
+                        else if (mapped === 'session_end') {
+                            clearSteeringSession(claudeSid);
+                        }
                         // Any subsequent hook means the prompt was answered — drop the
                         // overlay. Only rebroadcast if there was actually one to clear
                         // (direct-`claude` sessions fire tool hooks constantly).
-                        if (clearAwaitingOverlay(claudeSid)) {
+                        // EXCEPT while a held gate is still pending: parallel tool calls
+                        // fire their own PreToolUse/PostToolUse hooks, and clearing here
+                        // would strip the Allow/Deny UI out from under the open request
+                        // (its own onResolved clears the overlay when it settles).
+                        const heldOverlay = getAwaitingOverlay(claudeSid);
+                        const gateStillPending = Boolean(heldOverlay?.requestId && isPendingRequest(heldOverlay.requestId));
+                        if (!gateStillPending && clearAwaitingOverlay(claudeSid)) {
                             core.broadcastSessionsList().catch(() => { });
                         }
                     }
@@ -1146,6 +1187,10 @@ export async function startDaemon(opts) {
                 // run mapping. Falls back to a stable id only when a hook omits it.
                 const hookSid = typeof json.session_id === 'string' && json.session_id
                     ? json.session_id : 'daemon-hook';
+                // Liveness marker for the delayed orphan-chat reaper: a session that
+                // posts ANY hook after daemon startup is alive, and its open turn
+                // (even one persisted before the restart) must not be force-closed.
+                hookSessionsSeen.add(hookSid);
                 // Claude hooks carry `cwd` (the worktree dir), not project_name/path —
                 // capture it so APME runs are attributable to a specific worktree.
                 const hookCwd = (typeof json.cwd === 'string' ? json.cwd
@@ -1156,10 +1201,47 @@ export async function startDaemon(opts) {
                 const hookMessage = json.message;
                 // Prompt shapes: Claude `{prompt}` / `{message:{content}}`; some Codex
                 // builds send `{user_prompt}` (same fallback chain as codex-hook.ts).
-                const hookPromptText = typeof json.prompt === 'string' ? json.prompt
+                // Command XML envelopes (`<command-name>/merge</command-name>` …)
+                // collapse to their "/merge args" form so a slash-command turn reads
+                // as the command the user typed, not an XML blob.
+                const hookPromptText = normalizeCommandPrompt(typeof json.prompt === 'string' ? json.prompt
                     : (typeof hookMessage?.content === 'string' ? hookMessage.content
-                        : (typeof json.user_prompt === 'string' ? json.user_prompt : ''));
+                        : (typeof json.user_prompt === 'string' ? json.user_prompt : '')));
                 const isClearBoundary = boundary === 'user_prompt_submit' && /^\s*\/clear\s*$/i.test(hookPromptText);
+                // Session ended with a turn still open (the user interrupted the turn
+                // then exited, or the process was torn down before its Stop could
+                // fire): close the row honestly so dashboards stop the spinner instead
+                // of showing "in progress" forever. Runs BEFORE the collector so the
+                // interrupted chat_end sorts above the session_end task_end row.
+                // Mirrors the Swift daemon's session_end force-close (`hasOpenTurn`
+                // → interrupted chat_end).
