@clastres/groundcontrol 0.1.11 → 0.1.12

package/daemon.mjs

@@ -15,14 +15,14 @@ import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline';
-import { spawn, spawnSync, execFile, execSync } from 'node:child_process';
+import { spawn, spawnSync, execFile, execFileSync, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
-const VERSION = '0.1.11';
+const VERSION = '0.1.12';
 const PACKAGE = '@clastres/groundcontrol';
 
 // ---------- config / pairing ----------
@@ -558,8 +558,41 @@ const pairString = `groundcontrol://pair#${pairPayload}`;
 console.log('\n  GROUND CONTROL daemon');
 console.log(`  relay:   ${RELAY}  (phone will use: ${relayForPhone})`);
 console.log(`  channel: ${CHANNEL}\n`);
-qrcode.generate(pairString, { small: true });
-console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
+// The pairing code and the QR both carry the key itself. They are for a person
+// at a terminal. Anywhere else stdout is a file, the launchd service's is
+// daemon.log, and a log is the thing people paste into a bug report.
+if (subcommand === 'qr' || process.stdout.isTTY) {
+  qrcode.generate(pairString, { small: true });
+  console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
+} else {
+  console.log('  Pairing code hidden here. Show it with: npx @clastres/groundcontrol qr\n');
+}
+if (runsFromServiceDir) scrubLogSecrets();
+
+/// Versions up to 0.1.11 printed the pairing code and its QR into daemon.log
+/// on every start, and the log was readable by every account on the Mac.
+/// Take both out of the existing log and close the permissions. Rewritten in
+/// place rather than replaced: launchd holds the file open for appending, and
+/// a new file would leave it writing into one that no longer exists.
+function scrubLogSecrets() {
+  for (const f of [LOG_FILE, path.join(CONF_DIR, 'daemon.err.log')]) {
+    try { fs.chmodSync(f, 0o600); } catch {}
+  }
+  try { fs.chmodSync(CONF_DIR, 0o700); } catch {}
+  try {
+    const raw = fs.readFileSync(LOG_FILE, 'utf8');
+    // A real code, not the [removed] marker left by an earlier pass, so a
+    // clean log is read once per start and never rewritten.
+    const code = /groundcontrol:\/\/pair#[A-Za-z0-9_-]/;
+    const qrRow = /^[█▀▄ ]{20,}$/;
+    if (!code.test(raw) && !/^[█▀▄ ]{20,}$/m.test(raw)) return;
+    const clean = raw.split('\n')
+      .filter((line) => !qrRow.test(line))
+      .join('\n')
+      .replace(/groundcontrol:\/\/pair#[A-Za-z0-9_-]+/g, 'groundcontrol://pair#[removed]');
+    fs.writeFileSync(LOG_FILE, clean);
+  } catch {}
+}
 
 if (subcommand === 'qr') process.exit(0);
 
@@ -784,10 +817,14 @@ async function injectPrompt(tty, text) {
   const clean = text.replace(/\r?\n/g, ' ').trim();
 
   if (apps.tmuxPanes.has(dev)) {
+    // No shell in between. Phone text used to go through execSync inside
+    // double quotes, where backticks and $(...) still run, so "rename `foo`"
+    // executed foo on this Mac before the agent ever saw the prompt.
+    const pane = apps.tmuxPanes.get(dev);
     try {
-      execSync(`tmux send-keys -t '${apps.tmuxPanes.get(dev)}' -l ${JSON.stringify(clean)}`);
+      execFileSync('tmux', ['send-keys', '-t', pane, '-l', '--', clean], { stdio: 'ignore' });
       await sleep(150);
-      execSync(`tmux send-keys -t '${apps.tmuxPanes.get(dev)}' Enter`);
+      execFileSync('tmux', ['send-keys', '-t', pane, 'Enter'], { stdio: 'ignore' });
       return 'tmux';
     } catch {}
   }
@@ -1569,6 +1606,8 @@ function hostState() {
 const bustHostCache = () => { hostCache.at = 0; };
 
 let approvalServerUp = false;
+let approvalServer = null;
+let approvalSocketIno = 0;   // which file at ASK_SOCKET is ours
 let availableUpdate = null;   // version string once a newer release is seen
 
 const pendingAsks = new Map();  // askId -> ask record
@@ -1768,12 +1807,33 @@ function startApprovalServer(attempt = 0) {
   });
   server.listen(ASK_SOCKET, () => {
     try { fs.chmodSync(ASK_SOCKET, 0o600); } catch {}
+    try { approvalSocketIno = fs.statSync(ASK_SOCKET).ino; } catch {}
+    approvalServer = server;
     approvalServerUp = true;
     bustHostCache();
     console.log(`[daemon] remote approvals ready (mode: ${approvalConfig().mode})`);
   });
 }
 
+/// A second copy started on this Mac unlinks the approvals socket and binds
+/// its own. When that copy then loses the relay back to this one and exits,
+/// the hook is left calling a file nobody listens on, and approvals stop
+/// reaching the phone until the next restart. Up to 0.1.11 the restart came
+/// quickly, because a displaced daemon exited; now that it waits instead,
+/// it has to take the socket back itself, every time the relay is ours again.
+function ensureApprovalSocket() {
+  if (!approvalServer) return;
+  let ino = 0;
+  try { ino = fs.statSync(ASK_SOCKET).ino; } catch {}
+  if (ino && ino === approvalSocketIno) return;
+  console.log('[daemon] another copy replaced the approvals socket, taking it back');
+  try { approvalServer.close(); } catch {}
+  approvalServer = null;
+  approvalServerUp = false;
+  bustHostCache();
+  startApprovalServer();
+}
+
 // Claude Code's own status for each session, as last seen on disk.
 const lastRawStatus = new Map(); // sessionId -> 'busy' | 'idle' | 'waiting' | ...
 
