@clastres/groundcontrol 0.1.10 → 0.1.12

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.10",
-  "description": "See and command your coding agents from your iPhone. Pairs the Ground Control app with Claude Code, Codex, Kimi and Grok Bot sessions running on this Mac, end to end encrypted.",
+  "version": "0.1.12",
+  "description": "See and command your coding agents from your iPhone. Pairs the Ground Control app with Claude Code, Codex and Kimi sessions running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "bin/groundcontrol.mjs"
   },
@@ -21,7 +21,6 @@
     "claude-code",
     "codex",
     "kimi",
-    "grok",
     "ai",
     "agents",
     "cli",

package/test/approvals.mjs

@@ -0,0 +1,121 @@
+// A held permission request must clear when it is answered on the Mac, and
+// must NOT clear while it is still genuinely waiting on you. That balance has
+// been wrong twice, in both directions, so it gets a test.
+//
+// The fast path is the hook's socket closing, and in practice it almost never
+// fires: 182 of 189 settlements in a real daemon log came from this function
+// instead. So the status reading is the mechanism, not the safety net.
+//
+// Wrong the first way: any status other than "waiting" counted as answered.
+// Claude Code only writes "waiting" for the prompt it draws itself, and a
+// permission request raised from inside a running turn never gets one, so
+// every gated command inside a turn was declared answered six seconds after
+// it was asked. The card vanished off the phone mid tap and the session
+// stayed stopped on a question nobody could answer from there.
+//
+// Wrong the second way: requiring "waiting" to have been seen at all. That is
+// correct and it never lets go, so a request genuinely answered on the Mac
+// leaves a phantom card until the twelve hour hold cap.
+//
+// Right: hold through busy and shell, let go on idle. A session cannot report
+// idle while a hook is blocking a tool call.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
+const src = fs.readFileSync(DAEMON, 'utf8');
+const start = src.indexOf('const ANSWERED_GRACE_MS');
+const end = src.indexOf('/// Sitting back down at the Mac clears the phone card.');
+if (start < 0 || end < 0 || end < start) throw new Error('could not locate releaseAnsweredOnMac in daemon.mjs');
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+const settled = [];
+const pendingAsks = new Map();
+const lastRawStatus = new Map();
+const settleAsk = (ask, _decision, outcome, note) => {
+  pendingAsks.delete(ask.id);
+  settled.push({ id: ask.id, outcome, note });
+};
+
+const { releaseAnsweredOnMac, ANSWERED_GRACE_MS } = new Function(
+  'pendingAsks', 'lastRawStatus', 'settleAsk',
+  `${src.slice(start, end)}\n return { releaseAnsweredOnMac, ANSWERED_GRACE_MS };`,
+)(pendingAsks, lastRawStatus, settleAsk);
+
+/// A held request, aged so the grace period is behind it unless asked otherwise.
+function hold(id, sessionId, { ageMs = ANSWERED_GRACE_MS + 1000, sawWaiting = false } = {}) {
+  const ask = { id, sessionId, at: Date.now() - ageMs, sawWaiting };
+  pendingAsks.set(id, ask);
+  return ask;
+}
+const reset = () => { pendingAsks.clear(); lastRawStatus.clear(); settled.length = 0; };
+const outcomeOf = (id) => settled.find((s) => s.id === id)?.outcome;
+
+// The bug Carlos hit: a gated command inside a running turn. Claude never says
+// waiting, it says busy for as long as the hook blocks.
+reset();
+hold('a1', 's-busy');
+lastRawStatus.set('s-busy', 'busy');
+releaseAnsweredOnMac();
+check('a request held inside a running turn is not declared answered', pendingAsks.has('a1'), outcomeOf('a1') || 'still held');
+
+// Same, for a session running a shell command.
+reset();
+hold('a2', 's-shell');
+lastRawStatus.set('s-shell', 'shell');
+releaseAnsweredOnMac();
+check('nor one held while a shell command runs', pendingAsks.has('a2'));
+
+// The other failure mode: the turn ended, so whatever was holding it is gone.
+reset();
+hold('a3', 's-idle');
+lastRawStatus.set('s-idle', 'idle');
+releaseAnsweredOnMac();
+check('an idle session releases the request', outcomeOf('a3') === 'gone', outcomeOf('a3') || 'still held');
+
+// A busy session that later goes idle has to release, or the card is phantom
+// until the twelve hour cap.
