@clastres/groundcontrol 0.1.10 → 0.1.12

package/daemon.mjs

@@ -15,14 +15,14 @@ import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline';
-import { spawn, spawnSync, execFile, execSync } from 'node:child_process';
+import { spawn, spawnSync, execFile, execFileSync, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
-const VERSION = '0.1.10';
+const VERSION = '0.1.12';
 const PACKAGE = '@clastres/groundcontrol';
 
 // ---------- config / pairing ----------
@@ -558,8 +558,41 @@ const pairString = `groundcontrol://pair#${pairPayload}`;
 console.log('\n  GROUND CONTROL daemon');
 console.log(`  relay:   ${RELAY}  (phone will use: ${relayForPhone})`);
 console.log(`  channel: ${CHANNEL}\n`);
-qrcode.generate(pairString, { small: true });
-console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
+// The pairing code and the QR both carry the key itself. They are for a person
+// at a terminal. Anywhere else stdout is a file, the launchd service's is
+// daemon.log, and a log is the thing people paste into a bug report.
+if (subcommand === 'qr' || process.stdout.isTTY) {
+  qrcode.generate(pairString, { small: true });
+  console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
+} else {
+  console.log('  Pairing code hidden here. Show it with: npx @clastres/groundcontrol qr\n');
+}
+if (runsFromServiceDir) scrubLogSecrets();
+
+/// Versions up to 0.1.11 printed the pairing code and its QR into daemon.log
+/// on every start, and the log was readable by every account on the Mac.
+/// Take both out of the existing log and close the permissions. Rewritten in
+/// place rather than replaced: launchd holds the file open for appending, and
+/// a new file would leave it writing into one that no longer exists.
+function scrubLogSecrets() {
+  for (const f of [LOG_FILE, path.join(CONF_DIR, 'daemon.err.log')]) {
+    try { fs.chmodSync(f, 0o600); } catch {}
+  }
+  try { fs.chmodSync(CONF_DIR, 0o700); } catch {}
+  try {
+    const raw = fs.readFileSync(LOG_FILE, 'utf8');
+    // A real code, not the [removed] marker left by an earlier pass, so a
+    // clean log is read once per start and never rewritten.
+    const code = /groundcontrol:\/\/pair#[A-Za-z0-9_-]/;
+    const qrRow = /^[█▀▄ ]{20,}$/;
+    if (!code.test(raw) && !/^[█▀▄ ]{20,}$/m.test(raw)) return;
+    const clean = raw.split('\n')
+      .filter((line) => !qrRow.test(line))
+      .join('\n')
+      .replace(/groundcontrol:\/\/pair#[A-Za-z0-9_-]+/g, 'groundcontrol://pair#[removed]');
+    fs.writeFileSync(LOG_FILE, clean);
+  } catch {}
+}
 
 if (subcommand === 'qr') process.exit(0);
 
@@ -784,10 +817,14 @@ async function injectPrompt(tty, text) {
   const clean = text.replace(/\r?\n/g, ' ').trim();
 
   if (apps.tmuxPanes.has(dev)) {
+    // No shell in between. Phone text used to go through execSync inside
+    // double quotes, where backticks and $(...) still run, so "rename `foo`"
+    // executed foo on this Mac before the agent ever saw the prompt.
+    const pane = apps.tmuxPanes.get(dev);
     try {
-      execSync(`tmux send-keys -t '${apps.tmuxPanes.get(dev)}' -l ${JSON.stringify(clean)}`);
+      execFileSync('tmux', ['send-keys', '-t', pane, '-l', '--', clean], { stdio: 'ignore' });
       await sleep(150);
-      execSync(`tmux send-keys -t '${apps.tmuxPanes.get(dev)}' Enter`);
+      execFileSync('tmux', ['send-keys', '-t', pane, 'Enter'], { stdio: 'ignore' });
       return 'tmux';
     } catch {}
   }
@@ -867,7 +904,6 @@ function readMessages(sessionId, maxBytes = 512 * 1024, limit = 80) {
