@agentdeck/bridge 1.0.24 → 1.2.0

package/dist/pairing-knocks.js

@@ -0,0 +1,312 @@
+/**
+ * Who tried to connect, and who the operator let in — the Node daemon's half
+ * of the operator-approval credential path (`PairingKnockStore.swift`).
+ *
+ * The daemon already knew everything this needs: it refuses an unauthenticated
+ * LAN peer at the WebSocket handshake and logs the address. What it did not do
+ * was tell anyone. So a device with no credential retried forever into a log
+ * nobody reads, while every way to give it a credential asked the DEVICE to do
+ * something — scan a QR, type six digits, type a 32-character token. An e-ink
+ * reader can do none of them comfortably, and one with no camera cannot do the
+ * first at all.
+ *
+ * Turning the refusal into a prompt inverts that: the device does nothing, and
+ * the operator — who is holding the machine — approves a peer they can see.
+ * That is also the stronger of the two trust models. A pairing code trusts
+ * whoever knows a secret, so anyone in range may guess at it while the window
+ * is open; an approval trusts a specific peer the operator pointed at, and an
+ * attacker cannot approve themselves.
+ *
+ * This file is the Node parity port. It is deliberately a near-transliteration
+ * of the Swift store rather than a re-derivation: both daemons take turns
+ * owning port 9120 and they read each other's state, so a rule that is restated
+ * in this file's own words is a rule that can drift. The properties below are
+ * the ones that must hold in both.
+ *
+ * **Identity is the device id when the client sends one, and the address only
+ * when it does not.** The refusal happens at the HTTP upgrade, before any frame
+ * — `client_register`, where a device says its name, arrives only after a
+ * socket exists — so the daemon must learn who this is from the handshake
+ * itself. A client that sends `x-agentdeck-device` is approved as that device:
+ * two devices behind one NAT are told apart, a DHCP lease change does not
+ * retire the grant, and one device can be revoked without touching the token
+ * the whole fleet shares.
+ *
+ * The address remains the key for clients that send no id, and that path must
+ * keep working: every device already in the field predates the header, and
+ * refusing them would turn an upgrade into a fleet-wide outage. An IP-keyed
+ * approval carries the old caveats — it retires when the lease changes, and
+ * behind NAT it is not an identity at all — so a row says which kind it is
+ * instead of letting the two read alike.
+ *
+ * Neither kind is proof. The link is plaintext `ws://`, so a device id in the
+ * handshake is replayable by a passive observer on the same segment — exactly
+ * as true of the `?token=` every paired device already carries. This is no
+ * weaker than what ships today; it buys granularity and revocation, not
+ * secrecy.
+ *
+ * **A claimed name is never identity.** Nothing here reads one. If a name is
+ * ever surfaced it must sit beside the address, never instead of it.
+ *
+ * **Bounded, and expired on read.** A hostile peer must not be able to grow
+ * this list without limit, so it is capped and the oldest knock is dropped —
+ * which does mean a flood can push a real device out of view, and the cap is
+ * chosen high enough that a human notices the flood first. Expiry is evaluated
+ * when the list is read, never by a timer: a timer that fires late on a
+ * sleeping laptop would keep a stale knock alive past its promise, exactly as
+ * in `pairing-window.ts`.
+ */
+import { readFileSync, writeFileSync, renameSync, unlinkSync, mkdirSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { normalizeDeviceId } from '@agentdeck/shared';
+import { debug } from './logger.js';
+/**
+ * A knock is worth showing for this long after its last attempt. Long enough
+ * that the operator can walk to the machine; short enough that a device carried
+ * out of the building stops being offered.
+ */
+export const KNOCK_TTL_MS = 15 * 60_000;
+/** Cap on simultaneously-tracked peers. */
+export const MAX_KNOCKS = 12;
+/**
+ * The one place a key is spelled, so the gate, the store and the UI cannot
+ * disagree about what "this peer" means.
+ */
+export function peerKey(ip, deviceId) {
+    const normalized = normalizeDeviceId(deviceId);
+    if (normalized)
+        return `device:${normalized}`;
+    return `ip:${ip}`;
+}
+function deviceIdOfKey(key) {
+    return key.startsWith('device:') ? key.slice('device:'.length) : null;
+}
+/**
+ * Every other module resolves its state through
+ * `AGENTDECK_DATA_DIR || ~/.agentdeck`; mirror that here rather than hardcoding
+ * the home path, or a daemon started with a custom data dir would keep its
+ * approvals somewhere else than the rest of its state.