+reset();
+const a4 = hold('a4', 's-turn');
+lastRawStatus.set('s-turn', 'busy');
+releaseAnsweredOnMac();
+const heldDuringTurn = pendingAsks.has('a4');
+lastRawStatus.set('s-turn', 'idle');
+releaseAnsweredOnMac();
+check('held through the turn, released when it ends', heldDuringTurn && outcomeOf('a4') === 'gone');
+check('the ask is not left in the pending map', !pendingAsks.has('a4') && a4.id === 'a4');
+
+// Claude's own prompt does write waiting, and dropping out of it is the
+// original signal, which still has to work.
+reset();
+hold('a5', 's-prompt');
+lastRawStatus.set('s-prompt', 'waiting');
+releaseAnsweredOnMac();
+const heldWhileWaiting = pendingAsks.has('a5');
+lastRawStatus.set('s-prompt', 'busy');
+releaseAnsweredOnMac();
+check('a prompt seen waiting releases as soon as it stops waiting',
+  heldWhileWaiting && outcomeOf('a5') === 'gone', outcomeOf('a5') || 'still held');
+
+// The grace period covers the gap between the hook firing and Claude Code
+// getting round to writing its status.
+reset();
+hold('a6', 's-fresh', { ageMs: 1000 });
+lastRawStatus.set('s-fresh', 'idle');
+releaseAnsweredOnMac();
+check('a request younger than the grace period is left alone', pendingAsks.has('a6'));
+
+// A session the daemon cannot see at all is not evidence of anything.
+reset();
+hold('a7', 's-unknown');
+releaseAnsweredOnMac();
+check('an unknown session releases nothing', pendingAsks.has('a7'));
+
+console.log(failures ? `\n${failures} FAILURE(S)` : '\nall checks passed');
+process.exit(failures ? 1 : 0);

package/test/codex.mjs

@@ -0,0 +1,94 @@
+// Codex writes one rollout file per run, and two of the ways it does that used
+// to put holes in the app.
+//
+// A helper thread (the review subagent) gets its own rollout carrying the
+// *parent's* session_id, so the daemon reported two sessions under one id. The
+// phone keys every pilot on that id, so it drew one and left a card sized gap
+// where the other should have been, on the crew list and on the island both.
+//
+// And a plain `codex exec` starts a fresh rollout every time, so asking Codex
+// to review something three times in one folder put three identical pilots on
+// the island. Only the freshest one in a directory is worth talking to.
+//
+// This runs the real reader out of daemon.mjs against a synthetic ~/.codex.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
+const src = fs.readFileSync(DAEMON, 'utf8');
+const start = src.indexOf('// ---------- Codex session discovery ----------');
+const end = src.indexOf('// ---------- Kimi session discovery ----------');
+if (start < 0 || end < 0 || end < start) throw new Error('could not locate the Codex block in daemon.mjs');
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gc-codex-'));
+const day = path.join(tmp, 'sessions', '2026', '09', '05');
+fs.mkdirSync(day, { recursive: true });
+
+/// One rollout: the session_meta line, then a finished turn so the reader has
+/// something to call a last message.
+function rollout(name, meta, { text = 'hello', minutesAgo = 1 } = {}) {
+  const file = path.join(day, `rollout-${name}.jsonl`);
+  const at = new Date(Date.now() - minutesAgo * 60_000).toISOString();
+  fs.writeFileSync(file, [
+    JSON.stringify({ timestamp: at, type: 'session_meta', payload: { timestamp: at, ...meta } }),
+    JSON.stringify({ timestamp: at, type: 'event_msg', payload: { type: 'task_started' } }),
+    JSON.stringify({ timestamp: at, type: 'event_msg', payload: { type: 'agent_message', message: text } }),
+    JSON.stringify({ timestamp: at, type: 'event_msg', payload: { type: 'task_complete' } }),
+    '',
+  ].join('\n'));
+  const when = Date.now() - minutesAgo * 60_000;
+  fs.utimesSync(file, when / 1000, when / 1000);
+  return file;
+}
+
+const PROJECT = '/tmp/project-one';
+const OTHER = '/tmp/project-two';
+
+// The pair that broke it: a run and the review helper it spawned, same second,
+// same id, two files.