   // path.sep keeps the prefixes unambiguous: without it ~/.kimi would also
   // match every ~/.kimi-code path and routing would depend on check order.
   if (file.startsWith(CODEX_SESS_DIR + path.sep)) return readCodexMessages(file, maxBytes, limit);
-  if (file.startsWith(GROKBOT_DIR + path.sep)) return readGrokBotMessages(file, maxBytes, limit);
   if (file.startsWith(KIMICODE_DIR + path.sep)) return readKimiCodeMessages(file, maxBytes, limit);
   if (file.startsWith(KIMI_DIR + path.sep)) return readKimiLegacyMessages(file, maxBytes, limit);
   let raw;
@@ -996,6 +1032,15 @@ function codexMetaOf(file) {
         id: j.payload.session_id,
         cwd: j.payload.cwd || '',
         startedAt: Date.parse(j.payload.timestamp || j.timestamp) || 0,
+        // Codex spawns its own helpers (the review subagent, for one) as
+        // separate rollout files that carry the *parent's* session_id. Two
+        // files, one id: the phone would draw one pilot and leave a hole
+        // where the other should be, because both the crew list and the
+        // island key on the session id. A helper is not a pilot anyway, so
+        // it is marked here and dropped by the scan, which keeps the answer
+        // in the cache rather than re-reading a growing file every sweep.
+        helper: j.payload.thread_source === 'subagent'
+          || (!!j.payload.parent_thread_id && j.payload.parent_thread_id !== j.payload.id),
       };
     }
   } catch {}
@@ -1090,17 +1135,29 @@ function readCodexSessions() {
   codexCache.at = Date.now();
   const names = codexThreadNames();
   const sessions = [];
+  // One pilot per folder, not one per run.
+  //
+  // Codex has no long lived session the way Claude Code does: every `codex
+  // exec` writes its own rollout, so asking it to review a change three times
+  // in an afternoon used to put three identical pilots on the island, all in
+  // the same directory, none of them the one you meant. The freshest rollout
+  // in a folder is the one worth talking to, and prompting resumes it by id,
+  // so the older ones have nothing left to offer.
+  const newestPerCwd = new Map(); // cwd -> index into sessions
   for (const file of codexRolloutFiles()) {
     let mtime;
     try { mtime = fs.statSync(file).mtimeMs; } catch { continue; }
     if (Date.now() - mtime > CODEX_ACTIVE_WINDOW_MS) continue;
     const meta = codexMetaOf(file);
-    if (!meta) continue;
+    if (!meta || meta.helper) continue;
     const act = memoScan(`codex:${file}`, file, () => codexActivityOf(file));
     const busy = (act.busy || (!act.sawMarkers && Date.now() - mtime < 60_000))
       && Date.now() - mtime < CODEX_BUSY_STALE_MS;
+    const key = meta.cwd || `id:${meta.id}`;
+    const seen = newestPerCwd.get(key);
+    if (seen !== undefined && sessions[seen].updatedAt >= mtime) continue;
     transcriptCache.set(meta.id, file);
-    sessions.push({
+    const session = {
       id: meta.id,
       provider: 'codex',
       name: names.get(meta.id) || path.basename(meta.cwd || '?'),
@@ -1112,7 +1169,9 @@ function readCodexSessions() {
       lastMessage: act.lastMessage,
       tty: '',
       live: false,
-    });
+    };
+    if (seen !== undefined) sessions[seen] = session;
+    else { newestPerCwd.set(key, sessions.length); sessions.push(session); }
   }
   codexCache.sessions = sessions;
   return sessions;
@@ -1439,157 +1498,6 @@ function readKimiSessions() {
   return kimiCache.sessions;
 }
 