+ */
+function dataDir() {
+    return process.env.AGENTDECK_DATA_DIR || join(homedir(), '.agentdeck');
+}
+function approvalsFile() {
+    return join(dataDir(), 'pairing-approved.json');
+}
+/** Cached per resolved directory, so pointing AGENTDECK_DATA_DIR elsewhere re-reads. */
+let cache = null;
+const pending = new Map();
+/**
+ * Read a timestamp written by either daemon.
+ *
+ * The two encode `approvedAt` differently — this file writes epoch ms, while
+ * Swift's `JSONEncoder` default writes a Foundation reference-date Double
+ * (seconds since 2001-01-01). The files do not collide today, because the
+ * sandboxed app keeps its copy inside its container and this one lives in
+ * `~/.agentdeck`. But the two daemons take turns owning port 9120, and the day
+ * those paths converge a silent misread would date every approval to 1970 or to
+ * the far future — so accept both now, by magnitude, rather than discovering it
+ * as a bug later. A reference-date value for any plausible date is < 1e11;
+ * epoch ms is > 1e12.
+ */
+const FOUNDATION_REFERENCE_EPOCH_MS = 978_307_200_000; // 2001-01-01T00:00:00Z
+function toEpoch(value) {
+    if (typeof value === 'number' && Number.isFinite(value)) {
+        if (Math.abs(value) < 1e11)
+            return Math.round(value * 1000) + FOUNDATION_REFERENCE_EPOCH_MS;
+        return value;
+    }
+    if (typeof value === 'string') {
+        const parsed = Date.parse(value);
+        if (!Number.isNaN(parsed))
+            return parsed;
+    }
+    return 0;
+}
+function loadApprovals() {
+    const dir = dataDir();
+    if (cache && cache.dir === dir)
+        return cache.approved;
+    const table = new Map();
+    let raw = null;
+    try {
+        raw = readFileSync(approvalsFile(), 'utf8');
+    }
+    catch {
+        // No file yet is the common case: nobody has been approved.
+        cache = { dir, approved: table };
+        return table;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // Unparseable is NOT "nobody is approved" — see the migration note below.
+        // We cannot recover rows from it, but we must not overwrite the file
+        // either, so leave it on disk untouched for the operator to inspect.
+        debug('Pair', 'approvals file is unparseable; treating as empty without overwriting it');
+        cache = { dir, approved: table };
+        return table;
+    }
+    if (Array.isArray(parsed)) {
+        for (const row of parsed) {
+            if (!row || typeof row !== 'object')
+                continue;
+            const r = row;
+            if (typeof r.key === 'string' && r.key.length > 0) {
+                table.set(r.key, {
+                    key: r.key,
+                    lastIP: typeof r.lastIP === 'string' ? r.lastIP : '',
+                    approvedAt: toEpoch(r.approvedAt),
+                    deviceId: deviceIdOfKey(r.key),
+                });
+                continue;
+            }
+            // Migrate rather than discard. A decode that merely fails reads as
+            // "nobody is approved", which silently un-pairs every device the operator
+            // already let in — the same failure the tmp+rename below exists to
+            // prevent, arriving through the schema instead of the disk.
+            const legacy = row;
+            if (typeof legacy.ip === 'string' && legacy.ip.length > 0) {
+                const key = `ip:${legacy.ip}`;
+                table.set(key, {
+                    key,
+                    lastIP: legacy.ip,
+                    approvedAt: toEpoch(legacy.approvedAt),
+                    deviceId: null,
+                });
+            }
+        }
+    }
+    cache = { dir, approved: table };
+    return table;
+}
+function persist(approved) {
+    const rows = [...approved.values()].sort((a, b) => a.approvedAt - b.approvedAt);
+    const path = approvalsFile();
+    const tmp = `${path}.tmp`;
+    try {
+        mkdirSync(dataDir(), { recursive: true });
+        // tmp+rename, as everywhere else that writes the data dir: a truncated
+        // approvals file reads as "nobody is approved" and silently locks the whole
+        // fleet out.