@@ -1828,6 +1888,9 @@ function releaseAnsweredOnMac() {
 function releaseAsksIfBack() {
   if (!pendingAsks.size) return;
   const cfg = approvalConfig();
+  // `groundcontrol approvals off` runs in another process; this is where the
+  // daemon notices it and hands back whatever it was still holding.
+  if (cfg.mode === 'off') return releaseAllAsks('remote approvals were turned off');
   if (cfg.mode !== 'away') return;
   if (macIdleSeconds() >= cfg.awayAfterSeconds) return;
   for (const ask of [...pendingAsks.values()]) {
@@ -1857,8 +1920,11 @@ function isNewer(candidate, current) {
 }
 
 async function latestPublishedVersion() {
+  // Plain JSON. The abbreviated install-v1 format only exists for the whole
+  // package document; asked of /latest the registry answers 406, and it did,
+  // on every check from 0.1.7 through 0.1.11, so no install ever updated.
   const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
-    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    headers: { accept: 'application/json' },
     signal: AbortSignal.timeout(15_000),
   });
   if (!res.ok) throw new Error(`registry ${res.status}`);
@@ -1906,9 +1972,9 @@ async function checkForUpdate({ force = false } = {}) {
 
 /// A daemon shutting down must hand every held request back rather than leave
 /// sessions blocked on a socket that will never answer.
-function releaseAllAsks() {
+function releaseAllAsks(note = 'the daemon stopped') {
   for (const ask of [...pendingAsks.values()]) {
-    settleAsk(ask, null, 'released', 'the daemon stopped');
+    settleAsk(ask, null, 'released', note);
   }
 }
 
@@ -1917,6 +1983,17 @@ function releaseAllAsks() {
 let ws = null;
 let lastSnapshotJson = '';
 
+/// Everything bound for the phone goes through here. The socket is replaced
+/// on every reconnect, and ws throws, rather than returning, when asked to
+/// send on one that is still connecting. From a file watcher or a child
+/// process callback that is an uncaught exception, which takes the daemon and
+/// every held approval down with it. The relay keeps no queue, so a message
+/// with no open socket is lost either way; the phone has timeouts for that.
+function toPhone(obj) {
+  if (ws?.readyState !== 1) return false;
+  try { ws.send(seal(obj)); return true; } catch { return false; }
+}
+
 function sendSnapshot(force = false) {
   // A parser tripping on a malformed journal must never take the daemon down:
   // this runs on a bare interval with nothing above it to catch a throw.
@@ -1940,37 +2017,102 @@ function sendSnapshot(force = false) {
 
 // Live transcript streaming: while a phone has a chat open, push transcript
 // updates the moment the JSONL file changes.
-const watchers = new Map(); // sessionId -> fs.FSWatcher
-function watchTranscript(sessionId) {
-  if (watchers.has(sessionId)) return;
+//
+// Every open chat holds a lease on its watch. Apps from 0.1.9 name themselves
+// and renew every minute, so one phone closing a chat no longer stops it
+// streaming on another, and a phone that vanishes without an unwatch (killed
+// app, dead network) stops costing this Mac a file watch plus a full
+// transcript read on every write within minutes instead of never. Older apps
+// never renew, so theirs is long and renewed whenever they ask for the log.
+const WATCH_LEASE_MS = 3 * 60_000;
+const LEGACY_LEASE_MS = 30 * 60_000;
+const PROMPT_LEASE_MS = 5 * 60_000;
+const leaseFor = (holder) => (holder === 'legacy' ? LEGACY_LEASE_MS : holder === 'prompt' ? PROMPT_LEASE_MS : WATCH_LEASE_MS);
+const holderOf = (cmd) => (typeof cmd.client === 'string' && cmd.client ? `phone:${cmd.client.slice(0, 64)}` : 'legacy');
+const watchers = new Map(); // sessionId -> { watcher, debounce, leases: Map<holder, expiresAt> }
+// Sessions whose legacy lease ran out rather than being unwatched: the chat
+// may well still be open on an older phone, which asks for the log again
+// whenever the session changes state. That is the moment to resume.
+const lapsedLegacy = new Map(); // sessionId -> when the lease ran out
+const LAPSED_FORGET_MS = 24 * 60 * 60 * 1000;
+
+/// Start or renew a watch. Returns 'created', 'renewed', or null when there
+/// is no transcript to watch.
+function watchTranscript(sessionId, holder = 'legacy', now = Date.now()) {
+  if (holder === 'legacy') lapsedLegacy.delete(sessionId);
+  const until = now + leaseFor(holder);
+  const entry = watchers.get(sessionId);
+  if (entry) {
+    entry.leases.set(holder, Math.max(until, entry.leases.get(holder) || 0));
+    return 'renewed';
+  }
   const file = findTranscript(sessionId);
-  if (!file) return;
-  let debounce;
+  if (!file) return null;
+  const next = { watcher: null, debounce: null, leases: new Map([[holder, until]]) };
   try {
     // Journals are appended to, so watching the file is enough.
-    const w = fs.watch(file, () => {
-      clearTimeout(debounce);
-      debounce = setTimeout(() => {
-        ws?.send(seal({ type: 'transcript', sessionId, messages: readMessages(sessionId) }));
+    next.watcher = fs.watch(file, () => {
+      clearTimeout(next.debounce);
+      next.debounce = setTimeout(() => {
+        toPhone({ type: 'transcript', sessionId, messages: readMessages(sessionId) });
       }, 250);
     });
-    watchers.set(sessionId, w);
+    watchers.set(sessionId, next);
     console.log(`[daemon] watching transcript ${sessionId.slice(0, 8)}`);
-  } catch {}
+    return 'created';
+  } catch { return null; }
 }
-function unwatchTranscript(sessionId) {
-  watchers.get(sessionId)?.close();
+
+/// Keep an existing lease alive without starting a watch nobody asked for,
+/// except the one an older app's open chat lost to the clock.
+function renewWatch(sessionId, holder, now = Date.now()) {
+  const entry = watchers.get(sessionId);
+  if (entry?.leases.has(holder)) {
+    entry.leases.set(holder, now + leaseFor(holder));
+    return;
+  }
+  if (holder === 'legacy' && lapsedLegacy.has(sessionId)) watchTranscript(sessionId, 'legacy', now);
+}
+
+function unwatchTranscript(sessionId, holder = 'legacy') {
+  if (holder === 'legacy') lapsedLegacy.delete(sessionId);
+  const entry = watchers.get(sessionId);
+  if (!entry) return;
+  entry.leases.delete(holder);
+  if (!entry.leases.size) closeWatch(sessionId, entry);
+}
+
+function closeWatch(sessionId, entry) {
+  clearTimeout(entry.debounce);
+  try { entry.watcher?.close(); } catch {}
   watchers.delete(sessionId);
 }
 