-// ---------- Grok Bot session discovery ----------
-// Grok Bot's agents run on a cloud VM, so unlike every other provider there is
-// nothing local to attach to: no process, no tty, no working directory, and no
-// way to send. What the desktop app does keep is a replica of what it has
-// synced, under ~/Library/Application Support/Grok Bot/sand-client-persistence,
-// one JSON blob per store key with the key base32 encoded into the filename.
-// Two keys matter:
-//   <account>.roster.last-roster        one row per Bot
-//   <account>.transcript.replicas.<id>  that Bot's conversation
-//
-// Read only, deliberately. The replica is the app's cache and not the source of
-// truth (that lives on the VM at /home/box/sand-data/agents/<id>/store.db), so
-// a message written in here is a message the app overwrites rather than sends.
-//
-// It also only advances while the desktop app is running. Bots keep working
-// with the app closed and the island cannot see it, so a Bot left mid turn is
-// the app having quit, not the Bot being stuck: busy expires on staleness the
-// same way the other journal-freshness providers do.
-
-const GROKBOT_DIR = path.join(os.homedir(), 'Library', 'Application Support', 'Grok Bot', 'sand-client-persistence');
-const GROKBOT_BUSY_STALE_MS = 5 * 60 * 1000;
-
-// RFC 4648 base32, lowercase and unpadded, which is how the app names blobs.
-// A name that is not one of ours decodes to junk and simply matches nothing,
-// so guessing wrong costs a string compare.
-const B32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
-function b32decode(name) {
-  let bits = 0;
-  let value = 0;
-  const out = [];
-  for (const ch of name.toLowerCase()) {
-    if (ch === '=') break;
-    const i = B32_ALPHABET.indexOf(ch);
-    if (i < 0) return '';
-    value = (value << 5) | i;
-    bits += 5;
-    if (bits >= 8) { out.push((value >>> (bits - 8)) & 0xff); bits -= 8; }
-  }
-  return Buffer.from(out).toString('utf8');
-}
-
-// The names are long and never change, so decode each one once.
-const grokbotKeys = new Map(); // filename -> decoded store key
-const grokbotKeyOf = (name) => {
-  if (!grokbotKeys.has(name)) grokbotKeys.set(name, b32decode(name.replace(/\.blob$/, '')));
-  return grokbotKeys.get(name);
-};
-
-const grokbotEntriesOf = (file) => {
-  const entries = readJson(file)?.value?.entries;
-  return Array.isArray(entries) ? entries : [];
-};
-
-// Two entry kinds carry a turn: a typed one is {kind:'message', role, content}
-// and a Bot one is {kind:'send-message', message:{type,content}}. Everything
-// else in the stream (tool calls, approvals, status) has no place in a phone
-// transcript.
-function grokbotMessages(entries, limit = 80) {
-  const out = [];
-  for (const e of entries) {
-    let role = null;
-    let text = '';
-    if (e?.kind === 'message' && (e.role === 'user' || e.role === 'assistant')) {
-      role = e.role;
-      text = typeof e.content === 'string' ? e.content : '';
-    } else if (e?.kind === 'send-message' && e.message?.type === 'text') {
-      role = 'assistant';
-      text = typeof e.message.content === 'string' ? e.message.content : '';
-    }
-    text = text.trim();
-    if (!role || !text) continue;
-    out.push({ role, text: text.slice(0, 4000), ts: isoOf(e.timestampMs) });
-  }
-  return out.slice(-limit);
-}
-
-// One JSON object rather than a journal, so the tail slice every other provider
-// reads with would just be a syntax error. Whole file, with a ceiling that only
-// exists so a pathological blob cannot stall the daemon.
-function readGrokBotMessages(file, maxBytes = 512 * 1024, limit = 80) {
-  try { if (fs.statSync(file).size > 8 * 1024 * 1024) return []; } catch { return []; }
-  return grokbotMessages(grokbotEntriesOf(file), limit);
-}
-
-function scanGrokBotSessions() {
-  const sessions = [];
-  let files = [];
-  try { files = fs.readdirSync(GROKBOT_DIR); } catch { return sessions; }
-
-  let rosterFile = null;
-  const transcripts = new Map(); // botId -> blob path
-  for (const name of files) {
-    if (!name.endsWith('.blob')) continue;
-    const key = grokbotKeyOf(name);
-    if (key.endsWith('.roster.last-roster')) rosterFile = path.join(GROKBOT_DIR, name);
-    else {
-      const m = key.match(/\.transcript\.replicas\.([0-9a-f-]{36})$/);
-      if (m) transcripts.set(m[1], path.join(GROKBOT_DIR, name));
-    }
-  }
-  const rows = rosterFile ? readJson(rosterFile)?.value?.rows : null;
-  if (!Array.isArray(rows)) return sessions;
-
-  for (const row of rows) {
-    // A Bot is a standing teammate rather than a session that ends, so the
-    // roster is mirrored as it stands: what the Grok Bot sidebar lists, the
-    // island shows.
-    if (!row?.id || row.isHiddenFromSidebar) continue;
-    const file = transcripts.get(row.id) || null;
-    const scan = file
-      ? memoScan(`grokbot:${file}`, file, () => {
-        const entries = grokbotEntriesOf(file);
-        return { messages: grokbotMessages(entries, 1), streaming: entries.some((e) => e?.isStreaming === true) };
-      })
-      : { messages: [], streaming: false };
-    let updatedAt = row.lastActivityAt || row.updatedAt || 0;
-    if (file) { try { updatedAt = Math.max(updatedAt, fs.statSync(file).mtimeMs); } catch {} }
-    const busy = scan.streaming && Date.now() - updatedAt < GROKBOT_BUSY_STALE_MS;
-    if (file) transcriptCache.set(row.id, file);
-    sessions.push({
-      id: row.id,
-      provider: 'grokbot',
-      name: row.name || 'Bot',
-      // Its working directory is on a machine that is not this one, and
-      // claiming otherwise would put a path on the island you cannot open.
-      cwd: '',
-      project: 'Grok Bot',
-      // awaitingUserResponse is how the app marks a Bot stopped on you, which
-      // is the same pink invader as a held permission request.
-      status: row.awaitingUserResponse ? 'waiting' : (busy ? 'busy' : 'idle'),
-      updatedAt,
-      startedAt: row.createdAt || 0,
-      lastMessage: scan.messages.length ? scan.messages[scan.messages.length - 1] : null,
-      tty: '',
-      live: false,
-      // Nothing reads this yet. It is what a build that greys out the compose
-      // box will key on, instead of re-deriving read-only from the provider.
-      readOnly: true,
-    });
-  }
-  return sessions;
-}
-
-let grokbotCache = { at: 0, sessions: [] };
-function readGrokBotSessions() {
-  if (Date.now() - grokbotCache.at < 10_000) return grokbotCache.sessions;
-  grokbotCache.at = Date.now();
-  grokbotCache.sessions = scanGrokBotSessions();
-  return grokbotCache.sessions;
-}
-
 /// The phone-facing shape of a held request.
 const askPayload = (ask, queued) => ({
   id: ask.id,
@@ -1601,7 +1509,7 @@ const askPayload = (ask, queued) => ({
 });
 