+rollout('a-parent', { session_id: 'id-parent', id: 'id-parent', cwd: PROJECT, thread_source: 'user', source: 'exec' },
+  { text: 'the older run', minutesAgo: 9 });
+rollout('a-helper', { session_id: 'id-parent', id: 'id-child', parent_thread_id: 'id-parent', cwd: PROJECT, thread_source: 'subagent', source: { subagent: 'review' } },
+  { text: 'reviewing', minutesAgo: 8 });
+// A second, unrelated run in the same folder, more recent than both.
+rollout('b-newer', { session_id: 'id-newer', id: 'id-newer', cwd: PROJECT, thread_source: 'user', source: 'exec' },
+  { text: 'the newest run', minutesAgo: 2 });
+// A different folder, which must survive on its own.
+rollout('c-other', { session_id: 'id-other', id: 'id-other', cwd: OTHER, thread_source: 'user', source: 'exec' },
+  { text: 'elsewhere', minutesAgo: 3 });
+// Older than the active window: gone from the fleet entirely.
+rollout('d-stale', { session_id: 'id-stale', id: 'id-stale', cwd: '/tmp/project-three', thread_source: 'user', source: 'exec' },
+  { text: 'yesterday', minutesAgo: 60 * 5 });
+
+// tailLines, memoScan and scanMemo all live inside the extracted block, so the
+// only things handed in are the modules and the two maps the daemon shares.
+const block = src.slice(start, end)
+  .replace(/const CODEX_DIR = .*/, `const CODEX_DIR = ${JSON.stringify(tmp)};`);
+
+const { readCodexSessions } = new Function('fs', 'os', 'path', 'transcriptCache', 'headlessActive',
+  `${block}\n return { readCodexSessions };`)(fs, os, path, new Map(), new Set());
+
+const sessions = readCodexSessions();
+const ids = sessions.map((s) => s.id);
+const cwds = sessions.map((s) => s.cwd);
+
+check('the helper thread is not a pilot', !ids.includes('id-child') && ids.filter((i) => i === 'id-parent').length <= 1, ids.join(', '));
+check('no id appears twice', new Set(ids).size === ids.length, ids.join(', '));
+check('one pilot per folder', new Set(cwds).size === cwds.length, cwds.join(', '));
+check('the folder keeps its freshest run', ids.includes('id-newer') && !ids.includes('id-parent'), ids.join(', '));
+check('a second folder still flies', ids.includes('id-other'));
+check('a stale rollout is off the island', !ids.includes('id-stale'));
+check('the surviving pilot carries its own last message',
+  sessions.find((s) => s.id === 'id-newer')?.lastMessage?.text === 'the newest run');
+
+fs.rmSync(tmp, { recursive: true, force: true });
+console.log(failures ? `\n${failures} FAILURE(S)` : '\nall checks passed');
+process.exit(failures ? 1 : 0);

package/test/providers.mjs

@@ -20,11 +20,14 @@ const check = (label, cond, detail = '') => {
   if (!cond) failures++;
 };
 
-// Find every `sessions.push({ ... })` and read the object literal that follows,
-// counting braces so a nested object cannot end the block early.
+// Find every session object literal and read it, counting braces so a nested
+// object cannot end the block early. Most readers push one straight onto the
+// list; codex builds one first, because it keeps only the freshest rollout per
+// folder and may have to replace a row it already added.
 const blocks = [];
 lines.forEach((line, i) => {
-  if (!/sessions\.push\(\{\s*$/.test(line.trim())) return;
+  const t = line.trim();
+  if (!/sessions\.push\(\{\s*$/.test(t) && !/^const session = \{\s*$/.test(t)) return;
   let depth = 1;
   const body = [];
   for (let j = i + 1; j < lines.length && depth > 0; j++) {
@@ -48,7 +51,7 @@ for (const b of blocks) {
 // heard of still renders, uppercased, but a rename would silently drop a brand
 // name that used to be there, so the known set is pinned.
 const providers = new Set(blocks.map((b) => (b.body.match(/provider:\s*'([^']+)'/) || [])[1]).filter(Boolean));
-for (const known of ['claude', 'codex', 'kimi', 'kimicode', 'grokbot']) {
+for (const known of ['claude', 'codex', 'kimi', 'kimicode']) {
   check(`${known} is still a provider the daemon emits`, providers.has(known));
 }
 

package/test/review-fixes.mjs

@@ -0,0 +1,294 @@
+// The fixes from the 2026-09-22 review, each pinned to the failure it fixes.