+                if (boundary === 'session_end') {
+                    const rows = core.bridgeTimeline.getHistoryForSession(hookSid, undefined, 24);
+                    let lastStart;
+                    let lastCompletionTs = 0;
+                    for (const row of rows) {
+                        if (row.type === 'chat_start')
+                            lastStart = row;
+                        else if (row.type === 'chat_response' || row.type === 'chat_end') {
+                            lastCompletionTs = Math.max(lastCompletionTs, row.ts);
+                        }
+                    }
+                    if (lastStart && lastStart.ts > lastCompletionTs) {
+                        const now = Date.now();
+                        const durS = Math.max(0, Math.round((now - (lastStart.startedAt ?? lastStart.ts)) / 1000));
+                        core.bridgeTimeline.addEntry({
+                            ts: now, type: 'chat_end',
+                            raw: `Interrupted · ${formatDurationSec(durS)}`,
+                            summaryKind: 'none',
+                            sessionId: hookSid,
+                            agentType: hookAgentType,
+                            startedAt: lastStart.startedAt ?? lastStart.ts,
+                            endedAt: now,
+                            ...(lastStart.taskId ? { taskId: lastStart.taskId } : {}),
+                            ...(hookProject ? { projectName: hookProject } : {}),
+                        });
+                    }
+                }
                 // ── APME collector (task/turn segmentation) ──
                 if (apme) {
                     if (isClearBoundary) {
@@ -1313,7 +1395,7 @@ export async function startDaemon(opts) {
                             const durS = Math.max(0, Math.round((now - (lastStart.startedAt ?? lastStart.ts)) / 1000));
                             core.bridgeTimeline.addEntry({
                                 ts: now, type: 'chat_end',
-                                raw: `Completed · ${durS}s`,
+                                raw: `Completed · ${formatDurationSec(durS)}`,
                                 summaryKind: 'none',
                                 ...base,
                             });
@@ -1344,13 +1426,91 @@ export async function startDaemon(opts) {
                     }
                 }
                 // ── Response ──
-                // PreToolUse returns an empty body → Claude's normal permission flow
-                // runs untouched (zero added latency, no daemon-side gate). Every other
-                // event acks immediately.
+                // PreToolUse and Stop are request-response steering channels (the hook
+                // script echoes our body to Claude's stdout); everything else acks.
                 if (eventName === 'PreToolUse') {
+                    const toolName = typeof json.tool_name === 'string' ? json.tool_name : '';
+                    const toolInput = (json.tool_input && typeof json.tool_input === 'object')
+                        ? json.tool_input : undefined;
+                    // 1. Soft STOP: the user pressed STOP on a device — deny this tool
+                    //    call with a halt instruction. One-shot (flag consumed).
+                    if (claudeSid && consumeStop(claudeSid)) {
+                        res.writeHead(200, { 'Content-Type': 'application/json' });
+                        res.end(JSON.stringify({
+                            hookSpecificOutput: {
+                                hookEventName: 'PreToolUse',
+                                permissionDecision: 'deny',
+                                permissionDecisionReason: STOP_DENY_REASON,
+                            },
+                        }));
+                        core.broadcastSessionsList().catch(() => { });
+                        return;
+                    }
+                    // 2. Device-approval gate: hold the response for a device decision,
+                    //    but ONLY for calls the precision guards say Claude would
+                    //    genuinely prompt for (see shouldHoldPreToolUse — mode gate,
+                    //    never-prompt/prompt-prone sets, allowlist prediction, learned
+                    //    auto-approvals, connected-client check). Anything uncertain
+                    //    falls through to the empty pass-through below.
+                    if (claudeSid) {
+                        const gate = shouldHoldPreToolUse({
+                            sessionId: claudeSid,
+                            tool: toolName,
+                            toolInput,
+                            permissionMode: typeof json.permission_mode === 'string' ? json.permission_mode : undefined,
+                            cwd: hookCwd || undefined,
+                            clientCount: core.wsServer.getClientCount(),
+                            enabled: OBSERVED_APPROVAL_ENABLED,
+                        });
+                        if (gate.hold && gate.requestId) {
+                            const requestId = gate.requestId;
+                            debug('daemon', `PreToolUse gate held: ${toolName} (${gate.reason}) req=${requestId}`);
+                            setAwaitingOverlay(claudeSid, buildGateQuestion(toolName, toolInput), requestId);
+                            core.broadcastSessionsList().catch(() => { });
+                            registerPending(requestId, res, {
+                                sessionId: claudeSid,
+                                tool: toolName,
+                                timeoutMs: OBSERVED_APPROVAL_HOLD_MS,
+                                onResolved: (decision) => {
+                                    // `pass` (timeout) arms the auto-approval learner: if the
+                                    // tool then runs with no permission_prompt Notification,
+                                    // the signature is suppressed for this session.
+                                    gateReleased(claudeSid, requestId, {
+                                        undecided: decision === 'pass', tool: toolName, toolInput,
+                                    });
+                                    clearAwaitingOverlay(claudeSid);
+                                    core.broadcastSessionsList().catch(() => { });
+                                },
+                            });
+                            return; // response held open — resolved by device / timeout
+                        }
+                    }
+                    // Pass-through: empty body → Claude's normal permission flow runs
+                    // untouched (zero added latency, no daemon-side gate).
