@clastres/groundcontrol 0.1.11 → 0.1.13

package/daemon.mjs

@@ -15,14 +15,14 @@ import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
 import readline from 'node:readline';
-import { spawn, spawnSync, execFile, execSync } from 'node:child_process';
+import { spawn, spawnSync, execFile, execFileSync, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
-const VERSION = '0.1.11';
+const VERSION = '0.1.13';
 const PACKAGE = '@clastres/groundcontrol';
 
 // ---------- config / pairing ----------
@@ -84,6 +84,16 @@ const LOG_FILE = path.join(CONF_DIR, 'daemon.log');
 const THIS_FILE = fs.realpathSync(fileURLToPath(import.meta.url));
 const runsFromServiceDir = THIS_FILE.startsWith(SERVICE_DIR + path.sep);
 
+// The service log had no times, so a run of "stale relay link" lines could not
+// be told apart: a Mac waking from sleep, or a link failing every minute.
+// Only daemon lines, and only in the service, so the setup output stays clean.
+if (runsFromServiceDir) {
+  const plain = console.log.bind(console);
+  console.log = (first, ...rest) => (typeof first === 'string' && first.startsWith('[daemon]')
+    ? plain(`${new Date().toISOString()} ${first}`, ...rest)
+    : plain(first, ...rest));
+}
+
 const launchctl = (args) => {
   try { return execSync(`launchctl ${args}`, { stdio: 'pipe' }).toString(); }
   catch (e) { return (e.stdout?.toString() || '') + (e.stderr?.toString() || ''); }
@@ -558,8 +568,41 @@ const pairString = `groundcontrol://pair#${pairPayload}`;
 console.log('\n  GROUND CONTROL daemon');
 console.log(`  relay:   ${RELAY}  (phone will use: ${relayForPhone})`);
 console.log(`  channel: ${CHANNEL}\n`);
-qrcode.generate(pairString, { small: true });
-console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
+// The pairing code and the QR both carry the key itself. They are for a person
+// at a terminal. Anywhere else stdout is a file, the launchd service's is
+// daemon.log, and a log is the thing people paste into a bug report.
+if (subcommand === 'qr' || process.stdout.isTTY) {
+  qrcode.generate(pairString, { small: true });
+  console.log(`\n  Pairing code (paste into the app):\n\n  ${pairString}\n`);
+} else {
+  console.log('  Pairing code hidden here. Show it with: npx @clastres/groundcontrol qr\n');
+}
+if (runsFromServiceDir) scrubLogSecrets();
+
+/// Versions up to 0.1.11 printed the pairing code and its QR into daemon.log
+/// on every start, and the log was readable by every account on the Mac.
+/// Take both out of the existing log and close the permissions. Rewritten in
+/// place rather than replaced: launchd holds the file open for appending, and
+/// a new file would leave it writing into one that no longer exists.
+function scrubLogSecrets() {
+  for (const f of [LOG_FILE, path.join(CONF_DIR, 'daemon.err.log')]) {
+    try { fs.chmodSync(f, 0o600); } catch {}
+  }
+  try { fs.chmodSync(CONF_DIR, 0o700); } catch {}
+  try {
+    const raw = fs.readFileSync(LOG_FILE, 'utf8');
+    // A real code, not the [removed] marker left by an earlier pass, so a
+    // clean log is read once per start and never rewritten.
+    const code = /groundcontrol:\/\/pair#[A-Za-z0-9_-]/;
+    const qrRow = /^[█▀▄ ]{20,}$/;
+    if (!code.test(raw) && !/^[█▀▄ ]{20,}$/m.test(raw)) return;
+    const clean = raw.split('\n')
+      .filter((line) => !qrRow.test(line))
+      .join('\n')
+      .replace(/groundcontrol:\/\/pair#[A-Za-z0-9_-]+/g, 'groundcontrol://pair#[removed]');
+    fs.writeFileSync(LOG_FILE, clean);
+  } catch {}
+}
 
 if (subcommand === 'qr') process.exit(0);
 