+function expireWatches(now = Date.now()) {
+  for (const [sessionId, entry] of watchers) {
+    for (const [holder, until] of entry.leases) {
+      if (until > now) continue;
+      entry.leases.delete(holder);
+      if (holder === 'legacy') lapsedLegacy.set(sessionId, now);
+    }
+    if (!entry.leases.size) closeWatch(sessionId, entry);
+  }
+  for (const [sessionId, at] of lapsedLegacy) if (now - at > LAPSED_FORGET_MS) lapsedLegacy.delete(sessionId);
+}
+
 async function handleCommand(cmd) {
   if (cmd.type === 'getTranscript' && cmd.sessionId) {
-    ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
+    renewWatch(cmd.sessionId, holderOf(cmd));
+    toPhone({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) });
   } else if (cmd.type === 'watch' && cmd.sessionId) {
-    watchTranscript(cmd.sessionId);
-    ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
+    const how = watchTranscript(cmd.sessionId, holderOf(cmd));
+    // A renewal only keeps the lease; the phone already has the log, unless
+    // this daemon restarted since and the watch had to be started again.
+    if (!cmd.renew || how === 'created') {
+      toPhone({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) });
+    }
   } else if (cmd.type === 'unwatch' && cmd.sessionId) {
-    unwatchTranscript(cmd.sessionId);
+    unwatchTranscript(cmd.sessionId, holderOf(cmd));
   } else if (cmd.type === 'setApprovals') {
     // A deliberate tap in the app, with the app explaining what it adds, is
     // the consent for this. A backup is still written before any change.
@@ -1978,6 +2120,8 @@ async function handleCommand(cmd) {
     if (cmd.enabled === false) {
       writeApprovalConfig({ mode: 'off' });
       result = uninstallApprovalHook();
+      // Off means off for what is already held too, not just what comes next.
+      releaseAllAsks('remote approvals were turned off');
       console.log('[daemon] remote approvals turned off from the phone');
     } else {
       const mode = ['away', 'always'].includes(cmd.mode) ? cmd.mode : 'away';
@@ -1987,21 +2131,21 @@ async function handleCommand(cmd) {
     }
     bustHostCache();
     sendSnapshot(true);
-    ws?.send(seal({
+    toPhone({
       type: 'approvalsResult',
       ok: !!result.ok,
       error: result.ok ? '' : (result.reason || 'could not change the setting'),
       host: hostState(),
-    }));
+    });
   } else if (cmd.type === 'approve' || cmd.type === 'deny') {
     const ask = cmd.askId ? pendingAsks.get(cmd.askId) : null;
     if (!ask) {
       // Answered on the Mac, expired, or the session moved on while the tap
       // was in flight. Tell the phone so the card clears instead of hanging.
-      return ws?.send(seal({
+      return toPhone({
         type: 'askResolved', askId: cmd.askId || '', sessionId: cmd.sessionId || '',
         outcome: 'gone', note: 'that request is no longer waiting',
-      }));
+      });
     }
     if (cmd.type === 'approve') {
       settleAsk(ask, { behavior: 'allow', ...(cmd.always ? { alwaysAllow: true } : {}) },
@@ -2012,19 +2156,19 @@ async function handleCommand(cmd) {
         'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
     }
   } else if (cmd.type === 'projects') {
-    ws?.send(seal({
+    toPhone({
       type: 'projects',
       projects: knownProjects().map((p) => ({ path: p.path, name: p.name, at: p.at })),
       providers: launchProviders(),
-    }));
+    });
   } else if (cmd.type === 'launch') {
     await launchSession(cmd);
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
-    ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
+    toPhone({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() });
   } else if (cmd.type === 'prompt' && cmd.sessionId && cmd.text) {
     const session = readSessions().find((s) => s.id === cmd.sessionId);
-    if (!session) return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' }));
+    if (!session) return toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' });
 
     if (session.provider && session.provider !== 'claude') return promptHeadless(session, cmd.text);
 