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end('');
                 }
+                else if (eventName === 'Stop') {
+                    // Turn-end directive queue: deliver at most one queued deck command
+                    // by blocking the stop with the directive as the continuation
+                    // reason. Empty queue (the overwhelmingly common case) → empty body,
+                    // Claude ends the turn normally — no stop_hook_active loop possible.
+                    const directive = claudeSid ? takeDirective(claudeSid) : undefined;
+                    if (claudeSid)
+                        clearStop(claudeSid); // turn ended — a pending soft-stop is moot
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    if (directive) {
+                        debug('daemon', `Stop hook delivering queued directive for ${claudeSid}: "${directive.slice(0, 60)}"`);
+                        res.end(JSON.stringify({
+                            decision: 'block',
+                            reason: `The user sent this follow-up from their AgentDeck controller: "${directive}". Carry out this instruction now.`,
+                        }));
+                        core.broadcastSessionsList().catch(() => { });
+                    }
+                    else {
+                        res.end('');
+                    }
+                }
                 else {
                     res.writeHead(200, { 'Content-Type': 'application/json' });
                     res.end(JSON.stringify({ received: true }));
@@ -1358,6 +1518,26 @@ export async function startDaemon(opts) {
             });
             return;
         }
+        // OpenCode observer-plugin steering: the plugin long-polls here and
+        // executes returned commands via its in-process SDK client (abort /
+        // prompt). See bridge/src/opencode-steering.ts.
+        if (req.method === 'GET' && pathname === '/opencode/commands') {
+            const sid = parsedUrl.searchParams.get('sid') ?? '';
+            if (!sid) {
+                res.writeHead(400, { 'Content-Type': 'application/json' });
+                res.end(JSON.stringify({ error: 'sid required' }));
+                return;
+            }
+            const waitMs = Math.round(Number(parsedUrl.searchParams.get('wait') ?? '25') * 1000);
+            pollOpenCodeCommands(sid, waitMs).then((commands) => {
+                try {
+                    res.writeHead(200, { 'Content-Type': 'application/json' });
+                    res.end(JSON.stringify({ commands }));
+                }
+                catch { /* client disconnected */ }
+            });
+            return;
+        }
         if (req.method === 'POST' && pathname === '/shutdown') {
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ status: 'shutting_down' }));
@@ -1544,6 +1724,13 @@ export async function startDaemon(opts) {
         return prepareForSerial(event);
     });
     // Timeline
+    //
+    // The daemon owns timeline persistence: every surface's entries flow through
+    // it, so it is the only process positioned to hold the complete history and
+    // the only one allowed to write the file. Reads still sweep every candidate
+    // data dir (`latestTimelinePath`) so a Node daemon can pick up where a Swift
+    // daemon left off, and vice versa — the two implementations share one
+    // on-disk format.
     const bridgeLogStream = new BridgeLogStream();
     core.wireTimeline(bridgeLogStream);
     const timelinePath = latestTimelinePath();
@@ -1556,7 +1743,22 @@ export async function startDaemon(opts) {
         const reaped = core.bridgeTimeline.reapOrphanTaskStarts();
         if (reaped > 0)
             log(`[agentdeck] Closed ${reaped} orphaned task_start rows as interrupted`);
+        // Same for chat turns: a session killed mid-turn (no Stop / SessionEnd)
+        // leaves its chat_start spinning "in progress" on every surface. Runs
+        // DELAYED (5 min) so live sessions have posted a hook and registered in
+        // `hookSessionsSeen` — only stale rows (30 min+) of sessions that stayed
+        // silent since startup close; a live long-running turn is untouched and
+        // its real Stop still lands normally.
+        const chatReaperTimer = setTimeout(() => {
+            const reapedTurns = core.bridgeTimeline.reapOrphanChatStarts(undefined, undefined, hookSessionsSeen);
+            if (reapedTurns > 0)
+                log(`[agentdeck] Closed ${reapedTurns} orphaned chat_start rows as interrupted`);
+        }, 5 * 60_000);
+        chatReaperTimer.unref?.();
     }
+    // Enabled AFTER rehydration + reaping so the first write carries the restored
+    // history instead of truncating the file to whatever this run has seen.