+// Same approach as the other files here: lift the real function out of
+// daemon.mjs and run it against fakes, so what is tested is what ships.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
+const src = fs.readFileSync(DAEMON, 'utf8');
+
+/// The source between two markers, which must both exist and be in order.
+function slice(from, to) {
+  const start = src.indexOf(from);
+  const end = src.indexOf(to, start + 1);
+  if (start < 0 || end < 0) throw new Error(`could not locate ${from.slice(0, 50)} in daemon.mjs`);
+  return src.slice(start, end);
+}
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+// ---------- phone text never reaches a shell ----------
+{
+  const calls = [];
+  const { injectPrompt } = new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return { injectPrompt };`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { calls.push({ file, args }); return Buffer.from(''); },
+    (cmd) => { calls.push({ shell: cmd }); return Buffer.from(''); },
+    async () => {},
+    async () => 'notfound',
+    (s) => s,
+  );
+  const text = 'rename `foo` to $(whoami) and keep $HOME';
+  const method = await injectPrompt('ttys009', text);
+  check('a tmux session is typed into through tmux', method === 'tmux', `got ${method}`);
+  check('nothing goes through a shell', calls.every((c) => !c.shell), JSON.stringify(calls.filter((c) => c.shell)));
+  const typed = calls.find((c) => c.args?.includes('-l'));
+  check('the prompt arrives as one literal argument, backticks and all',
+    typed?.file === 'tmux' && typed.args.at(-1) === text, JSON.stringify(typed));
+  const dashed = [];
+  await new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return injectPrompt;`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { dashed.push(args); return Buffer.from(''); },
+    () => { throw new Error('shell'); },
+    async () => {}, async () => 'notfound', (s) => s,
+  )('ttys009', '-t is not a flag here');
+  check('a prompt starting with a dash is not read as a tmux option',
+    dashed[0]?.indexOf('--') === dashed[0]?.length - 2, JSON.stringify(dashed[0]));
+}
+
+// ---------- sends while reconnecting do not throw ----------
+{
+  const run = (ws) => new Function('ws', 'seal',
+    `${slice('/// Everything bound for the phone goes through here.', 'function sendSnapshot(')}
+     return toPhone;`)(ws, (o) => JSON.stringify(o));
+  const connecting = { readyState: 0, send() { throw new Error('WebSocket is not open: readyState 0 (CONNECTING)'); } };
+  let threw = false;
+  let sent;
+  try { sent = run(connecting)({ type: 'transcript' }); } catch { threw = true; }
+  check('a send while the next socket is still connecting does not throw', !threw && sent === false);
+  check('a send with no socket at all is dropped quietly', run(null)({ type: 'x' }) === false);
+  const out = [];
+  check('an open socket still gets the message', run({ readyState: 1, send: (d) => out.push(d) })({ type: 'x' }) === true && out.length === 1);
+}
+
+// ---------- self update asks npm a question it answers ----------
+{
+  const requests = [];
+  // The registry's real behaviour: the abbreviated document only exists for
+  // the package root, so /latest with that accept header is a 406.
+  const fakeFetch = async (url, opts) => {
+    requests.push({ url, accept: opts?.headers?.accept });
+    if (/\/latest$/.test(url) && String(opts?.headers?.accept).includes('vnd.npm.install-v1')) {
+      return { ok: false, status: 406, json: async () => ({}) };
+    }
+    return { ok: true, status: 200, json: async () => ({ name: '@clastres/groundcontrol', version: '0.1.12' }) };
+  };
+  const latest = new Function('fetch', 'PACKAGE',
+    `${slice('async function latestPublishedVersion() {', '/// Re-install the service from the newly published version.')}
+     return latestPublishedVersion;`)(fakeFetch, '@clastres/groundcontrol');