 function readSessions() {
-  const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions(), ...readGrokBotSessions()];
+  const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions()];
   const known = new Set(sessions.map((s) => s.id));
   for (const s of sessions) {
     const queue = askQueue.get(s.id);
@@ -1640,7 +1548,20 @@ function readSessions() {
   }
 
   sessions.sort((a, b) => a.startedAt - b.startedAt);
-  return sessions;
+  // One row per id, whatever the providers hand over.
+  //
+  // The phone keys every pilot on the session id: the crew list draws a
+  // ForEach over it and the island keeps one sprite per id. Two rows sharing
+  // one id do not draw twice, they draw once and leave a hole the height of a
+  // card where the other should be, which reads as a layout bug rather than
+  // as bad data. Codex was the source of that once already; this is here so
+  // the next provider that repeats an id cannot do it again.
+  const byId = new Map();
+  for (const s of sessions) {
+    const seen = byId.get(s.id);
+    if (!seen || (s.updatedAt || 0) > (seen.updatedAt || 0)) byId.set(s.id, s);
+  }
+  return byId.size === sessions.length ? sessions : sessions.filter((s) => byId.get(s.id) === s);
 }
 
 // ---------- remote approvals: runtime ----------
@@ -1685,6 +1606,8 @@ function hostState() {
 const bustHostCache = () => { hostCache.at = 0; };
 
 let approvalServerUp = false;
+let approvalServer = null;
+let approvalSocketIno = 0;   // which file at ASK_SOCKET is ours
 let availableUpdate = null;   // version string once a newer release is seen
 
 const pendingAsks = new Map();  // askId -> ask record
@@ -1821,6 +1744,9 @@ function onPermissionRequest(req, socket) {
     at: Date.now(),
     socket,
     done: false,
+    // Set once Claude Code has actually reported this session as waiting, so
+    // releaseAnsweredOnMac knows there was a prompt on the Mac to answer.
+    sawWaiting: false,
   };
   ask.holdTimer = setTimeout(
     () => settleAsk(ask, null, 'released', 'held too long, prompting on the Mac instead'),
@@ -1881,12 +1807,33 @@ function startApprovalServer(attempt = 0) {
   });
   server.listen(ASK_SOCKET, () => {
     try { fs.chmodSync(ASK_SOCKET, 0o600); } catch {}
+    try { approvalSocketIno = fs.statSync(ASK_SOCKET).ino; } catch {}
+    approvalServer = server;
     approvalServerUp = true;
     bustHostCache();
     console.log(`[daemon] remote approvals ready (mode: ${approvalConfig().mode})`);
   });
 }
 
+/// A second copy started on this Mac unlinks the approvals socket and binds
+/// its own. When that copy then loses the relay back to this one and exits,
+/// the hook is left calling a file nobody listens on, and approvals stop
+/// reaching the phone until the next restart. Up to 0.1.11 the restart came
+/// quickly, because a displaced daemon exited; now that it waits instead,
+/// it has to take the socket back itself, every time the relay is ours again.
+function ensureApprovalSocket() {
+  if (!approvalServer) return;
+  let ino = 0;
+  try { ino = fs.statSync(ASK_SOCKET).ino; } catch {}
+  if (ino && ino === approvalSocketIno) return;
+  console.log('[daemon] another copy replaced the approvals socket, taking it back');
+  try { approvalServer.close(); } catch {}
+  approvalServer = null;
+  approvalServerUp = false;
+  bustHostCache();
+  startApprovalServer();
+}
+
 // Claude Code's own status for each session, as last seen on disk.
 const lastRawStatus = new Map(); // sessionId -> 'busy' | 'idle' | 'waiting' | ...
 
@@ -1905,10 +1852,30 @@ const ANSWERED_GRACE_MS = 6000;
 function releaseAnsweredOnMac() {
   if (!pendingAsks.size) return;
   for (const ask of [...pendingAsks.values()]) {
-    if (Date.now() - ask.at < ANSWERED_GRACE_MS) continue;
     const status = lastRawStatus.get(ask.sessionId);
     // Unknown session: nothing to conclude, leave it to the socket or the cap.
-    if (!status || status === 'waiting') continue;
+    if (!status) continue;
+    // Recorded before the grace period is checked, not after: the prompt is
+    // most likely to be showing as waiting in exactly those first seconds.
+    if (status === 'waiting') { ask.sawWaiting = true; continue; }
+    if (Date.now() - ask.at < ANSWERED_GRACE_MS) continue;
+    // Not waiting is only evidence of an answer if we watched the prompt go
+    // up in the first place.
+    //
+    // Claude Code writes "waiting" for the prompt it draws itself, and a
+    // permission request raised from inside a running turn never gets one:
+    // the session sits on "busy" for as long as the hook blocks. Concluding
+    // from that alone declared every gated command inside a turn answered six
+    // seconds after it was asked, so the card vanished off the phone mid tap
+    // and the session stayed stopped on a question nobody could answer from
+    // there any more.
+    //
+    // Idle is the signal that is safe to read instead. A session cannot go
+    // idle while a hook is blocking a tool call, so idle means the turn ran
+    // to the end and this request is long settled, whatever settled it. Busy
+    // and shell mean the turn is still in flight, which is exactly when the
+    // card has to stay put.
+    if (!ask.sawWaiting && (status === 'busy' || status === 'shell')) continue;
     settleAsk(ask, null, 'gone', 'answered on the Mac');
   }
 }
@@ -1921,6 +1888,9 @@ function releaseAnsweredOnMac() {
 function releaseAsksIfBack() {
   if (!pendingAsks.size) return;
   const cfg = approvalConfig();
+  // `groundcontrol approvals off` runs in another process; this is where the
+  // daemon notices it and hands back whatever it was still holding.
+  if (cfg.mode === 'off') return releaseAllAsks('remote approvals were turned off');
   if (cfg.mode !== 'away') return;
   if (macIdleSeconds() >= cfg.awayAfterSeconds) return;
   for (const ask of [...pendingAsks.values()]) {
@@ -1950,8 +1920,11 @@ function isNewer(candidate, current) {
 }
 
 async function latestPublishedVersion() {
+  // Plain JSON. The abbreviated install-v1 format only exists for the whole
+  // package document; asked of /latest the registry answers 406, and it did,
+  // on every check from 0.1.7 through 0.1.11, so no install ever updated.
   const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
-    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    headers: { accept: 'application/json' },
     signal: AbortSignal.timeout(15_000),
   });
   if (!res.ok) throw new Error(`registry ${res.status}`);
@@ -1999,9 +1972,9 @@ async function checkForUpdate({ force = false } = {}) {
 
 /// A daemon shutting down must hand every held request back rather than leave
 /// sessions blocked on a socket that will never answer.
-function releaseAllAsks() {
+function releaseAllAsks(note = 'the daemon stopped') {
   for (const ask of [...pendingAsks.values()]) {
-    settleAsk(ask, null, 'released', 'the daemon stopped');
+    settleAsk(ask, null, 'released', note);
   }
 }
 