+    core.bridgeTimeline.enablePersistence(getOwnTimelineFile());
     core.wireDisplayMonitor();
     let lastStateEvent = null;
     let userFocusedSessionId = null;
@@ -1718,11 +1920,12 @@ export async function startDaemon(opts) {
             };
         }
         const ulanziPluginConnected = core.wsServer.getUlanziClientCount() > 0;
-        modules.d200h = {
-            connected: ulanziPluginConnected,
-            externalOwner: ulanziPluginConnected,
-            managerOpened: ulanziPluginConnected,
-        };
+        if (ulanziPluginConnected) {
+            modules.d200h = {
+                connected: true,
+                driver: 'ulanzi-plugin',
+            };
+        }
         return modules;
     };
     core.setModuleHealthProvider(moduleHealthProvider);
@@ -1744,9 +1947,10 @@ export async function startDaemon(opts) {
             events.push(buildDisplayStateEvent(core.displayMonitor.isDisplayOn()));
             // Seed the last few timeline entries so a freshly (re)connected board's
             // ticker shows the real latest event instead of whatever its ring last
-            // held. Kept to 3 entries — the whole line must stay well under the
-            // small serial RX buffers on non-InkDeck boards.
-            const recent = core.bridgeTimeline.getHistory().slice(-3);
+            // held. Kept to 6 entries — the whole line must stay well under the
+            // small (4KB) serial RX buffers on non-InkDeck boards; prepareForSerial
+            // byte-caps each entry's raw/detail at send time.
+            const recent = core.bridgeTimeline.getHistory().slice(-6);
             if (recent.length > 0) {
                 events.push({ type: 'timeline_history', entries: recent });
             }
@@ -1874,15 +2078,33 @@ export async function startDaemon(opts) {
         // the 5s-throttled observer, so a Notification arriving mid-window still
         // surfaces within one frame. Key = the Claude session UUID embedded in
         // `observed:claude:<uuid>`.
-        const observed = applyAwaitingOverlayToObserved(passiveSessionObserver.collect(sessions));
+        const observed = applyAwaitingOverlayToObserved(passiveSessionObserver.collect(sessions))
+            .map((s) => {
+            // Steering feedback for observed Claude sessions: devices render
+            // "stopping at next tool" / queued-directive badges from these.
+            if (!s.id.startsWith('observed:claude:'))
+                return s;
+            const snap = steeringSnapshot(s.id.slice('observed:claude:'.length));
+            if (!snap.stopRequested && snap.queuedDirectives === 0)
+                return s;
+            return {
+                ...s,
+                ...(snap.stopRequested ? { stopRequested: true } : {}),
+                ...(snap.queuedDirectives > 0 ? { queuedDirectives: snap.queuedDirectives } : {}),
+            };
+        });
         // Derive per-session elapsed seconds from startedAt so NTP-less devices
         // (ESP32 IPS10 mosaic) render an elapsed value per cell without a wall clock.
         const now = Date.now();
         const enrichedSessions = [...sessions, ...observed].map((s) => {
-            if (s.elapsedSec != null || !s.startedAt)
-                return s;
-            const sec = Math.round((now - Date.parse(s.startedAt)) / 1000);
-            return Number.isFinite(sec) && sec >= 0 ? { ...s, elapsedSec: sec } : s;
+            // On-demand review badge (REVIEW tile verdict / REVIEWING state) —
+            // applies to every session type, managed included.
+            const review = reviewSnapshot(s.id);
+            const withReview = Object.keys(review).length > 0 ? { ...s, ...review } : s;
+            if (withReview.elapsedSec != null || !withReview.startedAt)
+                return withReview;
+            const sec = Math.round((now - Date.parse(withReview.startedAt)) / 1000);
+            return Number.isFinite(sec) && sec >= 0 ? { ...withReview, elapsedSec: sec } : withReview;
         });
         // SSOT: inject iff Gateway is authenticated (gatewayConnected). Reachability
         // / adapter-liveness alone must not materialize a session — that kept a
@@ -2268,6 +2490,36 @@ export async function startDaemon(opts) {
         }
         return false; // not consumed — pass to command handler
     });
+    // Steering commands for observed (hook-only, no PTY) Claude sessions —
+    // shared by the session_command route and the bare-command fallback below.