+  let version = null;
+  let error = null;
+  try { version = await latest(); } catch (e) { error = e.message; }
+  check('the update check gets a version back', version === '0.1.12', error || '');
+  check('it asks the latest endpoint of the right package',
+    requests[0]?.url === 'https://registry.npmjs.org/@clastres/groundcontrol/latest', requests[0]?.url);
+}
+
+// ---------- a takeover backs off instead of restarting ----------
+{
+  const backoff = new Function(`${slice('/// How long to stay off the relay', 'function connect() {')} return takeoverBackoffMs;`)();
+  const mins = [1, 2, 3, 4, 5, 6, 9].map((n) => backoff(n) / 60_000);
+  check('the first takeover waits a minute, then doubles', mins[0] === 1 && mins[1] === 2 && mins[2] === 4 && mins[3] === 8, mins.join(','));
+  check('and never waits more than fifteen minutes', mins.slice(4).every((m) => m === 15), mins.join(','));
+  const closeHandler = slice("  ws.on('close', (code) => {", "  ws.on('error', () => {});");
+  check('the service copy no longer exits on a takeover',
+    /if \(!runsFromServiceDir\) \{[\s\S]*process\.exit\(0\);[\s\S]*\}[\s\S]*setTimeout\(connect, wait\)/.test(closeHandler));
+}
+
+// ---------- replayed and stale commands are refused ----------
+{
+  const fresh = new Function(`${slice('// Replay protection.', 'let lastPongAt = Date.now();')} return freshCommand;`)();
+  const now = Date.now();
+  const frame = (tag) => `${tag.padEnd(16, 'A')}restOfTheCiphertext==`;
+  check('a new command is accepted', fresh(frame('n1'), { type: 'prompt', at: now }, now));
+  check('the same frame again is a replay', !fresh(frame('n1'), { type: 'prompt', at: now }, now + 1000));
+  check('a stamped command from twenty minutes ago is stale', !fresh(frame('n2'), { type: 'prompt', at: now - 20 * 60_000 }, now));
+  check('a clock a little ahead is fine', fresh(frame('n3'), { type: 'prompt', at: now + 60_000 }, now));
+  check('an older app with no stamp still gets through once', fresh(frame('n4'), { type: 'watch' }, now));
+  check('but not twice', !fresh(frame('n4'), { type: 'watch' }, now));
+
+  // The relay can respell a frame: base64 decoding skips whitespace and takes
+  // either alphabet. Every spelling must still count as the same frame.
+  const key = crypto.randomBytes(32);
+  const open = new Function('key', 'crypto', 'Buffer',
+    `${slice('function open(b64) {', '// ---------- environment hardening ----------')} return open;`)(key, crypto, Buffer);
+  const seal = (obj) => {
+    const nonce = crypto.randomBytes(12);
+    const c = crypto.createCipheriv('chacha20-poly1305', key, nonce, { authTagLength: 16 });
+    const ct = Buffer.concat([c.update(JSON.stringify(obj)), c.final()]);
+    return Buffer.concat([nonce, ct, c.getAuthTag()]).toString('base64');
+  };
+  const real = seal({ type: 'prompt', sessionId: 's', text: 'hi', at: now });
+  const spellings = [` ${real}`, `\n${real}`, `${real.slice(0, 8)} ${real.slice(8)}`, real.replace(/\+/g, '-').replace(/\//g, '_')];
+  check('a real frame is accepted', fresh(real, open(real), now));
+  for (const alt of spellings) {
+    let decoded = null;
+    try { decoded = open(alt); } catch {}
+    check(`respelled ${JSON.stringify(alt.slice(0, 3))}... still decrypts, and is still a replay`, decoded?.text === 'hi' && !fresh(alt, decoded, now + 5));
+  }
+}
+
+// ---------- the pairing key stays out of the log ----------
+{
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gc-scrub-'));
+  const LOG_FILE = path.join(dir, 'daemon.log');
+  const qrRow = '█ ▄▄▄▄▄ █ █▄▀▀█▄█ ▀█ ▄▀█ █▀  ▄█▄▄  █▀▄█ ▄▄▄▄▄ █';
+  fs.writeFileSync(LOG_FILE, [
+    '[daemon] connected to relay',
+    '▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄',
+    qrRow,
+    '  Pairing code (paste into the app):',
+    '  groundcontrol://pair#eyJ2IjoxLCJrIjoic2VjcmV0In0',
+    '[daemon] snapshot -> 2 session(s): a:idle, b:busy',