@@ -2033,27 +2177,27 @@ async function handleCommand(cmd) {
       const method = await injectPrompt(session.tty, cmd.text);
       if (method) {
         console.log(`[daemon] injected prompt into ${session.name} via ${method}`);
-        ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: true, text: '' }));
-        watchTranscript(cmd.sessionId);
+        toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: true, text: '' });
+        watchTranscript(cmd.sessionId, 'prompt');
         sendSnapshot(true);
         return;
       }
       if (automationDenied) {
         console.log('[daemon] prompt blocked: macOS Automation permission missing');
-        return ws?.send(seal({
+        return toPhone({
           type: 'promptResult', sessionId: cmd.sessionId, ok: false,
           error: 'Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then send again.',
-        }));
+        });
       }
     }
-    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
+    if (session.status === 'busy') return toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' });
     const bin = claudeBin();
     if (!bin) {
       console.log('[daemon] prompt failed: claude binary not found on PATH');
-      return ws?.send(seal({
+      return toPhone({
         type: 'promptResult', sessionId: cmd.sessionId, ok: false,
         error: 'The daemon could not find the claude command on this Mac. Open a terminal, check that claude runs, then reinstall with: npx @clastres/groundcontrol',
-      }));
+      });
     }
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
@@ -2069,11 +2213,13 @@ async function handleCommand(cmd) {
       if (responded) return;
       responded = true;
       headlessActive.delete(cmd.sessionId);
-      ws?.send(seal(payload));
+      toPhone(payload);
       sendSnapshot(true);
     };
     child.stdout.on('data', (d) => { out += d; });
     child.stderr.on('data', (d) => { err += d; });
+    // Delivered is not done: the turn can run for minutes. See promptAccepted.
+    child.on('spawn', () => promptAccepted(cmd.sessionId));
     child.on('error', (e) => {
       console.log(`[daemon] claude spawn failed: ${e.message}`);
       respond({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: `could not run claude: ${e.message}` });
@@ -2082,6 +2228,7 @@ async function handleCommand(cmd) {
       respond({
         type: 'promptResult', sessionId: cmd.sessionId, ok: code === 0,
         text: (out || err).trim().slice(0, 4000),
+        ...(code === 0 ? {} : { error: failureText('claude', code, err || out) }),
       });
     });
   }
@@ -2110,15 +2257,15 @@ function bustProviderCaches() {
 function promptHeadless(session, text) {
   // Anything but idle means another writer owns the session right now: busy
   // is a running turn, waiting is a human approval the phone cannot answer.
-  if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' }));
-  if (session.status !== 'idle') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' }));
+  if (session.status === 'busy') return toPhone({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' });
+  if (session.status !== 'idle') return toPhone({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' });
   const spec = headlessPromptSpec[session.provider]?.();
   if (!spec) {
     console.log(`[daemon] ${session.provider} prompt failed: binary not found`);
-    return ws?.send(seal({
+    return toPhone({
       type: 'promptResult', sessionId: session.id, ok: false,
       error: `The daemon could not find the ${session.provider === 'codex' ? 'codex' : 'kimi'} command on this Mac, so it cannot reach this session. If you just installed it, try again in a minute.`,
-    }));
+    });
   }
   console.log(`[daemon] prompt -> ${session.provider} ${session.name}: ${text.slice(0, 60)}`);
   const promptedAt = Date.now();
@@ -2137,11 +2284,12 @@ function promptHeadless(session, text) {
     responded = true;
     headlessActive.delete(session.id);
     bustProviderCaches();
-    ws?.send(seal(payload));
+    toPhone(payload);
     sendSnapshot(true);
   };
   child.stderr.on('data', (d) => { err += d; });
   child.stdout.on('data', () => {});
+  child.on('spawn', () => promptAccepted(session.id));
   child.on('error', (e) => {
     console.log(`[daemon] ${session.provider} spawn failed: ${e.message}`);
     respond({ type: 'promptResult', sessionId: session.id, ok: false, error: `could not run ${session.provider}: ${e.message}` });
@@ -2156,9 +2304,26 @@ function promptHeadless(session, text) {
     respond({
       type: 'promptResult', sessionId: session.id, ok: code === 0,
       text: code === 0 ? (reply?.text || '').slice(0, 4000) : err.trim().slice(0, 4000),
+      ...(code === 0 ? {} : { error: failureText(session.provider, code, err) }),
     });
   });
-  watchTranscript(session.id);
+  watchTranscript(session.id, 'prompt');
+}
+
+/// Tell the phone a headless run has started. The run answers only when the
+/// whole turn is over, often minutes later, and the app gives up on a prompt
+/// after 30 seconds: up to 0.1.8 it then showed "no reply from mac yet" and
+/// kept showing it after the run succeeded. An ok now clears the pending
+/// prompt; a failure later still arrives as its own result.
+function promptAccepted(sessionId) {
+  toPhone({ type: 'promptResult', sessionId, ok: true, text: '', accepted: true });
+}
+
+/// A failed run's last words, for the phone. Whatever the agent printed on
+/// stderr last is usually the reason; the exit code is the fallback.
+function failureText(provider, code, output) {
+  const tail = String(output || '').trim().split('\n').filter(Boolean).slice(-3).join(' ').slice(0, 300);
+  return tail ? `${provider} stopped: ${tail}` : `${provider} exited with code ${code}`;
 }
 
 // ---------- launching a new pilot ----------
@@ -2259,7 +2424,7 @@ const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
 let lastLaunchAt = 0;
 
 async function launchSession(cmd) {
-  const fail = (error) => ws?.send(seal({ type: 'launchResult', ok: false, error }));
+  const fail = (error) => toPhone({ type: 'launchResult', ok: false, error });
 
   const providers = launchProviders();
   const provider = cmd.provider || 'claude';
@@ -2317,18 +2482,60 @@ end tell`);
   // The new session reaches the island through the same discovery every other
   // one does, which takes a few seconds. Say so rather than implying the pilot
   // is already there.
-  ws?.send(seal({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` }));
+  toPhone({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` });
   sendSnapshot(true);
 }
 