@@ -778,16 +821,20 @@ function canInject(tty) {
 }
 
 // Returns the method used, or null if no terminal path was found.
-async function injectPrompt(tty, text) {
+async function injectNow(tty, text) {
   const dev = `/dev/${tty}`;
   const apps = terminalApps();
   const clean = text.replace(/\r?\n/g, ' ').trim();
 
   if (apps.tmuxPanes.has(dev)) {
+    // No shell in between. Phone text used to go through execSync inside
+    // double quotes, where backticks and $(...) still run, so "rename `foo`"
+    // executed foo on this Mac before the agent ever saw the prompt.
+    const pane = apps.tmuxPanes.get(dev);
     try {
-      execSync(`tmux send-keys -t '${apps.tmuxPanes.get(dev)}' -l ${JSON.stringify(clean)}`);
+      execFileSync('tmux', ['send-keys', '-t', pane, '-l', '--', clean], { stdio: 'ignore' });
       await sleep(150);
-      execSync(`tmux send-keys -t '${apps.tmuxPanes.get(dev)}' Enter`);
+      execFileSync('tmux', ['send-keys', '-t', pane, 'Enter'], { stdio: 'ignore' });
       return 'tmux';
     } catch {}
   }
@@ -833,6 +880,18 @@ end tell`);
   return null;
 }
 
+// One injection per terminal at a time. Each is two writes with a pause
+// between them (the text, then Enter), so two prompts landing together would
+// interleave into one run on prompt and a stray Enter.
+const injecting = new Map(); // tty -> tail of its queue
+function injectPrompt(tty, text) {
+  const run = (injecting.get(tty) || Promise.resolve()).then(() => injectNow(tty, text));
+  const tail = run.catch(() => null);
+  injecting.set(tty, tail);
+  tail.then(() => { if (injecting.get(tty) === tail) injecting.delete(tty); });
+  return run;
+}
+
 const headlessActive = new Set(); // sessionIds with a headless --resume in flight
 
 const transcriptCache = new Map(); // sessionId -> file path
@@ -889,7 +948,9 @@ function readMessages(sessionId, maxBytes = 512 * 1024, limit = 80) {
     if (role !== 'user' && role !== 'assistant') continue;
     const text = extractText(e.message).trim();
     if (!text || /^(<system-reminder>|<command-name>|<local-command|<command-message|\[Request interrupted|\[SYSTEM NOTIFICATION)/.test(text)) continue;
-    out.push({ role, text: text.slice(0, 4000), ts: e.timestamp || null });
+    // uuid is Claude Code's own id for the line, stable for as long as the
+    // journal lives. The phone keys its rows on it; text is no identity.
+    out.push({ role, text: text.slice(0, 4000), ts: e.timestamp || null, ...(e.uuid ? { id: e.uuid } : {}) });
   }
   return out.slice(-limit);
 }
@@ -1469,8 +1530,63 @@ const askPayload = (ask, queued) => ({
   detail: ask.detail,
   at: ask.at,
   queued,
+  // ALWAYS only means something when Claude Code offered a rule to save.
+  // Apps before 0.1.11 ignore this and always show the button.
+  canAlways: ask.suggestions.length > 0,
+  ...(ask.questions ? { questions: ask.questions } : {}),
 });
 
+/// AskUserQuestion is a picker, not a yes or no. Allowing it without answers
+/// lets Claude carry on with nothing chosen, so the phone gets the questions
+/// themselves and answers them through updatedInput. Clipped, because every
+/// byte rides the relay and lands on a phone screen.
+function questionsOf(tool, input) {
+  if (tool !== 'AskUserQuestion' || !Array.isArray(input?.questions)) return null;
+  const qs = questionSources(input)
+    .map((q) => ({
+      question: q.question.slice(0, 600),
+      header: typeof q.header === 'string' ? q.header.slice(0, 40) : '',
+      multiSelect: q.multiSelect === true,
+      // choice is the default; text and number have no options to tap.
+      kind: typeof q.kind === 'string' ? q.kind : 'choice',
+      options: (Array.isArray(q.options) ? q.options : [])
+        .filter((o) => o && typeof o.label === 'string' && o.label)
+        .slice(0, 8)
+        .map((o) => ({
+          label: o.label.slice(0, 200),
+          description: typeof o.description === 'string' ? o.description.slice(0, 300) : '',
+        })),
+    }));
+  return qs.length ? qs : null;
+}
+
+/// The questions as Claude Code wrote them, in the order the phone sees them.
+/// Answers go back keyed by these full texts: the phone only ever sees a
+/// clipped copy, and Claude looks each answer up by the exact question.
+function questionSources(input) {
+  return (Array.isArray(input?.questions) ? input.questions : [])
+    .filter((q) => q && typeof q.question === 'string' && q.question)
+    .slice(0, 6);
+}
+
+/// The phone's picks, checked against the questions it was shown. Keys are
+/// the question text, which is how Claude Code looks them up; a multi select
+/// arrives as several labels and goes back joined, the way Claude's own
+/// picker reports it.
+function answersFor(ask, raw) {
+  if (!ask.questions || !raw || typeof raw !== 'object') return null;
+  const full = questionSources(ask.input);
+  const out = {};
+  ask.questions.forEach((q, i) => {
+    const v = raw[q.question];
+    const picked = (Array.isArray(v) ? v : [v])
+      .filter((x) => typeof x === 'string' && x.trim())
+      .map((x) => x.trim().slice(0, 2000));
+    if (picked.length) out[full[i]?.question ?? q.question] = picked.join(', ');
+  });
+  return Object.keys(out).length ? out : null;
+}
+
 function readSessions() {
   const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions()];
   const known = new Set(sessions.map((s) => s.id));
@@ -1569,6 +1685,8 @@ function hostState() {
 const bustHostCache = () => { hostCache.at = 0; };
 