@@ -2010,6 +1983,17 @@ function releaseAllAsks() {
 let ws = null;
 let lastSnapshotJson = '';
 
+/// Everything bound for the phone goes through here. The socket is replaced
+/// on every reconnect, and ws throws, rather than returning, when asked to
+/// send on one that is still connecting. From a file watcher or a child
+/// process callback that is an uncaught exception, which takes the daemon and
+/// every held approval down with it. The relay keeps no queue, so a message
+/// with no open socket is lost either way; the phone has timeouts for that.
+function toPhone(obj) {
+  if (ws?.readyState !== 1) return false;
+  try { ws.send(seal(obj)); return true; } catch { return false; }
+}
+
 function sendSnapshot(force = false) {
   // A parser tripping on a malformed journal must never take the daemon down:
   // this runs on a bare interval with nothing above it to catch a throw.
@@ -2033,43 +2017,102 @@ function sendSnapshot(force = false) {
 
 // Live transcript streaming: while a phone has a chat open, push transcript
 // updates the moment the JSONL file changes.
-const watchers = new Map(); // sessionId -> fs.FSWatcher
-function watchTranscript(sessionId) {
-  if (watchers.has(sessionId)) return;
+//
+// Every open chat holds a lease on its watch. Apps from 0.1.9 name themselves
+// and renew every minute, so one phone closing a chat no longer stops it
+// streaming on another, and a phone that vanishes without an unwatch (killed
+// app, dead network) stops costing this Mac a file watch plus a full
+// transcript read on every write within minutes instead of never. Older apps
+// never renew, so theirs is long and renewed whenever they ask for the log.
+const WATCH_LEASE_MS = 3 * 60_000;
+const LEGACY_LEASE_MS = 30 * 60_000;
+const PROMPT_LEASE_MS = 5 * 60_000;
+const leaseFor = (holder) => (holder === 'legacy' ? LEGACY_LEASE_MS : holder === 'prompt' ? PROMPT_LEASE_MS : WATCH_LEASE_MS);
+const holderOf = (cmd) => (typeof cmd.client === 'string' && cmd.client ? `phone:${cmd.client.slice(0, 64)}` : 'legacy');
+const watchers = new Map(); // sessionId -> { watcher, debounce, leases: Map<holder, expiresAt> }
+// Sessions whose legacy lease ran out rather than being unwatched: the chat
+// may well still be open on an older phone, which asks for the log again
+// whenever the session changes state. That is the moment to resume.
+const lapsedLegacy = new Map(); // sessionId -> when the lease ran out
+const LAPSED_FORGET_MS = 24 * 60 * 60 * 1000;
+
+/// Start or renew a watch. Returns 'created', 'renewed', or null when there
+/// is no transcript to watch.
+function watchTranscript(sessionId, holder = 'legacy', now = Date.now()) {
+  if (holder === 'legacy') lapsedLegacy.delete(sessionId);
+  const until = now + leaseFor(holder);
+  const entry = watchers.get(sessionId);
+  if (entry) {
+    entry.leases.set(holder, Math.max(until, entry.leases.get(holder) || 0));
+    return 'renewed';
+  }
   const file = findTranscript(sessionId);
-  if (!file) return;
-  let debounce;
+  if (!file) return null;
+  const next = { watcher: null, debounce: null, leases: new Map([[holder, until]]) };
   try {
-    // Journals are appended to, so watching the file is enough. Grok Bot
-    // rewrites its replica blob wholesale, and a rename leaves a file watch
-    // bound to an inode nothing writes to again: watch the directory instead
-    // and filter, which survives the swap.
-    const inGrokBot = file.startsWith(GROKBOT_DIR + path.sep);
-    const target = inGrokBot ? GROKBOT_DIR : file;
-    const w = fs.watch(target, (_ev, changed) => {
-      if (inGrokBot && changed && changed !== path.basename(file)) return;
-      clearTimeout(debounce);
-      debounce = setTimeout(() => {
-        ws?.send(seal({ type: 'transcript', sessionId, messages: readMessages(sessionId) }));
+    // Journals are appended to, so watching the file is enough.
+    next.watcher = fs.watch(file, () => {
+      clearTimeout(next.debounce);
+      next.debounce = setTimeout(() => {
+        toPhone({ type: 'transcript', sessionId, messages: readMessages(sessionId) });
       }, 250);
     });
-    watchers.set(sessionId, w);
+    watchers.set(sessionId, next);
     console.log(`[daemon] watching transcript ${sessionId.slice(0, 8)}`);
-  } catch {}
+    return 'created';
+  } catch { return null; }
+}
+
+/// Keep an existing lease alive without starting a watch nobody asked for,
+/// except the one an older app's open chat lost to the clock.
+function renewWatch(sessionId, holder, now = Date.now()) {
+  const entry = watchers.get(sessionId);
+  if (entry?.leases.has(holder)) {
+    entry.leases.set(holder, now + leaseFor(holder));
+    return;
+  }
+  if (holder === 'legacy' && lapsedLegacy.has(sessionId)) watchTranscript(sessionId, 'legacy', now);
+}
+
+function unwatchTranscript(sessionId, holder = 'legacy') {
+  if (holder === 'legacy') lapsedLegacy.delete(sessionId);
+  const entry = watchers.get(sessionId);
+  if (!entry) return;
+  entry.leases.delete(holder);
+  if (!entry.leases.size) closeWatch(sessionId, entry);
 }
-function unwatchTranscript(sessionId) {
-  watchers.get(sessionId)?.close();
+
+function closeWatch(sessionId, entry) {
+  clearTimeout(entry.debounce);
+  try { entry.watcher?.close(); } catch {}
   watchers.delete(sessionId);
 }
 