+        writeFileSync(tmp, JSON.stringify(rows, null, 2), { mode: 0o600 });
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch { /* nothing to clean up */ }
+        debug('Pair', `failed to persist approvals: ${String(err)}`);
+    }
+}
+function evictIfNeeded() {
+    if (pending.size <= MAX_KNOCKS)
+        return;
+    const ordered = [...pending.values()].sort((a, b) => a.lastSeen - b.lastSeen);
+    for (const knock of ordered.slice(0, pending.size - MAX_KNOCKS)) {
+        pending.delete(knock.key);
+    }
+}
+/**
+ * Called from the refusal path. Cheap on purpose — it runs for every rejected
+ * handshake, and a looping device produces one every few seconds.
+ */
+export function recordKnock(ip, deviceId, staleToken, now = Date.now()) {
+    if (!ip)
+        return;
+    const normalized = normalizeDeviceId(deviceId);
+    const key = peerKey(ip, normalized);
+    if (loadApprovals().has(key))
+        return; // already let in; not a knock
+    const existing = pending.get(key);
+    if (existing) {
+        existing.attempts += 1;
+        existing.lastSeen = now;
+        existing.staleToken = staleToken;
+        return;
+    }
+    pending.set(key, {
+        key,
+        ip,
+        deviceId: normalized,
+        attempts: 1,
+        firstSeen: now,
+        lastSeen: now,
+        staleToken,
+        deviceScoped: normalized !== null,
+    });
+    evictIfNeeded();
+}
+/** Live knocks, newest first. Expiry is applied here — see the header. */
+export function pairingKnocks(now = Date.now()) {
+    for (const [key, knock] of pending) {
+        if (now - knock.lastSeen >= KNOCK_TTL_MS)
+            pending.delete(key);
+    }
+    return [...pending.values()].sort((a, b) => b.lastSeen - a.lastSeen);
+}
+/**
+ * Drop a knock without approving it. Not a block: the peer may knock again,
+ * which is deliberate — a permanent denylist keyed on an address a stranger can
+ * change is security theatre, and it would silently strand a real device that
+ * later inherits that address.
+ */
+export function dismissKnock(key) {
+    return pending.delete(key);
+}
+/**
+ * Approving is what a pairing code would have done, minus the typing: from here
+ * on this peer authenticates by its key. Persisted immediately.
+ */
+export function approvePeer(key, now = Date.now()) {
+    if (!key)
+        return false;
+    const approved = loadApprovals();
+    const lastIP = pending.get(key)?.ip ?? approved.get(key)?.lastIP ?? '';
+    approved.set(key, { key, lastIP, approvedAt: now, deviceId: deviceIdOfKey(key) });
+    pending.delete(key);
+    persist(approved);
+    return true;
+}
+export function revokePeer(key) {
+    const approved = loadApprovals();
+    if (!approved.delete(key))
+        return false;
+    persist(approved);
+    return true;
+}
+/**
+ * The question the WebSocket gate asks.
+ *
+ * A device id wins when the client sent one; the address is consulted only as
+ * the legacy path, so a client that adopts the header stops depending on its
+ * address the moment it does. Both are checked rather than one, because a
+ * device approved by address before it learned to send an id must not be locked
+ * out by the upgrade that taught it.
+ */
+export function isApprovedPeer(ip, deviceId) {
+    const approved = loadApprovals();
+    const normalized = normalizeDeviceId(deviceId);
+    if (normalized && approved.has(`device:${normalized}`))
+        return true;
+    if (!ip)
+        return false;
+    return approved.has(`ip:${ip}`);
+}
+export function pairingApprovals() {
+    return [...loadApprovals().values()].sort((a, b) => b.approvedAt - a.approvedAt);
+}
+/** Read the device id a client offered on the handshake, if any. */
+export function deviceIdFromHeaders(headers, headerName) {
+    const raw = headers?.[headerName];
+    return normalizeDeviceId(Array.isArray(raw) ? raw[0] : raw);
+}
+export function resetPairingKnocksForTests() {
+    pending.clear();
+    cache = null;
+}
+//# sourceMappingURL=pairing-knocks.js.map