 let approvalServerUp = false;
+let approvalServer = null;
+let approvalSocketIno = 0;   // which file at ASK_SOCKET is ours
 let availableUpdate = null;   // version string once a newer release is seen
 
 const pendingAsks = new Map();  // askId -> ask record
@@ -1652,6 +1770,12 @@ function summarizeTool(tool, input) {
       return { line: clip(i.url, 300), detail: clip(i.prompt, 300) };
     case 'WebSearch':
       return { line: clip(i.query, 300), detail: '' };
+    case 'AskUserQuestion': {
+      // The questions travel on their own (questionsOf); the line is just the
+      // first one, for older apps and the crew list.
+      const qs = Array.isArray(i.questions) ? i.questions : [];
+      return { line: clip(qs[0]?.question || 'Claude has a question', 300), detail: '' };
+    }
     default: {
       // Unknown or MCP tools: show whichever field reads most like a target,
       // and fall back to the whole input.
@@ -1677,6 +1801,13 @@ function settleAsk(ask, decision, outcome, note) {
   ask.done = true;
   clearTimeout(ask.holdTimer);
   dropAsk(ask);
+  // A hook that is already gone cannot take the answer. Saying "allowed" to
+  // the phone then would be a lie: the session never got it.
+  if (decision && (ask.socket.destroyed || !ask.socket.writable)) {
+    outcome = 'gone';
+    note = 'the session stopped waiting before your answer arrived';
+    decision = null;
+  }
   try { ask.socket.write(JSON.stringify({ decision: decision || null }) + '\n'); } catch {}
   try { ask.socket.end(); } catch {}
   console.log(`[daemon] permission ${ask.tool} ${outcome}${note ? `: ${note}` : ''}`);
@@ -1701,6 +1832,14 @@ function onPermissionRequest(req, socket) {
     tool: req.toolName || 'tool',
     line,
     detail,
+    // Kept whole for AskUserQuestion, whose answer is the same input with the
+    // answers added. Never sent to the phone as is.
+    input: req.toolInput && typeof req.toolInput === 'object' ? req.toolInput : {},
+    questions: questionsOf(req.toolName, req.toolInput),
+    // What Claude Code would save if you picked "don't ask again" on the Mac.
+    // ALWAYS on the phone sends these back as updatedPermissions; without
+    // them there is no rule to save, so the button is hidden.
+    suggestions: Array.isArray(req.permissionSuggestions) ? req.permissionSuggestions : [],
     cwd: req.cwd || '',
     at: Date.now(),
     socket,
@@ -1768,12 +1907,33 @@ function startApprovalServer(attempt = 0) {
   });
   server.listen(ASK_SOCKET, () => {
     try { fs.chmodSync(ASK_SOCKET, 0o600); } catch {}
+    try { approvalSocketIno = fs.statSync(ASK_SOCKET).ino; } catch {}
+    approvalServer = server;
     approvalServerUp = true;
     bustHostCache();
     console.log(`[daemon] remote approvals ready (mode: ${approvalConfig().mode})`);
   });
 }
 
+/// A second copy started on this Mac unlinks the approvals socket and binds
+/// its own. When that copy then loses the relay back to this one and exits,
+/// the hook is left calling a file nobody listens on, and approvals stop
+/// reaching the phone until the next restart. Up to 0.1.11 the restart came
+/// quickly, because a displaced daemon exited; now that it waits instead,
+/// it has to take the socket back itself, every time the relay is ours again.
+function ensureApprovalSocket() {
+  if (!approvalServer) return;
+  let ino = 0;
+  try { ino = fs.statSync(ASK_SOCKET).ino; } catch {}
+  if (ino && ino === approvalSocketIno) return;
+  console.log('[daemon] another copy replaced the approvals socket, taking it back');
+  try { approvalServer.close(); } catch {}
+  approvalServer = null;
+  approvalServerUp = false;
+  bustHostCache();
+  startApprovalServer();
+}
+
 // Claude Code's own status for each session, as last seen on disk.
 const lastRawStatus = new Map(); // sessionId -> 'busy' | 'idle' | 'waiting' | ...
 