+// Replay protection. The relay only ever sees ciphertext, but it could send
+// a captured command again, and it would decrypt just fine. Every sealed
+// message opens with a random 12 byte nonce, so one seen twice is a replay.
+// Keyed on the decoded bytes, not the text: base64 decoding skips whitespace
+// and takes either alphabet, so one frame can be spelled many ways.
+// Apps from 0.1.9 also stamp each command with when it was sent, which turns
+// away old captures even after a restart has emptied this cache. Commands
+// from older apps carry no stamp and get the nonce check alone.
+const seenNonces = new Map();              // nonce, hex -> seen at
+const NONCE_TTL_MS = 24 * 60 * 60 * 1000;
+const NONCE_CAP = 20_000;
+const COMMAND_MAX_SKEW_MS = 10 * 60 * 1000;
+function freshCommand(b64, cmd, now = Date.now()) {
+  const nonce = Buffer.from(b64, 'base64').subarray(0, 12).toString('hex');
+  if (seenNonces.has(nonce)) return false;
+  if (typeof cmd?.at === 'number' && Math.abs(now - cmd.at) > COMMAND_MAX_SKEW_MS) return false;
+  seenNonces.set(nonce, now);
+  // Oldest first, so trimming stops at the first one worth keeping.
+  for (const [k, t] of seenNonces) {
+    if (now - t > NONCE_TTL_MS || seenNonces.size > NONCE_CAP) seenNonces.delete(k);
+    else break;
+  }
+  return true;
+}
+
 let lastPongAt = Date.now();
+let connectedAt = 0;
+let takeovers = 0;   // in a row; reset once a connection has held for a while
+
+/// How long to stay off the relay after another host took the channel.
+/// Exiting instead, as this did up to 0.1.11, hands the job to launchd, which
+/// starts us again five seconds later; we take the channel back, the other
+/// host takes it back, and round it goes. One Mac logged 1,123 restarts that
+/// way, in bursts of ten, against another machine sharing its key.
+function takeoverBackoffMs(n) {
+  return Math.min(15 * 60_000, 60_000 * 2 ** Math.max(0, n - 1));
+}
 
 function connect() {
   // handshakeTimeout: a dial that never completes would otherwise sit in
   // CONNECTING forever without firing close, freezing the retry loop.
   ws = new WebSocket(`${RELAY}/ch/${CHANNEL}?role=host`, { handshakeTimeout: 15_000 });
   lastPongAt = Date.now();
-  ws.on('open', () => { lastPongAt = Date.now(); console.log('[daemon] connected to relay'); sendSnapshot(true); });
+  ws.on('open', () => {
+    lastPongAt = Date.now();
+    connectedAt = Date.now();
+    console.log('[daemon] connected to relay');
+    ensureApprovalSocket();
+    sendSnapshot(true);
+  });
   ws.on('pong', () => { lastPongAt = Date.now(); });
   ws.on('message', (data) => {
     const str = data.toString();
@@ -2343,14 +2550,30 @@ function connect() {
     // which is what the approval policy checks before holding a prompt.
     try {
       const cmd = open(str);
+      if (!freshCommand(str, cmd)) {
+        const off = typeof cmd?.at === 'number' ? Math.round((Date.now() - cmd.at) / 60_000) : 0;
+        console.log(`[daemon] dropped a repeated or stale ${cmd?.type || 'command'}`
+          + (Math.abs(off) >= 10 ? ` (stamped ${off} min off this Mac's clock)` : ''));
+        return;
+      }
       notePhoneSeen();
       handleCommand(cmd)?.catch?.(() => {});
     } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
   });
   ws.on('close', (code) => {
     if (code === 4001) {
-      console.log('[daemon] another daemon took over this channel, exiting. Run only one copy.');
-      process.exit(0);
+      // A copy someone started by hand should get out of the way and say why.
+      if (!runsFromServiceDir) {
+        console.log('[daemon] another daemon took over this channel, exiting. Run only one copy.');
+        process.exit(0);
+      }
+      if (connectedAt && Date.now() - connectedAt > 10 * 60_000) takeovers = 0;
+      takeovers++;
+      const wait = takeoverBackoffMs(takeovers);
+      console.log(`[daemon] another host took over this pairing (${takeovers} in a row), trying again in ${Math.round(wait / 60_000)} min. `
+        + 'Another Mac or a second copy is using this key; remove it there with: npx @clastres/groundcontrol service uninstall');
+      setTimeout(connect, wait);
+      return;
     }
     console.log('[daemon] relay disconnected, retrying in 3s');
     setTimeout(connect, 3000);
@@ -2374,6 +2597,7 @@ for (const cmd of hookState.foreign || []) console.log(`[daemon] another app als
 startApprovalServer();
 setInterval(releaseAsksIfBack, 3000);
 setInterval(releaseAnsweredOnMac, 2000);
+setInterval(expireWatches, 30_000);
 