+    // Semantics differ from managed PTY on purpose:
+    //   interrupt/escape → soft STOP (deny at the next tool call)
+    //   send_prompt      → queued, delivered when the current turn ends
+    //   respond/select_option → resolve an open device-approval gate
+    function handleObservedClaudeCommand(uuid, command) {
+        const type = typeof command?.type === 'string' ? command.type : '';
+        if (type === 'interrupt' || type === 'escape') {
+            requestStop(uuid);
+            core.broadcastSessionsList().catch(() => { });
+            return;
+        }
+        if (type === 'send_prompt' && typeof command.text === 'string') {
+            if (queueDirective(uuid, command.text))
+                core.broadcastSessionsList().catch(() => { });
+            return;
+        }
+        if (type === 'respond' || type === 'select_option') {
+            const ov = getAwaitingOverlay(uuid);
+            if (ov?.requestId) {
+                const allow = type === 'select_option'
+                    ? command.index === 0
+                    : command.value === 'y' || command.value === 'yes';
+                resolvePending(ov.requestId, allow ? 'allow' : 'deny');
+            }
+            return;
+        }
+        debug('daemon', `observed steering: unsupported command ${type} for ${uuid}`);
+    }
     core.wsServer.onCommand((cmd) => {
         debug('daemon', `cmd: ${cmd.type}`);
         if (gatewayAdapter?.isAlive() && gatewayAdapter.handleCommand(cmd)) {
@@ -2336,12 +2588,76 @@ export async function startDaemon(opts) {
             broadcastFocusedState();
             return;
         }
+        // Independent on-demand review (REVIEW deck button): judge the session's
+        // working-tree delta with an independent model. Valid for every session
+        // type — no agent control involved. Result: WS events + badge fields +
+        // HTML report opened in the browser (this daemon's "popup" tier).
+        if (cmd.type === 'review_run') {
+            const sessionId = cmd.sessionId;
+            if (!sessionId)
+                return;
+            const managed = listActiveSessions().find(s => s.id === sessionId);
+            const observed = managed ? undefined
+                : passiveSessionObserver.collect([]).find(s => s.id === sessionId);
+            const target = (managed ?? observed);
+            // cwd sources: observed rows carry it from the process scan; managed
+            // registry rows don't — fall back to the session's APME run projectPath.
+            const cwd = (typeof target?.cwd === 'string' && target.cwd) ? target.cwd
+                : (apme ? (() => {
+                    const runId = apme.collector.getRunId(sessionId);
+                    return runId ? apme.store.getRun(runId)?.projectPath ?? undefined : undefined;
+                })() : undefined);
+            // Recent request↔response lines so the judge evaluates the diff
+            // against what the user actually asked (not just code in isolation).
+            const recentActivity = core.bridgeTimeline.getHistoryForSession(sessionId, undefined, 16)
+                .filter((e) => e.type === 'chat_start' || e.type === 'chat_response')
+                .map((e) => `${e.type === 'chat_start' ? 'USER' : 'AGENT'}: ${e.raw}`)
+                .join('\n');
+            void runSessionReview({
+                sessionId,
+                cwd,
+                projectName: target?.projectName ?? cwd?.split('/').filter(Boolean).pop() ?? 'unknown',
+                recentActivity,
+                onEvent: (event) => {
+                    core.wsServer.broadcast(event);
+                    core.broadcastSessionsList().catch(() => { }); // badge refresh
+                },
+                recordEval: apme ? (record) => {
+                    // Record into the same eval store as the automatic pipeline,
+                    // flagged `manual_review`, on the session's active task (if any).
+                    const runId = apme.collector.getRunId(sessionId);
+                    const taskId = apme.collector.getActiveTaskId(sessionId);
+                    if (!runId || !taskId)
+                        return;
+                    apme.store.insertEvalForTask({
+                        runId, taskId, layer: 'manual_review', metric: 'risk',
+                        score: record.score, raw: record.raw,
+                        judgeModel: record.judgeModel, createdAt: Date.now(),
+                    });
+                } : undefined,
+            });
+            core.broadcastSessionsList().catch(() => { }); // REVIEWING tile
+            return;
+        }
         // Device approval for a gated PreToolUse permission request (observed session).