@@ -1828,6 +1988,9 @@ function releaseAnsweredOnMac() {
 function releaseAsksIfBack() {
   if (!pendingAsks.size) return;
   const cfg = approvalConfig();
+  // `groundcontrol approvals off` runs in another process; this is where the
+  // daemon notices it and hands back whatever it was still holding.
+  if (cfg.mode === 'off') return releaseAllAsks('remote approvals were turned off');
   if (cfg.mode !== 'away') return;
   if (macIdleSeconds() >= cfg.awayAfterSeconds) return;
   for (const ask of [...pendingAsks.values()]) {
@@ -1857,8 +2020,11 @@ function isNewer(candidate, current) {
 }
 
 async function latestPublishedVersion() {
+  // Plain JSON. The abbreviated install-v1 format only exists for the whole
+  // package document; asked of /latest the registry answers 406, and it did,
+  // on every check from 0.1.7 through 0.1.11, so no install ever updated.
   const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
-    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    headers: { accept: 'application/json' },
     signal: AbortSignal.timeout(15_000),
   });
   if (!res.ok) throw new Error(`registry ${res.status}`);
@@ -1906,9 +2072,9 @@ async function checkForUpdate({ force = false } = {}) {
 
 /// A daemon shutting down must hand every held request back rather than leave
 /// sessions blocked on a socket that will never answer.
-function releaseAllAsks() {
+function releaseAllAsks(note = 'the daemon stopped') {
   for (const ask of [...pendingAsks.values()]) {
-    settleAsk(ask, null, 'released', 'the daemon stopped');
+    settleAsk(ask, null, 'released', note);
   }
 }
 
@@ -1917,6 +2083,17 @@ function releaseAllAsks() {
 let ws = null;
 let lastSnapshotJson = '';
 
+/// Everything bound for the phone goes through here. The socket is replaced
+/// on every reconnect, and ws throws, rather than returning, when asked to
+/// send on one that is still connecting. From a file watcher or a child
+/// process callback that is an uncaught exception, which takes the daemon and
+/// every held approval down with it. The relay keeps no queue, so a message
+/// with no open socket is lost either way; the phone has timeouts for that.
+function toPhone(obj) {
+  if (ws?.readyState !== 1) return false;
+  try { ws.send(seal(obj)); return true; } catch { return false; }
+}
+
 function sendSnapshot(force = false) {
   // A parser tripping on a malformed journal must never take the daemon down:
   // this runs on a bare interval with nothing above it to catch a throw.
@@ -1926,10 +2103,19 @@ function sendSnapshot(force = false) {
     return;
   }
   for (const s of sessions) if (s.rawStatus) lastRawStatus.set(s.id, s.rawStatus);
+  // A session that left the fleet takes its status with it. Kept, an idle from
+  // its last turn would read as "answered on the Mac" for the next request.
+  const present = new Set(sessions.map((s) => s.id));
+  for (const id of lastRawStatus.keys()) if (!present.has(id)) lastRawStatus.delete(id);
   const host = hostState();
   // Host state joins the dedupe key, otherwise flipping approvals on would not
-  // reach a phone whose session list happened not to change.
-  const json = JSON.stringify([sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })), host]);
+  // reach a phone whose session list happened not to change. The last message
+  // is keyed on its time, role and length as well as its opening: two replies
+  // that start alike would otherwise look like one and the second never sent.
+  const json = JSON.stringify([sessions.map(({ lastMessage, ...s }) => ({
+    ...s,
+    last: lastMessage && [lastMessage.ts, lastMessage.role, lastMessage.text?.length, lastMessage.text?.slice(0, 120)],
+  })), host]);
   if (!force && json === lastSnapshotJson) return;
   lastSnapshotJson = json;
   if (ws?.readyState === 1) {
@@ -1940,37 +2126,131 @@ function sendSnapshot(force = false) {
 