+function expireWatches(now = Date.now()) {
+  for (const [sessionId, entry] of watchers) {
+    for (const [holder, until] of entry.leases) {
+      if (until > now) continue;
+      entry.leases.delete(holder);
+      if (holder === 'legacy') lapsedLegacy.set(sessionId, now);
+    }
+    if (!entry.leases.size) closeWatch(sessionId, entry);
+  }
+  for (const [sessionId, at] of lapsedLegacy) if (now - at > LAPSED_FORGET_MS) lapsedLegacy.delete(sessionId);
+}
+
 async function handleCommand(cmd) {
   if (cmd.type === 'getTranscript' && cmd.sessionId) {
-    ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
+    renewWatch(cmd.sessionId, holderOf(cmd));
+    toPhone({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) });
   } else if (cmd.type === 'watch' && cmd.sessionId) {
-    watchTranscript(cmd.sessionId);
-    ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
+    const how = watchTranscript(cmd.sessionId, holderOf(cmd));
+    // A renewal only keeps the lease; the phone already has the log, unless
+    // this daemon restarted since and the watch had to be started again.
+    if (!cmd.renew || how === 'created') {
+      toPhone({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) });
+    }
   } else if (cmd.type === 'unwatch' && cmd.sessionId) {
-    unwatchTranscript(cmd.sessionId);
+    unwatchTranscript(cmd.sessionId, holderOf(cmd));
   } else if (cmd.type === 'setApprovals') {
     // A deliberate tap in the app, with the app explaining what it adds, is
     // the consent for this. A backup is still written before any change.
@@ -2077,6 +2120,8 @@ async function handleCommand(cmd) {
     if (cmd.enabled === false) {
       writeApprovalConfig({ mode: 'off' });
       result = uninstallApprovalHook();
+      // Off means off for what is already held too, not just what comes next.
+      releaseAllAsks('remote approvals were turned off');
       console.log('[daemon] remote approvals turned off from the phone');
     } else {
       const mode = ['away', 'always'].includes(cmd.mode) ? cmd.mode : 'away';
@@ -2086,21 +2131,21 @@ async function handleCommand(cmd) {
     }
     bustHostCache();
     sendSnapshot(true);
-    ws?.send(seal({
+    toPhone({
       type: 'approvalsResult',
       ok: !!result.ok,
       error: result.ok ? '' : (result.reason || 'could not change the setting'),
       host: hostState(),
-    }));
+    });
   } else if (cmd.type === 'approve' || cmd.type === 'deny') {
     const ask = cmd.askId ? pendingAsks.get(cmd.askId) : null;
     if (!ask) {
       // Answered on the Mac, expired, or the session moved on while the tap
       // was in flight. Tell the phone so the card clears instead of hanging.
-      return ws?.send(seal({
+      return toPhone({
         type: 'askResolved', askId: cmd.askId || '', sessionId: cmd.sessionId || '',
         outcome: 'gone', note: 'that request is no longer waiting',
-      }));
+      });
     }
     if (cmd.type === 'approve') {
       settleAsk(ask, { behavior: 'allow', ...(cmd.always ? { alwaysAllow: true } : {}) },
@@ -2111,28 +2156,19 @@ async function handleCommand(cmd) {
         'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
     }
   } else if (cmd.type === 'projects') {
-    ws?.send(seal({
+    toPhone({
       type: 'projects',
       projects: knownProjects().map((p) => ({ path: p.path, name: p.name, at: p.at })),
       providers: launchProviders(),
-    }));
+    });
   } else if (cmd.type === 'launch') {
     await launchSession(cmd);
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
-    ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
+    toPhone({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() });
   } else if (cmd.type === 'prompt' && cmd.sessionId && cmd.text) {
     const session = readSessions().find((s) => s.id === cmd.sessionId);
-    if (!session) return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' }));
-
-    // A Bot lives on a cloud VM this daemon has no channel to. Saying so beats
-    // a send that looks accepted and arrives nowhere.
-    if (session.provider === 'grokbot') {
-      return ws?.send(seal({
-        type: 'promptResult', sessionId: cmd.sessionId, ok: false,
-        error: 'Grok Bot runs in the cloud, so Ground Control can only watch it. Open the Grok Bot app to reply.',
-      }));
-    }
+    if (!session) return toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' });
 
     if (session.provider && session.provider !== 'claude') return promptHeadless(session, cmd.text);
 