 // Self update. Staggered off startup so a login storm does not hit the
 // registry at once, then re-checked hourly (the daily stamp does the gating).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "See and command your coding agents from your iPhone. Pairs the Ground Control app with Claude Code, Codex and Kimi sessions running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "bin/groundcontrol.mjs"

package/test/review-fixes.mjs

@@ -0,0 +1,294 @@
+// The fixes from the 2026-09-22 review, each pinned to the failure it fixes.
+// Same approach as the other files here: lift the real function out of
+// daemon.mjs and run it against fakes, so what is tested is what ships.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
+const src = fs.readFileSync(DAEMON, 'utf8');
+
+/// The source between two markers, which must both exist and be in order.
+function slice(from, to) {
+  const start = src.indexOf(from);
+  const end = src.indexOf(to, start + 1);
+  if (start < 0 || end < 0) throw new Error(`could not locate ${from.slice(0, 50)} in daemon.mjs`);
+  return src.slice(start, end);
+}
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+// ---------- phone text never reaches a shell ----------
+{
+  const calls = [];
+  const { injectPrompt } = new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return { injectPrompt };`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { calls.push({ file, args }); return Buffer.from(''); },
+    (cmd) => { calls.push({ shell: cmd }); return Buffer.from(''); },
+    async () => {},
+    async () => 'notfound',
+    (s) => s,
+  );
+  const text = 'rename `foo` to $(whoami) and keep $HOME';
+  const method = await injectPrompt('ttys009', text);
+  check('a tmux session is typed into through tmux', method === 'tmux', `got ${method}`);
+  check('nothing goes through a shell', calls.every((c) => !c.shell), JSON.stringify(calls.filter((c) => c.shell)));
+  const typed = calls.find((c) => c.args?.includes('-l'));
+  check('the prompt arrives as one literal argument, backticks and all',
+    typed?.file === 'tmux' && typed.args.at(-1) === text, JSON.stringify(typed));
+  const dashed = [];
+  await new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return injectPrompt;`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { dashed.push(args); return Buffer.from(''); },
+    () => { throw new Error('shell'); },
+    async () => {}, async () => 'notfound', (s) => s,
+  )('ttys009', '-t is not a flag here');
+  check('a prompt starting with a dash is not read as a tmux option',
+    dashed[0]?.indexOf('--') === dashed[0]?.length - 2, JSON.stringify(dashed[0]));
+}
+
+// ---------- sends while reconnecting do not throw ----------
+{
+  const run = (ws) => new Function('ws', 'seal',
+    `${slice('/// Everything bound for the phone goes through here.', 'function sendSnapshot(')}
+     return toPhone;`)(ws, (o) => JSON.stringify(o));
+  const connecting = { readyState: 0, send() { throw new Error('WebSocket is not open: readyState 0 (CONNECTING)'); } };
+  let threw = false;
+  let sent;
+  try { sent = run(connecting)({ type: 'transcript' }); } catch { threw = true; }
+  check('a send while the next socket is still connecting does not throw', !threw && sent === false);
+  check('a send with no socket at all is dropped quietly', run(null)({ type: 'x' }) === false);
+  const out = [];
+  check('an open socket still gets the message', run({ readyState: 1, send: (d) => out.push(d) })({ type: 'x' }) === true && out.length === 1);
+}
+
+// ---------- self update asks npm a question it answers ----------
+{
+  const requests = [];
+  // The registry's real behaviour: the abbreviated document only exists for
+  // the package root, so /latest with that accept header is a 406.
+  const fakeFetch = async (url, opts) => {
+    requests.push({ url, accept: opts?.headers?.accept });
+    if (/\/latest$/.test(url) && String(opts?.headers?.accept).includes('vnd.npm.install-v1')) {
+      return { ok: false, status: 406, json: async () => ({}) };
+    }
+    return { ok: true, status: 200, json: async () => ({ name: '@clastres/groundcontrol', version: '0.1.12' }) };
+  };
+  const latest = new Function('fetch', 'PACKAGE',
+    `${slice('async function latestPublishedVersion() {', '/// Re-install the service from the newly published version.')}
+     return latestPublishedVersion;`)(fakeFetch, '@clastres/groundcontrol');
+  let version = null;
+  let error = null;
+  try { version = await latest(); } catch (e) { error = e.message; }
+  check('the update check gets a version back', version === '0.1.12', error || '');
+  check('it asks the latest endpoint of the right package',
+    requests[0]?.url === 'https://registry.npmjs.org/@clastres/groundcontrol/latest', requests[0]?.url);
+}
+
+// ---------- a takeover backs off instead of restarting ----------
+{
+  const backoff = new Function(`${slice('/// How long to stay off the relay', 'function connect() {')} return takeoverBackoffMs;`)();
+  const mins = [1, 2, 3, 4, 5, 6, 9].map((n) => backoff(n) / 60_000);
+  check('the first takeover waits a minute, then doubles', mins[0] === 1 && mins[1] === 2 && mins[2] === 4 && mins[3] === 8, mins.join(','));
+  check('and never waits more than fifteen minutes', mins.slice(4).every((m) => m === 15), mins.join(','));
+  const closeHandler = slice("  ws.on('close', (code) => {", "  ws.on('error', () => {});");