package/dist/pairing-knocks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing-knocks.js","sourceRoot":"","sources":["../src/pairing-knocks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,EAAE,GAAG,MAAM,CAAC;AAExC,2CAA2C;AAC3C,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAoC7B;;;GAGG;AACH,MAAM,UAAU,OAAO,CAAC,EAAU,EAAE,QAAiB;IACnD,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU;QAAE,OAAO,UAAU,UAAU,EAAE,CAAC;IAC9C,OAAO,MAAM,EAAE,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,SAAS,OAAO;IACd,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAClD,CAAC;AAED,wFAAwF;AACxF,IAAI,KAAK,GAAmE,IAAI,CAAC;AACjF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;AAQhD;;;;;;;;;;;;GAYG;AACH,MAAM,6BAA6B,GAAG,eAAe,CAAC,CAAC,uBAAuB;AAE9E,SAAS,OAAO,CAAC,KAAc;IAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,6BAA6B,CAAC;QAC5F,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;IAC3C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa;IACpB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,IAAI,KAAK,CAAC,GAAG,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;IAEtD,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,IAAI,GAAG,GAAkB,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;QAC5D,KAAK,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,qEAAqE;QACrE,qEAAqE;QACrE,KAAK,CAAC,MAAM,EAAE,yEAAyE,CAAC,CAAC;QACzF,KAAK,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,SAAS;YAC9C,MAAM,CAAC,GAAG,GAA8B,CAAC;YACzC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAClD,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;oBACf,GAAG,EAAE,CAAC,CAAC,GAAG;oBACV,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;oBACpD,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;oBACjC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;iBAC/B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,mEAAmE;YACnE,0EAA0E;YAC1E,mEAAmE;YACnE,4DAA4D;YAC5D,MAAM,MAAM,GAAG,GAAgC,CAAC;YAChD,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,CAAC;gBAC9B,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE;oBACb,GAAG;oBACH,MAAM,EAAE,MAAM,CAAC,EAAE;oBACjB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;oBACtC,QAAQ,EAAE,IAAI;iBACf,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,OAAO,CAAC,QAAsC;IACrD,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,MAAM,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,uEAAuE;QACvE,4EAA4E;QAC5E,aAAa;QACb,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;QAC5D,KAAK,CAAC,MAAM,EAAE,gCAAgC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,SAAS,aAAa;IACpB,IAAI,OAAO,CAAC,IAAI,IAAI,UAAU;QAAE,OAAO;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC9E,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC;QAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,EAAU,EACV,QAAiB,EACjB,UAAmB,EACnB,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAEhB,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACpC,IAAI,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,8BAA8B;IAEpE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,IAAI,CAAC,CAAC;QACvB,QAAQ,CAAC,QAAQ,GAAG,GAAG,CAAC;QACxB,QAAQ,CAAC,UAAU,GAAG,UAAU,CAAC;QACjC,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE;QACf,GAAG;QACH,EAAE;QACF,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,GAAG;QACd,QAAQ,EAAE,GAAG;QACb,UAAU;QACV,YAAY,EAAE,UAAU,KAAK,IAAI;KAClC,CAAC,CAAC;IACH,aAAa,EAAE,CAAC;AAClB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,IAAI,GAAG,GAAG,KAAK,CAAC,QAAQ,IAAI,YAAY;YAAE,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,EAAE,CAAC;IACvE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,QAAiB;IAC1D,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IACjC,MAAM,UAAU,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,UAAU,IAAI,QAAQ,CAAC,GAAG,CAAC,UAAU,UAAU,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,CAAC,GAAG,aAAa,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;AACnF,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CACjC,OAAkE,EAClE,UAAkB;IAElB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;IAClC,OAAO,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,KAAK,GAAG,IAAI,CAAC;AACf,CAAC"}

package/dist/passive-observer.d.ts

@@ -26,6 +26,8 @@ export interface CodexRolloutSummary extends TranscriptSummary {
     hasPendingCalls?: boolean;
     /** Internal companion rollouts never become top-level dashboard sessions. */
     isSubagent: boolean;
+    /** `codex-tui` for CLI, `Codex Desktop` for the desktop client. */
+    originator?: string;
 }
 /**
  * Condense a first user prompt into a one-line session goal: strip injected
@@ -53,6 +55,15 @@ export interface ObservedSession extends EnrichedSession {
      *  prompt is over. Absent when no transcript could be located. */
     lastActivityAt?: number;
 }
+/**
+ * A desktop app-server keeps rollout descriptors open for chats retained by
+ * the Codex App, including conversations that have not done work for days.
+ * An idle descriptor is therefore only a recent observation, not process
+ * liveness. Mirror the Swift daemon's `codexIdleObservationStaleTTL`: after
+ * this window the chat remains resumable in Codex, but leaves AgentDeck's
+ * active-session roster until its rollout changes again.