+    '',
+  ].join('\n'), { mode: 0o644 });
+  new Function('fs', 'path', 'LOG_FILE', 'CONF_DIR',
+    `${slice('/// Versions up to 0.1.11 printed the pairing code', "if (subcommand === 'qr') process.exit(0);")}
+     scrubLogSecrets();`)(fs, path, LOG_FILE, dir);
+  const after = fs.readFileSync(LOG_FILE, 'utf8');
+  check('the pairing code is gone from the log', !after.includes('eyJ2IjoxLCJrIjoic2VjcmV0In0'));
+  check('so is the QR that encodes it', !after.includes(qrRow) && !after.includes('▄▄▄▄▄▄▄▄'));
+  check('everything else in the log is kept', after.includes('[daemon] connected to relay') && after.includes('b:busy'));
+  check('the log is readable by its owner only', (fs.statSync(LOG_FILE).mode & 0o777) === 0o600,
+    (fs.statSync(LOG_FILE).mode & 0o777).toString(8));
+  let writes = 0;
+  const spyFs = { ...fs, writeFileSync: (...a) => { writes++; return fs.writeFileSync(...a); } };
+  new Function('fs', 'path', 'LOG_FILE', 'CONF_DIR',
+    `${slice('/// Versions up to 0.1.11 printed the pairing code', "if (subcommand === 'qr') process.exit(0);")}
+     scrubLogSecrets();`)(spyFs, path, LOG_FILE, dir);
+  check('a log already scrubbed is not rewritten on the next start', writes === 0, `${writes} write(s)`);
+  const print = slice("if (subcommand === 'qr' || process.stdout.isTTY) {", "if (runsFromServiceDir) scrubLogSecrets();");
+  check('a daemon writing to a file prints no pairing code', /else \{\s*console\.log\('  Pairing code hidden here/.test(print));
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------- watch leases ----------
+{
+  const opened = [];
+  const fakeFs = {
+    watch(file, cb) {
+      const w = { file, cb, closed: false, close() { this.closed = true; } };
+      opened.push(w);
+      return w;
+    },
+  };
+  const sent = [];
+  const api = new Function('fs', 'findTranscript', 'readMessages', 'toPhone',
+    `${slice('const WATCH_LEASE_MS', 'async function handleCommand(cmd) {')}
+     return { watchTranscript, unwatchTranscript, renewWatch, expireWatches, holderOf, watchers, WATCH_LEASE_MS, LEGACY_LEASE_MS };`,
+  )(fakeFs, (id) => `/tmp/${id}.jsonl`, () => [], (m) => sent.push(m));
+  const { watchTranscript, unwatchTranscript, renewWatch, expireWatches, holderOf, watchers, WATCH_LEASE_MS, LEGACY_LEASE_MS } = api;
+  const a = holderOf({ client: 'phone-a' });
+  const b = holderOf({ client: 'phone-b' });
+
+  check('the first watch starts one', watchTranscript('s1', a) === 'created' && opened.length === 1);
+  check('a second phone shares it', watchTranscript('s1', b) === 'renewed' && opened.length === 1);
+  unwatchTranscript('s1', a);
+  check('one phone closing the chat keeps it streaming for the other', watchers.has('s1') && !opened[0].closed);
+  unwatchTranscript('s1', b);
+  check('the last one closing stops it', !watchers.has('s1') && opened[0].closed);
+
+  watchTranscript('s2', a);
+  const now = Date.now();
+  expireWatches(now + WATCH_LEASE_MS - 1000);
+  check('a lease inside its window stays', watchers.has('s2'));
+  expireWatches(now + WATCH_LEASE_MS + 1000);
+  check('a phone that vanished without an unwatch is let go', !watchers.has('s2') && opened[1].closed);
+
+  watchTranscript('s3');
+  expireWatches(now + WATCH_LEASE_MS + 1000);
+  check('an older app, which never renews, keeps its watch well past that', watchers.has('s3'));
+  renewWatch('s3', 'legacy', now + LEGACY_LEASE_MS - 5000);
+  expireWatches(now + LEGACY_LEASE_MS + 1000);
+  check('asking for the log renews it', watchers.has('s3'));
+  expireWatches(now + 2 * LEGACY_LEASE_MS);
+  check('and it still ends', !watchers.has('s3'));
+
+  renewWatch('s4', a);
+  check('a renewal never starts a watch by itself', !watchers.has('s4'));
+
+  // An older app with the chat still open lets its lease lapse while the
+  // session sits idle, then asks for the log when the session moves again.