+  check('the service copy no longer exits on a takeover',
+    /if \(!runsFromServiceDir\) \{[\s\S]*process\.exit\(0\);[\s\S]*\}[\s\S]*setTimeout\(connect, wait\)/.test(closeHandler));
+}
+
+// ---------- replayed and stale commands are refused ----------
+{
+  const fresh = new Function(`${slice('// Replay protection.', 'let lastPongAt = Date.now();')} return freshCommand;`)();
+  const now = Date.now();
+  const frame = (tag) => `${tag.padEnd(16, 'A')}restOfTheCiphertext==`;
+  check('a new command is accepted', fresh(frame('n1'), { type: 'prompt', at: now }, now));
+  check('the same frame again is a replay', !fresh(frame('n1'), { type: 'prompt', at: now }, now + 1000));
+  check('a stamped command from twenty minutes ago is stale', !fresh(frame('n2'), { type: 'prompt', at: now - 20 * 60_000 }, now));
+  check('a clock a little ahead is fine', fresh(frame('n3'), { type: 'prompt', at: now + 60_000 }, now));
+  check('an older app with no stamp still gets through once', fresh(frame('n4'), { type: 'watch' }, now));
+  check('but not twice', !fresh(frame('n4'), { type: 'watch' }, now));
+
+  // The relay can respell a frame: base64 decoding skips whitespace and takes
+  // either alphabet. Every spelling must still count as the same frame.
+  const key = crypto.randomBytes(32);
+  const open = new Function('key', 'crypto', 'Buffer',
+    `${slice('function open(b64) {', '// ---------- environment hardening ----------')} return open;`)(key, crypto, Buffer);
+  const seal = (obj) => {
+    const nonce = crypto.randomBytes(12);
+    const c = crypto.createCipheriv('chacha20-poly1305', key, nonce, { authTagLength: 16 });
+    const ct = Buffer.concat([c.update(JSON.stringify(obj)), c.final()]);
+    return Buffer.concat([nonce, ct, c.getAuthTag()]).toString('base64');
+  };
+  const real = seal({ type: 'prompt', sessionId: 's', text: 'hi', at: now });
+  const spellings = [` ${real}`, `\n${real}`, `${real.slice(0, 8)} ${real.slice(8)}`, real.replace(/\+/g, '-').replace(/\//g, '_')];
+  check('a real frame is accepted', fresh(real, open(real), now));
+  for (const alt of spellings) {
+    let decoded = null;
+    try { decoded = open(alt); } catch {}
+    check(`respelled ${JSON.stringify(alt.slice(0, 3))}... still decrypts, and is still a replay`, decoded?.text === 'hi' && !fresh(alt, decoded, now + 5));
+  }
+}
+
+// ---------- the pairing key stays out of the log ----------
+{
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gc-scrub-'));
+  const LOG_FILE = path.join(dir, 'daemon.log');
+  const qrRow = '█ ▄▄▄▄▄ █ █▄▀▀█▄█ ▀█ ▄▀█ █▀  ▄█▄▄  █▀▄█ ▄▄▄▄▄ █';
+  fs.writeFileSync(LOG_FILE, [
+    '[daemon] connected to relay',
+    '▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄',
+    qrRow,
+    '  Pairing code (paste into the app):',
+    '  groundcontrol://pair#eyJ2IjoxLCJrIjoic2VjcmV0In0',
+    '[daemon] snapshot -> 2 session(s): a:idle, b:busy',
+    '',
+  ].join('\n'), { mode: 0o644 });
+  new Function('fs', 'path', 'LOG_FILE', 'CONF_DIR',
+    `${slice('/// Versions up to 0.1.11 printed the pairing code', "if (subcommand === 'qr') process.exit(0);")}
+     scrubLogSecrets();`)(fs, path, LOG_FILE, dir);
+  const after = fs.readFileSync(LOG_FILE, 'utf8');
+  check('the pairing code is gone from the log', !after.includes('eyJ2IjoxLCJrIjoic2VjcmV0In0'));
+  check('so is the QR that encodes it', !after.includes(qrRow) && !after.includes('▄▄▄▄▄▄▄▄'));
+  check('everything else in the log is kept', after.includes('[daemon] connected to relay') && after.includes('b:busy'));
+  check('the log is readable by its owner only', (fs.statSync(LOG_FILE).mode & 0o777) === 0o600,
+    (fs.statSync(LOG_FILE).mode & 0o777).toString(8));
+  let writes = 0;
+  const spyFs = { ...fs, writeFileSync: (...a) => { writes++; return fs.writeFileSync(...a); } };
+  new Function('fs', 'path', 'LOG_FILE', 'CONF_DIR',
+    `${slice('/// Versions up to 0.1.11 printed the pairing code', "if (subcommand === 'qr') process.exit(0);")}
+     scrubLogSecrets();`)(spyFs, path, LOG_FILE, dir);
+  check('a log already scrubbed is not rewritten on the next start', writes === 0, `${writes} write(s)`);
+  const print = slice("if (subcommand === 'qr' || process.stdout.isTTY) {", "if (runsFromServiceDir) scrubLogSecrets();");
+  check('a daemon writing to a file prints no pairing code', /else \{\s*console\.log\('  Pairing code hidden here/.test(print));
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------- watch leases ----------
+{
+  const opened = [];
+  const fakeFs = {
+    watch(file, cb) {
+      const w = { file, cb, closed: false, close() { this.closed = true; } };
+      opened.push(w);
+      return w;
+    },
+  };
+  const sent = [];
+  const api = new Function('fs', 'findTranscript', 'readMessages', 'toPhone',
+    `${slice('const WATCH_LEASE_MS', 'async function handleCommand(cmd) {')}
+     return { watchTranscript, unwatchTranscript, renewWatch, expireWatches, holderOf, watchers, WATCH_LEASE_MS, LEGACY_LEASE_MS };`,
+  )(fakeFs, (id) => `/tmp/${id}.jsonl`, () => [], (m) => sent.push(m));
+  const { watchTranscript, unwatchTranscript, renewWatch, expireWatches, holderOf, watchers, WATCH_LEASE_MS, LEGACY_LEASE_MS } = api;
+  const a = holderOf({ client: 'phone-a' });
+  const b = holderOf({ client: 'phone-b' });
+
+  check('the first watch starts one', watchTranscript('s1', a) === 'created' && opened.length === 1);