+ */
+export declare const CODEX_APP_IDLE_ROLLOUT_TTL_MS = 90000;
 export declare function observedStateAfterSilence(state: ObservedState, lastActivityAt: number | undefined, now?: number): ObservedState;
 interface CodexRolloutFileInfo {
     mtimeMs: number;
@@ -103,6 +114,15 @@ export declare class PassiveSessionObserver {
 export declare function parseProcessTable(output: string): ProcInfo[];
 export declare function parseClaudeTranscript(raw: string): TranscriptSummary;
 export declare function parseCodexRollout(raw: string): CodexRolloutSummary;
+export interface LocatedCodexRolloutSummary {
+    path: string;
+    mtimeMs: number;
+    summary: CodexRolloutSummary;
+}
+/** Locate and summarize a rollout by the stable id carried by lifecycle hooks.
+ * This path is independent of pid/fd enumeration, so it works on Windows and
+ * can distinguish desktop from TUI via session_meta.originator. */
+export declare function codexRolloutSummaryForSession(sessionId: string, sessionsRoot?: string): LocatedCodexRolloutSummary | null;
 export declare function collectProcessInfo(): Promise<ProcInfo[]>;
 /**
  * Parse `Win32_Process | ConvertTo-Json` output into the shared ProcInfo shape.
@@ -121,7 +141,7 @@ export declare function appNameFromCommand(command: string): string | undefined;
  *  tty, so the owning app is how the injector finds their UI. */
 export declare function resolveHostApp(pid: number, byPid: Map<number, ProcInfo>, maxDepth?: number): string | undefined;
 /** Testable async projection from open rollout paths to top-level sessions. */
-export declare function collectCodexSessionsFromRollouts(processes: ProcInfo[], rolloutsByPid: Map<number, string[]>, rolloutCache: CodexRolloutCache): Promise<ObservedSession[]>;
+export declare function collectCodexSessionsFromRollouts(processes: ProcInfo[], rolloutsByPid: Map<number, string[]>, rolloutCache: CodexRolloutCache, now?: number): Promise<ObservedSession[]>;
 /**
  * A Codex process that can own a user session.
  *

package/dist/passive-observer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passive-observer.d.ts","sourceRoot":"","sources":["../src/passive-observer.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAc/D,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;CACrB;AAgBD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7C;AASD,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;iDAC6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,UAAU,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;sEAIkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAQD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,aAAa,EACpB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,SAAa,GACf,aAAa,CAMf;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,sBAAuB,SAAQ,oBAAoB;IAC3D,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E;AAUD;;;;GAIG;AACH,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,OAAO,CAA6C;gBAExC,IAAI,GAAE,6BAAoE;IAExF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAsBpE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAMxC,IAAI,IAAI,IAAI,MAAM,CAA8B;CACjD;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,gBAAgB,CAA0B;IAElD;;0DAEsD;IACtD,WAAW,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAEtC;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE;YAYhD,IAAI;CAgBnB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAc5D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAoFpE;AAgCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAwHlE;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAY9D;AAwCD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CA2B7D;AAED;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED;;iEAEiE;AACjE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5B,QAAQ,SAAI,GACX,MAAM,GAAG,SAAS,CASpB;AAmDD,+EAA+E;AAC/E,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,QAAQ,EAAE,EACrB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACpC,YAAY,EAAE,iBAAiB,GAC9B,OAAO,CAAC,eAAe,EAAE,CAAC,CAiD5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGrE;AAwGD;;;;;;6DAM6D;AAC7D,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,QAAQ,EAAE,EACrB,SAAS,EAAE,mBAAmB,EAAE,EAChC,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,EACjD,GAAG,GAAE,MAAmB,GACvB,eAAe,EAAE,CAoEnB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsChE;AAED;gFACgF;AAChF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAoBxE;AASD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAehE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGvE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsBpE;AAED,mFAAmF;AACnF,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAwB7E;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EAAE,EAC3B,eAAe,EAAE,eAAe,EAAE,EAClC,SAAS,EAAE,QAAQ,EAAE,GACpB,eAAe,EAAE,CAkBnB;AAkGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAgBvE;AAwND;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAItE"}