+  watchTranscript('s5', 'legacy', now);
+  expireWatches(now + LEGACY_LEASE_MS + 1000);
+  check('an idle legacy chat lapses', !watchers.has('s5'));
+  renewWatch('s5', 'legacy', now + LEGACY_LEASE_MS + 60_000);
+  check('and asking for the log after that resumes the stream', watchers.has('s5'));
+  unwatchTranscript('s5', 'legacy');
+  watchTranscript('s6', 'legacy', now);
+  unwatchTranscript('s6', 'legacy');
+  renewWatch('s6', 'legacy', now + 1000);
+  check('a chat that was closed is not reopened by a later fetch', !watchers.has('s6'));
+}
+
+// ---------- the approvals socket comes back after a local takeover ----------
+{
+  const run = (inoOnDisk) => {
+    const log = { restarted: 0, closed: 0 };
+    const api = new Function('fs', 'ASK_SOCKET', 'bustHostCache', 'startApprovalServer', 'console', 'log',
+      `let approvalServer = { close() { log.closed++; } };
+       let approvalSocketIno = 41;
+       let approvalServerUp = true;
+       ${slice('/// A second copy started on this Mac unlinks the approvals socket', "// Claude Code's own status for each session")}
+       return () => { ensureApprovalSocket(); return approvalServerUp; };`,
+    )({ statSync: () => { if (inoOnDisk === null) throw new Error('ENOENT'); return { ino: inoOnDisk }; } },
+      '/tmp/approvals.sock', () => {}, () => { log.restarted++; }, { log() {} }, log);
+    const upAfter = api();
+    return { ...log, upAfter };
+  };
+  const same = run(41);
+  check('our own socket is left alone', same.restarted === 0 && same.closed === 0 && same.upAfter);
+  const replaced = run(99);
+  check('a socket another copy bound is taken back', replaced.restarted === 1 && replaced.closed === 1);
+  const gone = run(null);
+  check('so is a socket file that disappeared', gone.restarted === 1);
+  const onOpen = slice("  ws.on('open', () => {", "  ws.on('pong'");
+  check('and it is checked every time the relay is ours again', onOpen.includes('ensureApprovalSocket()'));
+}
+
+// ---------- prompts are acknowledged when they start ----------
+{
+  const sent = [];
+  const { promptAccepted, failureText } = new Function('toPhone',
+    `${slice('/// Tell the phone a headless run has started.', '// ---------- launching a new pilot ----------')}
+     return { promptAccepted, failureText };`)((m) => sent.push(m));
+  promptAccepted('abc');
+  check('a started run tells the phone ok at once', sent[0]?.type === 'promptResult' && sent[0].ok === true && sent[0].sessionId === 'abc');
+  check('a failure says why', failureText('codex', 1, 'warn: x\nerror: not logged in\n') === 'codex stopped: warn: x error: not logged in');
+  check('and falls back to the exit code', failureText('kimi', 2, '') === 'kimi exited with code 2');
+  for (const provider of ['claude --resume', 'spec.bin']) {
+    const at = src.indexOf(provider === 'spec.bin' ? 'const child = spawn(spec.bin' : "const child = spawn(bin, ['--resume'");
+    const block = src.slice(at, at + 1600);
+    check(`the ${provider === 'spec.bin' ? 'codex and kimi' : 'claude'} path acks on spawn`, /child\.on\('spawn', \(\) => promptAccepted\(/.test(block));
+  }
+}
+
+// ---------- turning approvals off lets go of what is held ----------
+{
+  const released = [];
+  const releaseAsksIfBack = new Function('pendingAsks', 'approvalConfig', 'releaseAllAsks', 'macIdleSeconds', 'settleAsk',
+    `${slice('function releaseAsksIfBack() {', '// ---------- self update ----------')} return releaseAsksIfBack;`,
+  )(new Map([['a1', {}]]), () => ({ mode: 'off' }), (note) => released.push(note), () => 0, () => {});
+  releaseAsksIfBack();
+  check('approvals off from the CLI hands held requests back', released[0] === 'remote approvals were turned off');
+  const phoneOff = slice('if (cmd.enabled === false) {', '} else {');
+  check('approvals off from the phone does too', phoneOff.includes("releaseAllAsks('remote approvals were turned off')"));
+}
+
+console.log(failures ? `\n${failures} check(s) failed` : '\nall checks passed');
+process.exit(failures ? 1 : 0);

package/test/grokbot.mjs

@@ -1,86 +0,0 @@
-// Runs the real Grok Bot reader out of daemon.mjs against whatever replica this
-// Mac has. The block is extracted from source rather than copied, so the test
-// cannot drift from what the daemon ships.
-//
-// The daemon is one long script that connects to the relay on import, so there
-// is nothing to import: pulling the section out by its comment markers and
-// evaluating it with its handful of helpers injected is what keeps this honest.
-//
-// On a Mac without Grok Bot installed the roster assertions are skipped and the
-// machine independent ones still run.