@@ -2141,27 +2177,27 @@ async function handleCommand(cmd) {
       const method = await injectPrompt(session.tty, cmd.text);
       if (method) {
         console.log(`[daemon] injected prompt into ${session.name} via ${method}`);
-        ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: true, text: '' }));
-        watchTranscript(cmd.sessionId);
+        toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: true, text: '' });
+        watchTranscript(cmd.sessionId, 'prompt');
         sendSnapshot(true);
         return;
       }
       if (automationDenied) {
         console.log('[daemon] prompt blocked: macOS Automation permission missing');
-        return ws?.send(seal({
+        return toPhone({
           type: 'promptResult', sessionId: cmd.sessionId, ok: false,
           error: 'Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then send again.',
-        }));
+        });
       }
     }
-    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
+    if (session.status === 'busy') return toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' });
     const bin = claudeBin();
     if (!bin) {
       console.log('[daemon] prompt failed: claude binary not found on PATH');
-      return ws?.send(seal({
+      return toPhone({
         type: 'promptResult', sessionId: cmd.sessionId, ok: false,
         error: 'The daemon could not find the claude command on this Mac. Open a terminal, check that claude runs, then reinstall with: npx @clastres/groundcontrol',
-      }));
+      });
     }
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
@@ -2177,11 +2213,13 @@ async function handleCommand(cmd) {
       if (responded) return;
       responded = true;
       headlessActive.delete(cmd.sessionId);
-      ws?.send(seal(payload));
+      toPhone(payload);
       sendSnapshot(true);
     };
     child.stdout.on('data', (d) => { out += d; });
     child.stderr.on('data', (d) => { err += d; });
+    // Delivered is not done: the turn can run for minutes. See promptAccepted.
+    child.on('spawn', () => promptAccepted(cmd.sessionId));
     child.on('error', (e) => {
       console.log(`[daemon] claude spawn failed: ${e.message}`);
       respond({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: `could not run claude: ${e.message}` });
@@ -2190,6 +2228,7 @@ async function handleCommand(cmd) {
       respond({
         type: 'promptResult', sessionId: cmd.sessionId, ok: code === 0,
         text: (out || err).trim().slice(0, 4000),
+        ...(code === 0 ? {} : { error: failureText('claude', code, err || out) }),
       });
     });
   }
@@ -2213,21 +2252,20 @@ const headlessPromptSpec = {
 function bustProviderCaches() {
   codexCache.at = 0;
   kimiCache.at = 0;
-  grokbotCache.at = 0;
 }
 
 function promptHeadless(session, text) {
   // Anything but idle means another writer owns the session right now: busy
   // is a running turn, waiting is a human approval the phone cannot answer.
-  if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' }));
-  if (session.status !== 'idle') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' }));
+  if (session.status === 'busy') return toPhone({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' });
+  if (session.status !== 'idle') return toPhone({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' });
   const spec = headlessPromptSpec[session.provider]?.();
   if (!spec) {
     console.log(`[daemon] ${session.provider} prompt failed: binary not found`);
-    return ws?.send(seal({
+    return toPhone({
       type: 'promptResult', sessionId: session.id, ok: false,
       error: `The daemon could not find the ${session.provider === 'codex' ? 'codex' : 'kimi'} command on this Mac, so it cannot reach this session. If you just installed it, try again in a minute.`,
-    }));
+    });
   }
   console.log(`[daemon] prompt -> ${session.provider} ${session.name}: ${text.slice(0, 60)}`);
   const promptedAt = Date.now();
@@ -2246,11 +2284,12 @@ function promptHeadless(session, text) {
     responded = true;
     headlessActive.delete(session.id);
     bustProviderCaches();
-    ws?.send(seal(payload));
+    toPhone(payload);
     sendSnapshot(true);
   };
   child.stderr.on('data', (d) => { err += d; });
   child.stdout.on('data', () => {});
+  child.on('spawn', () => promptAccepted(session.id));
   child.on('error', (e) => {
     console.log(`[daemon] ${session.provider} spawn failed: ${e.message}`);
     respond({ type: 'promptResult', sessionId: session.id, ok: false, error: `could not run ${session.provider}: ${e.message}` });
@@ -2265,9 +2304,26 @@ function promptHeadless(session, text) {
     respond({
       type: 'promptResult', sessionId: session.id, ok: code === 0,
       text: code === 0 ? (reply?.text || '').slice(0, 4000) : err.trim().slice(0, 4000),
+      ...(code === 0 ? {} : { error: failureText(session.provider, code, err) }),
     });
   });
-  watchTranscript(session.id);
+  watchTranscript(session.id, 'prompt');
+}
+
+/// Tell the phone a headless run has started. The run answers only when the
+/// whole turn is over, often minutes later, and the app gives up on a prompt
+/// after 30 seconds: up to 0.1.8 it then showed "no reply from mac yet" and
+/// kept showing it after the run succeeded. An ok now clears the pending
+/// prompt; a failure later still arrives as its own result.
+function promptAccepted(sessionId) {
+  toPhone({ type: 'promptResult', sessionId, ok: true, text: '', accepted: true });
+}
+
+/// A failed run's last words, for the phone. Whatever the agent printed on
+/// stderr last is usually the reason; the exit code is the fallback.
+function failureText(provider, code, output) {
+  const tail = String(output || '').trim().split('\n').filter(Boolean).slice(-3).join(' ').slice(0, 300);
+  return tail ? `${provider} stopped: ${tail}` : `${provider} exited with code ${code}`;
 }
 
 // ---------- launching a new pilot ----------
@@ -2368,7 +2424,7 @@ const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
 let lastLaunchAt = 0;
 
 async function launchSession(cmd) {
-  const fail = (error) => ws?.send(seal({ type: 'launchResult', ok: false, error }));
+  const fail = (error) => toPhone({ type: 'launchResult', ok: false, error });
 
   const providers = launchProviders();
   const provider = cmd.provider || 'claude';
@@ -2426,18 +2482,60 @@ end tell`);
   // The new session reaches the island through the same discovery every other
   // one does, which takes a few seconds. Say so rather than implying the pilot
   // is already there.
-  ws?.send(seal({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` }));
+  toPhone({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` });
   sendSnapshot(true);
 }
 