+{"version":3,"file":"passive-observer.d.ts","sourceRoot":"","sources":["../src/passive-observer.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAc/D,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,mBAAmB,CAAC;AAG3B,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,aAAa,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,6EAA6E;IAC7E,UAAU,EAAE,OAAO,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAgBD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAU7C;AASD,MAAM,WAAW,eAAgB,SAAQ,eAAe;IACtD,+EAA+E;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;iDAC6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,UAAU,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;sEAIkE;IAClE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAOD;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,QAAS,CAAC;AAEpD,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,aAAa,EACpB,cAAc,EAAE,MAAM,GAAG,SAAS,EAClC,GAAG,SAAa,GACf,aAAa,CAMf;AAED,UAAU,oBAAoB;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,UAAU,sBAAuB,SAAQ,oBAAoB;IAC3D,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED,MAAM,WAAW,6BAA6B;IAC5C,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAClD,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3E;AAUD;;;;GAIG;AACH,qBAAa,iBAAiB;IAGhB,OAAO,CAAC,IAAI;IAFxB,OAAO,CAAC,OAAO,CAA6C;gBAExC,IAAI,GAAE,6BAAoE;IAExF,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC;IAsBpE,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI;IAMxC,IAAI,IAAI,IAAI,MAAM,CAA8B;CACjD;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,MAAM,CAAyB;IACvC,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,gBAAgB,CAA0B;IAElD;;0DAEsD;IACtD,WAAW,EAAE,CAAC,MAAM,IAAI,CAAC,GAAG,SAAS,CAAC;IAEtC;;;;;;;;OAQG;IACH,OAAO,CAAC,eAAe,EAAE,eAAe,EAAE,GAAG,eAAe,EAAE;YAYhD,IAAI;CAgBnB;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAc5D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,iBAAiB,CAoFpE;AAgCD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA2HlE;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,mBAAmB,CAAC;CAC9B;AAED;;mEAEmE;AACnE,wBAAgB,6BAA6B,CAC3C,SAAS,EAAE,MAAM,EACjB,YAAY,CAAC,EAAE,MAAM,GACpB,0BAA0B,GAAG,IAAI,CAWnC;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAY9D;AAwCD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,CA2B7D;AAED;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED;;iEAEiE;AACjE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC5B,QAAQ,SAAI,GACX,MAAM,GAAG,SAAS,CASpB;AAmDD,+EAA+E;AAC/E,wBAAsB,gCAAgC,CACpD,SAAS,EAAE,QAAQ,EAAE,EACrB,aAAa,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,EACpC,YAAY,EAAE,iBAAiB,EAC/B,GAAG,SAAa,GACf,OAAO,CAAC,eAAe,EAAE,CAAC,CAoD5B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGrE;AAwGD;;;;;;6DAM6D;AAC7D,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,QAAQ,EAAE,EACrB,SAAS,EAAE,mBAAmB,EAAE,EAChC,QAAQ,GAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAa,EACjD,GAAG,GAAE,MAAmB,GACvB,eAAe,EAAE,CAoEnB;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsChE;AAED;gFACgF;AAChF,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAoBxE;AASD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAehE;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAGvE;AAED,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAsBpE;AAED,mFAAmF;AACnF,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAwB7E;AAED,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EAAE,EAC3B,eAAe,EAAE,eAAe,EAAE,EAClC,SAAS,EAAE,QAAQ,EAAE,GACpB,eAAe,EAAE,CAkBnB;AAkGD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAgBvE;AAwND;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAItE"}

package/dist/passive-observer.js

@@ -13,6 +13,7 @@ import { stripUnsafeText, rawSessionId } from '@agentdeck/shared';
 import { isClaudeInterruptMessage } from './claude-interrupt-marker.js';
 import { parseAntigravityTranscript, antigravityDefaultModel, antigravityConversationId, antigravityTranscriptPath, } from './apme/antigravity-transcript.js';
 import { KiroSessionCache, readKiroNativeSessionSnapshots, } from './kiro-session.js';
+import { locateCodexRollout } from './codex-rollout-response.js';
 /** Pull display text out of a Claude user message (string or text blocks). */
 function claudeUserText(message) {
     if (!message)
@@ -50,6 +51,15 @@ const MAX_TAIL_BYTES = 512 * 1024;
 const MAX_SAMPLE_BYTES = 1024 * 1024;
 /** Transcript/rollout silence after which an end-event-less turn is presumed dead. */
 const STALE_TURN_MS = 10 * 60 * 1000;
+/**
+ * A desktop app-server keeps rollout descriptors open for chats retained by
+ * the Codex App, including conversations that have not done work for days.