-import fs from 'node:fs';
-import os from 'node:os';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
-const src = fs.readFileSync(DAEMON, 'utf8');
-const start = src.indexOf('// ---------- Grok Bot session discovery ----------');
-const end = src.indexOf('/// The phone-facing shape of a held request.');
-if (start < 0 || end < 0 || end < start) throw new Error('could not locate the Grok Bot block in daemon.mjs');
-const block = src.slice(start, end);
-
-const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
-const isoOf = (t) => { try { return t ? new Date(t).toISOString() : null; } catch { return null; } };
-const memoScan = (_key, _file, fn) => fn();
-const transcriptCache = new Map();
-
-const load = (source, cache) => new Function('fs', 'os', 'path', 'readJson', 'isoOf', 'memoScan', 'transcriptCache',
-  `${source}\n return { readGrokBotSessions, readGrokBotMessages, b32decode, GROKBOT_DIR };`)(
-  fs, os, path, readJson, isoOf, memoScan, cache);
-
-const { readGrokBotSessions, readGrokBotMessages, b32decode, GROKBOT_DIR } = load(block, transcriptCache);
-
-let failures = 0;
-const check = (label, cond, detail = '') => {
-  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
-  if (!cond) failures++;
-};
-
-// A store key the app really writes, so a change to the encoding is caught here
-// rather than by an empty island.
-const known = 'onqw4zbomnwgszlooqxhg3djmnss4y3mnfsw45bnnvsxiyjomfrwg33vnz2c243mn52a';
-check('b32decode reads a real store key', b32decode(known) === 'sand.client.slice.client-meta.account-slot', b32decode(known));
-check('b32decode rejects junk', b32decode('!!!!') === '');
-
-// A Mac without Grok Bot must return an empty list rather than throw.
-check('missing install returns empty, does not throw',
-  load(block.replace(/const GROKBOT_DIR = .*/, "const GROKBOT_DIR = '/nope/not/here';"), new Map())
-    .readGrokBotSessions().length === 0);
-
-const sessions = fs.existsSync(GROKBOT_DIR) ? readGrokBotSessions() : [];
-if (!sessions.length) {
-  console.log(`\nskipped the roster checks: no Bots found in ${GROKBOT_DIR}`);
-  console.log(failures ? `\n${failures} FAILURE(S)` : '\nall checks passed');
-  process.exit(failures ? 1 : 0);
-}
-
-console.log(`\n${sessions.length} bot(s) found\n`);
-for (const s of sessions) {
-  check(`${s.name}: id is a uuid`, /^[0-9a-f-]{36}$/.test(s.id));
-  check(`${s.name}: status is one the app understands`, ['idle', 'busy', 'waiting'].includes(s.status));
-  check(`${s.name}: has a name`, !!s.name);
-  check(`${s.name}: startedAt set`, s.startedAt > 0);
-  check(`${s.name}: updatedAt set`, s.updatedAt > 0);
-  check(`${s.name}: read only flagged`, s.readOnly === true);
-  // Every field the Swift Session struct decodes as non-optional must be here,
-  // or the phone drops the whole snapshot, not just this row.
-  for (const k of ['id', 'name', 'cwd', 'project', 'status', 'updatedAt', 'startedAt']) {
-    check(`${s.name}: ${k} present for Swift decode`, s[k] !== undefined && s[k] !== null);
-  }
-
-  const file = transcriptCache.get(s.id);
-  check(`${s.name}: transcript located`, !!file);
-  if (!file) continue;
-  const msgs = readGrokBotMessages(file);
-  check(`${s.name}: transcript has messages`, msgs.length > 0);
-  check(`${s.name}: roles are user/assistant only`, msgs.every((m) => m.role === 'user' || m.role === 'assistant'));
-  check(`${s.name}: every message has a timestamp`, msgs.every((m) => !!m.ts));
-  check(`${s.name}: lastMessage matches transcript tail`, s.lastMessage?.text === msgs[msgs.length - 1]?.text);
-  // The app stores a ProseMirror doc beside every typed turn. Leaking it into
-  // the transcript would put raw JSON on the phone.
-  check(`${s.name}: no raw richText leaked into text`, msgs.every((m) => !m.text.includes('"type":"doc"')));
-}
-
-console.log(failures ? `\n${failures} FAILURE(S)` : '\nall checks passed');
-process.exit(failures ? 1 : 0);