+// Replay protection. The relay only ever sees ciphertext, but it could send
+// a captured command again, and it would decrypt just fine. Every sealed
+// message opens with a random 12 byte nonce, so one seen twice is a replay.
+// Keyed on the decoded bytes, not the text: base64 decoding skips whitespace
+// and takes either alphabet, so one frame can be spelled many ways.
+// Apps from 0.1.9 also stamp each command with when it was sent, which turns
+// away old captures even after a restart has emptied this cache. Commands
+// from older apps carry no stamp and get the nonce check alone.
+const seenNonces = new Map();              // nonce, hex -> seen at
+const NONCE_TTL_MS = 24 * 60 * 60 * 1000;
+const NONCE_CAP = 20_000;
+const COMMAND_MAX_SKEW_MS = 10 * 60 * 1000;
+function freshCommand(b64, cmd, now = Date.now()) {
+  const nonce = Buffer.from(b64, 'base64').subarray(0, 12).toString('hex');
+  if (seenNonces.has(nonce)) return false;
+  if (typeof cmd?.at === 'number' && Math.abs(now - cmd.at) > COMMAND_MAX_SKEW_MS) return false;
+  seenNonces.set(nonce, now);
+  // Oldest first, so trimming stops at the first one worth keeping.
+  for (const [k, t] of seenNonces) {
+    if (now - t > NONCE_TTL_MS || seenNonces.size > NONCE_CAP) seenNonces.delete(k);
+    else break;
+  }
+  return true;
+}
+
 let lastPongAt = Date.now();
+let connectedAt = 0;
+let takeovers = 0;   // in a row; reset once a connection has held for a while
+
+/// How long to stay off the relay after another host took the channel.
+/// Exiting instead, as this did up to 0.1.11, hands the job to launchd, which
+/// starts us again five seconds later; we take the channel back, the other
+/// host takes it back, and round it goes. One Mac logged 1,123 restarts that
+/// way, in bursts of ten, against another machine sharing its key.
+function takeoverBackoffMs(n) {
+  return Math.min(15 * 60_000, 60_000 * 2 ** Math.max(0, n - 1));
+}
 
 function connect() {
   // handshakeTimeout: a dial that never completes would otherwise sit in
   // CONNECTING forever without firing close, freezing the retry loop.
   ws = new WebSocket(`${RELAY}/ch/${CHANNEL}?role=host`, { handshakeTimeout: 15_000 });
   lastPongAt = Date.now();
-  ws.on('open', () => { lastPongAt = Date.now(); console.log('[daemon] connected to relay'); sendSnapshot(true); });
+  ws.on('open', () => {
+    lastPongAt = Date.now();
+    connectedAt = Date.now();
+    console.log('[daemon] connected to relay');
+    ensureApprovalSocket();
+    sendSnapshot(true);
+  });
   ws.on('pong', () => { lastPongAt = Date.now(); });
   ws.on('message', (data) => {
     const str = data.toString();
@@ -2452,14 +2550,30 @@ function connect() {
     // which is what the approval policy checks before holding a prompt.
     try {
       const cmd = open(str);
+      if (!freshCommand(str, cmd)) {
+        const off = typeof cmd?.at === 'number' ? Math.round((Date.now() - cmd.at) / 60_000) : 0;
+        console.log(`[daemon] dropped a repeated or stale ${cmd?.type || 'command'}`
+          + (Math.abs(off) >= 10 ? ` (stamped ${off} min off this Mac's clock)` : ''));
+        return;
+      }
       notePhoneSeen();
       handleCommand(cmd)?.catch?.(() => {});
     } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
   });
   ws.on('close', (code) => {
     if (code === 4001) {
-      console.log('[daemon] another daemon took over this channel, exiting. Run only one copy.');
-      process.exit(0);
+      // A copy someone started by hand should get out of the way and say why.
+      if (!runsFromServiceDir) {
+        console.log('[daemon] another daemon took over this channel, exiting. Run only one copy.');
+        process.exit(0);
+      }
+      if (connectedAt && Date.now() - connectedAt > 10 * 60_000) takeovers = 0;
+      takeovers++;
+      const wait = takeoverBackoffMs(takeovers);
+      console.log(`[daemon] another host took over this pairing (${takeovers} in a row), trying again in ${Math.round(wait / 60_000)} min. `
+        + 'Another Mac or a second copy is using this key; remove it there with: npx @clastres/groundcontrol service uninstall');
+      setTimeout(connect, wait);
+      return;
     }
     console.log('[daemon] relay disconnected, retrying in 3s');
     setTimeout(connect, 3000);
@@ -2483,6 +2597,7 @@ for (const cmd of hookState.foreign || []) console.log(`[daemon] another app als
 startApprovalServer();
 setInterval(releaseAsksIfBack, 3000);
 setInterval(releaseAnsweredOnMac, 2000);
+setInterval(expireWatches, 30_000);
 
 // Self update. Staggered off startup so a login storm does not hit the
 // registry at once, then re-checked hourly (the daily stamp does the gating).
@@ -2531,4 +2646,3 @@ function watchProviderDir(dir, cache, label) {
 watchProviderDir(CODEX_SESS_DIR, codexCache, `codex sessions (codex binary: ${codexBin() || 'not found yet, rechecked on each prompt'})`);
 watchProviderDir(path.join(KIMI_DIR, 'sessions'), kimiCache, 'kimi sessions');
 watchProviderDir(path.join(KIMICODE_DIR, 'sessions'), kimiCache, 'kimi code sessions');
-watchProviderDir(GROKBOT_DIR, grokbotCache, 'grok bot roster (read only, replies happen in the Grok Bot app)');