         // Resolves the held hook HTTP response → Claude allows/denies the tool.
         if (cmd.type === 'permission_decision') {
             const { requestId, decision } = cmd;
             if (typeof requestId !== 'string' || (decision !== 'allow' && decision !== 'deny'))
                 return;
+            // OpenCode permission (requestId = "ocperm:<rawSid>:<permissionID>"):
+            // route through the observer-plugin queue; the plugin resolves it via
+            // POST /session/{id}/permissions/{permissionID}.
+            if (requestId.startsWith('ocperm:')) {
+                const rest = requestId.slice('ocperm:'.length);
+                const sep = rest.indexOf(':');
+                if (sep > 0) {
+                    enqueueOpenCodeCommand(rest.slice(0, sep), {
+                        type: 'permission_respond', permissionId: rest.slice(sep + 1), response: decision,
+                    });
+                }
+                return;
+            }
             // resolvePending → onResolved clears the overlay + rebroadcasts (sessions_list
             // + focused state), so all surfaces drop the gate. No-op if already resolved.
             resolvePending(requestId, decision);
@@ -2352,6 +2668,26 @@ export async function startDaemon(opts) {
             const { sessionId, command } = cmd;
             if (!sessionId || !command)
                 return;
+            // Observed Claude sessions have no bridge/PTY — route to the hook-based
+            // steering primitives instead (soft STOP, turn-end directive queue,
+            // gate approval). This replaces the old silent drop.
+            if (typeof sessionId === 'string' && sessionId.startsWith('observed:claude:')) {
+                handleObservedClaudeCommand(sessionId.slice('observed:claude:'.length), command);
+                return;
+            }
+            // Observed OpenCode sessions steer directly through the observer
+            // plugin's command queue (immediate abort / prompt injection).
+            if (typeof sessionId === 'string' && (sessionId.startsWith('opencode:') || sessionId.startsWith('observed:opencode:'))) {
+                const rawSid = sessionId.replace(/^(?:observed:)?opencode:/, '');
+                const type = typeof command?.type === 'string' ? command.type : '';
+                if (type === 'interrupt' || type === 'escape') {
+                    enqueueOpenCodeCommand(rawSid, { type: 'interrupt' });
+                }
+                else if (type === 'send_prompt' && typeof command.text === 'string') {
+                    enqueueOpenCodeCommand(rawSid, { type: 'send_prompt', text: command.text });
+                }
+                return;
+            }
             const sessions = listActiveSessions();
             const target = sessions.find(s => s.id === sessionId);
             if (!target) {
@@ -2384,6 +2720,15 @@ export async function startDaemon(opts) {
         if (focusRelay.getFocusedSessionId() && focusRelay.routeCommand(cmd)) {
             return;
         }
+        // Bare-command fallback for an observed-focused session: older device
+        // clients send unwrapped commands after focus_session. The focus relay
+        // can't route them (no bridge), so map them to the steering primitives
+        // instead of dropping them silently.
+        if (userFocusedSessionId?.startsWith('observed:claude:')
+            && ['interrupt', 'escape', 'send_prompt', 'respond', 'select_option'].includes(cmd.type)) {
+            handleObservedClaudeCommand(userFocusedSessionId.slice('observed:claude:'.length), cmd);
+            return;
+        }
         if (cmd.type === 'query_usage') {
             fetchUsageRelayed(port).then((usage) => {
                 if (usage)
@@ -2617,6 +2962,9 @@ export async function startDaemon(opts) {
         voiceAssistant?.stop();
         voiceManager?.disconnectFromServer();
         bridgeLogStream.stop();
+        // Flush synchronously — the process exits a few lines below and a pending
+        // debounce timer would take the last turn's entries with it.
+        core.bridgeTimeline.stopPersistence();
         // iDotMatrix BLE sync is stopped by IDotMatrixModule.stop() via stopModules below.
         await Promise.all([
             gatewayAdapter ? gatewayAdapter.shutdown().catch(() => { }) : Promise.resolve(),