+  check('a second phone shares it', watchTranscript('s1', b) === 'renewed' && opened.length === 1);
+  unwatchTranscript('s1', a);
+  check('one phone closing the chat keeps it streaming for the other', watchers.has('s1') && !opened[0].closed);
+  unwatchTranscript('s1', b);
+  check('the last one closing stops it', !watchers.has('s1') && opened[0].closed);
+
+  watchTranscript('s2', a);
+  const now = Date.now();
+  expireWatches(now + WATCH_LEASE_MS - 1000);
+  check('a lease inside its window stays', watchers.has('s2'));
+  expireWatches(now + WATCH_LEASE_MS + 1000);
+  check('a phone that vanished without an unwatch is let go', !watchers.has('s2') && opened[1].closed);
+
+  watchTranscript('s3');
+  expireWatches(now + WATCH_LEASE_MS + 1000);
+  check('an older app, which never renews, keeps its watch well past that', watchers.has('s3'));
+  renewWatch('s3', 'legacy', now + LEGACY_LEASE_MS - 5000);
+  expireWatches(now + LEGACY_LEASE_MS + 1000);
+  check('asking for the log renews it', watchers.has('s3'));
+  expireWatches(now + 2 * LEGACY_LEASE_MS);
+  check('and it still ends', !watchers.has('s3'));
+
+  renewWatch('s4', a);
+  check('a renewal never starts a watch by itself', !watchers.has('s4'));
+
+  // An older app with the chat still open lets its lease lapse while the
+  // session sits idle, then asks for the log when the session moves again.
+  watchTranscript('s5', 'legacy', now);
+  expireWatches(now + LEGACY_LEASE_MS + 1000);
+  check('an idle legacy chat lapses', !watchers.has('s5'));
+  renewWatch('s5', 'legacy', now + LEGACY_LEASE_MS + 60_000);
+  check('and asking for the log after that resumes the stream', watchers.has('s5'));
+  unwatchTranscript('s5', 'legacy');
+  watchTranscript('s6', 'legacy', now);
+  unwatchTranscript('s6', 'legacy');
+  renewWatch('s6', 'legacy', now + 1000);
+  check('a chat that was closed is not reopened by a later fetch', !watchers.has('s6'));
+}
+
+// ---------- the approvals socket comes back after a local takeover ----------
+{
+  const run = (inoOnDisk) => {
+    const log = { restarted: 0, closed: 0 };
+    const api = new Function('fs', 'ASK_SOCKET', 'bustHostCache', 'startApprovalServer', 'console', 'log',
+      `let approvalServer = { close() { log.closed++; } };
+       let approvalSocketIno = 41;
+       let approvalServerUp = true;
+       ${slice('/// A second copy started on this Mac unlinks the approvals socket', "// Claude Code's own status for each session")}
+       return () => { ensureApprovalSocket(); return approvalServerUp; };`,
+    )({ statSync: () => { if (inoOnDisk === null) throw new Error('ENOENT'); return { ino: inoOnDisk }; } },
+      '/tmp/approvals.sock', () => {}, () => { log.restarted++; }, { log() {} }, log);
+    const upAfter = api();
+    return { ...log, upAfter };
+  };
+  const same = run(41);
+  check('our own socket is left alone', same.restarted === 0 && same.closed === 0 && same.upAfter);
+  const replaced = run(99);
+  check('a socket another copy bound is taken back', replaced.restarted === 1 && replaced.closed === 1);
+  const gone = run(null);
+  check('so is a socket file that disappeared', gone.restarted === 1);
+  const onOpen = slice("  ws.on('open', () => {", "  ws.on('pong'");
+  check('and it is checked every time the relay is ours again', onOpen.includes('ensureApprovalSocket()'));
+}
+
+// ---------- prompts are acknowledged when they start ----------
+{
+  const sent = [];
+  const { promptAccepted, failureText } = new Function('toPhone',
+    `${slice('/// Tell the phone a headless run has started.', '// ---------- launching a new pilot ----------')}
+     return { promptAccepted, failureText };`)((m) => sent.push(m));
+  promptAccepted('abc');
+  check('a started run tells the phone ok at once', sent[0]?.type === 'promptResult' && sent[0].ok === true && sent[0].sessionId === 'abc');
+  check('a failure says why', failureText('codex', 1, 'warn: x\nerror: not logged in\n') === 'codex stopped: warn: x error: not logged in');
+  check('and falls back to the exit code', failureText('kimi', 2, '') === 'kimi exited with code 2');
+  for (const provider of ['claude --resume', 'spec.bin']) {
+    const at = src.indexOf(provider === 'spec.bin' ? 'const child = spawn(spec.bin' : "const child = spawn(bin, ['--resume'");
+    const block = src.slice(at, at + 1600);
+    check(`the ${provider === 'spec.bin' ? 'codex and kimi' : 'claude'} path acks on spawn`, /child\.on\('spawn', \(\) => promptAccepted\(/.test(block));
+  }
+}
+
+// ---------- turning approvals off lets go of what is held ----------
+{
+  const released = [];
+  const releaseAsksIfBack = new Function('pendingAsks', 'approvalConfig', 'releaseAllAsks', 'macIdleSeconds', 'settleAsk',
+    `${slice('function releaseAsksIfBack() {', '// ---------- self update ----------')} return releaseAsksIfBack;`,
+  )(new Map([['a1', {}]]), () => ({ mode: 'off' }), (note) => released.push(note), () => 0, () => {});
+  releaseAsksIfBack();
+  check('approvals off from the CLI hands held requests back', released[0] === 'remote approvals were turned off');
+  const phoneOff = slice('if (cmd.enabled === false) {', '} else {');
+  check('approvals off from the phone does too', phoneOff.includes("releaseAllAsks('remote approvals were turned off')"));
+}
+
+console.log(failures ? `\n${failures} check(s) failed` : '\nall checks passed');
+process.exit(failures ? 1 : 0);