+ * An idle descriptor is therefore only a recent observation, not process
+ * liveness. Mirror the Swift daemon's `codexIdleObservationStaleTTL`: after
+ * this window the chat remains resumable in Codex, but leaves AgentDeck's
+ * active-session roster until its rollout changes again.
+ */
+export const CODEX_APP_IDLE_ROLLOUT_TTL_MS = 90_000;
 export function observedStateAfterSilence(state, lastActivityAt, now = Date.now()) {
     return state === 'processing'
         && lastActivityAt !== undefined
@@ -295,6 +305,7 @@ export function parseCodexRollout(raw) {
     let lastContextTokens = 0;
     let contextWindow = 0;
     let isSubagent = false;
+    let originator;
     // A turn is in flight from task_started/user_message until task_complete/
     // turn_aborted. Mid-turn events (agent_message, function_call) must NOT end
     // it: most of a working turn is the thinking gap between a tool result and
@@ -313,6 +324,7 @@ export function parseCodexRollout(raw) {
                 continue;
             sessionId = stringAt(payload, 'id') ?? sessionId;
             cwd = stringAt(payload, 'cwd') ?? cwd;
+            originator = stringAt(payload, 'originator') ?? originator;
             startedAt = timestampMs(stringAt(payload, 'timestamp')) ?? startedAt;
             const source = payload.source;
             isSubagent = isSubagent || (isRecord(source) && 'subagent' in source);
@@ -404,6 +416,7 @@ export function parseCodexRollout(raw) {
     return {
         hasPendingCalls: pendingCalls.size > 0,
         isSubagent,
+        originator,
         sessionId,
         cwd,
         startedAt,
@@ -418,6 +431,24 @@ export function parseCodexRollout(raw) {
             : undefined,
     };
 }
+/** Locate and summarize a rollout by the stable id carried by lifecycle hooks.
+ * This path is independent of pid/fd enumeration, so it works on Windows and
+ * can distinguish desktop from TUI via session_meta.originator. */
+export function codexRolloutSummaryForSession(sessionId, sessionsRoot) {
+    const path = locateCodexRollout(sessionId, sessionsRoot);
+    if (!path)
+        return null;
+    try {
+        const stat = statSync(path);
+        const raw = readFileHeadAndTail(path, 256 * 1024, MAX_SAMPLE_BYTES);
+        if (!raw)
+            return null;
+        return { path, mtimeMs: stat.mtimeMs, summary: parseCodexRollout(raw) };
+    }
+    catch {
+        return null;
+    }
+}
 export async function collectProcessInfo() {
     if (process.platform === 'win32')
         return collectProcessInfoWin32();
@@ -578,7 +609,7 @@ async function collectCodexSessions(processes, rolloutCache) {
     return collectCodexSessionsFromRollouts(processes, rolloutsByPid, rolloutCache);
 }
 /** Testable async projection from open rollout paths to top-level sessions. */
-export async function collectCodexSessionsFromRollouts(processes, rolloutsByPid, rolloutCache) {
+export async function collectCodexSessionsFromRollouts(processes, rolloutsByPid, rolloutCache, now = Date.now()) {
     const byPid = new Map(processes.map((p) => [p.pid, p]));
     const codex = processes.filter((p) => isCodexSessionProcessCommand(p.command));
     const activeRollouts = new Set();
@@ -598,15 +629,18 @@ export async function collectCodexSessionsFromRollouts(processes, rolloutsByPid,
                 continue;
             const parsed = snapshot.summary;
             let state = parsed.state;
-            if (state === 'processing' && !parsed.hasPendingCalls && Date.now() - snapshot.mtimeMs > STALE_TURN_MS) {
+            if (state === 'processing' && !parsed.hasPendingCalls && now - snapshot.mtimeMs > STALE_TURN_MS) {
                 state = 'idle';
             }
+            const desktop = proc.command.includes('app-server');
+            if (desktop && state === 'idle' && now - snapshot.mtimeMs > CODEX_APP_IDLE_ROLLOUT_TTL_MS) {
+                continue;
+            }
             const sessionId = parsed.sessionId ?? codexRolloutId(rollout);
             if (seen.has(sessionId))
                 continue;
             seen.add(sessionId);
             const cwd = parsed.cwd;
-            const desktop = proc.command.includes('app-server');
             sessions.push({
                 id: desktop ? `observed:codex-app:${sessionId}` : `observed:codex:${sessionId}`,
                 port: 0,