 // Live transcript streaming: while a phone has a chat open, push transcript
 // updates the moment the JSONL file changes.
-const watchers = new Map(); // sessionId -> fs.FSWatcher
-function watchTranscript(sessionId) {
-  if (watchers.has(sessionId)) return;
+//
+// Every open chat holds a lease on its watch. Apps from 0.1.9 name themselves
+// and renew every minute, so one phone closing a chat no longer stops it
+// streaming on another, and a phone that vanishes without an unwatch (killed
+// app, dead network) stops costing this Mac a file watch plus a full
+// transcript read on every write within minutes instead of never. Older apps
+// never renew, so theirs is long and renewed whenever they ask for the log.
+const WATCH_LEASE_MS = 3 * 60_000;
+const LEGACY_LEASE_MS = 30 * 60_000;
+const PROMPT_LEASE_MS = 5 * 60_000;
+const leaseFor = (holder) => (holder === 'legacy' ? LEGACY_LEASE_MS : holder === 'prompt' ? PROMPT_LEASE_MS : WATCH_LEASE_MS);
+const holderOf = (cmd) => (typeof cmd.client === 'string' && cmd.client ? `phone:${cmd.client.slice(0, 64)}` : 'legacy');
+const watchers = new Map(); // sessionId -> { watcher, debounce, leases: Map<holder, expiresAt> }
+// Sessions whose legacy lease ran out rather than being unwatched: the chat
+// may well still be open on an older phone, which asks for the log again
+// whenever the session changes state. That is the moment to resume.
+const lapsedLegacy = new Map(); // sessionId -> when the lease ran out
+const LAPSED_FORGET_MS = 24 * 60 * 60 * 1000;
+
+/// Start or renew a watch. Returns 'created', 'renewed', or null when there
+/// is no transcript to watch.
+function watchTranscript(sessionId, holder = 'legacy', now = Date.now()) {
+  if (holder === 'legacy') lapsedLegacy.delete(sessionId);
+  const until = now + leaseFor(holder);
+  const entry = watchers.get(sessionId);
+  // A journal that was replaced or moved leaves the old watch listening to a
+  // file nobody writes. Renewals are the moment to notice and start over.
+  if (entry && !watchStale(sessionId, entry)) {
+    entry.leases.set(holder, Math.max(until, entry.leases.get(holder) || 0));
+    return 'renewed';
+  }
+  const leases = entry ? entry.leases : new Map();
+  if (entry) closeWatch(sessionId, entry);
+  leases.set(holder, Math.max(until, leases.get(holder) || 0));
   const file = findTranscript(sessionId);
-  if (!file) return;
-  let debounce;
+  if (!file) return null;
+  const next = { watcher: null, debounce: null, firstAt: 0, file, ino: inodeOf(file), leases };
+  const push = () => {
+    clearTimeout(next.debounce);
+    next.debounce = null;
+    next.firstAt = 0;
+    toPhone({ type: 'transcript', sessionId, messages: readMessages(sessionId) });
+  };
   try {
-    // Journals are appended to, so watching the file is enough.
-    const w = fs.watch(file, () => {
-      clearTimeout(debounce);
-      debounce = setTimeout(() => {
-        ws?.send(seal({ type: 'transcript', sessionId, messages: readMessages(sessionId) }));
-      }, 250);
+    // Journals are appended to, so watching the file is enough. Debounced so
+    // a burst of writes is one read, but never for longer than a second: a
+    // turn that keeps writing would otherwise reach the phone only once it
+    // stopped, which is the chat that looks frozen while the Mac is busy.
+    next.watcher = fs.watch(file, () => {
+      const t = Date.now();
+      if (!next.firstAt) next.firstAt = t;
+      clearTimeout(next.debounce);
+      if (t - next.firstAt >= TRANSCRIPT_MAX_WAIT_MS) return push();
+      next.debounce = setTimeout(push, 250);
     });
-    watchers.set(sessionId, w);
+    next.watcher.on?.('error', () => closeWatch(sessionId, next, { keepIntent: true }));
+    watchers.set(sessionId, next);
     console.log(`[daemon] watching transcript ${sessionId.slice(0, 8)}`);
-  } catch {}
+    return 'created';
+  } catch { return null; }
 }
-function unwatchTranscript(sessionId) {
-  watchers.get(sessionId)?.close();
-  watchers.delete(sessionId);
+
+const TRANSCRIPT_MAX_WAIT_MS = 1000;
+const inodeOf = (file) => { try { return fs.statSync(file).ino; } catch { return 0; } };
+function watchStale(sessionId, entry) {
+  if (!entry.watcher) return true;
+  const file = findTranscript(sessionId);
+  return !!file && (file !== entry.file || inodeOf(file) !== entry.ino);
+}
+
+/// Keep an existing lease alive without starting a watch nobody asked for,
+/// except the one an older app's open chat lost to the clock.
+function renewWatch(sessionId, holder, now = Date.now()) {
+  const entry = watchers.get(sessionId);
+  if (entry?.leases.has(holder)) {
+    if (watchStale(sessionId, entry)) watchTranscript(sessionId, holder, now);
+    else entry.leases.set(holder, now + leaseFor(holder));
+    return;
+  }
+  if (holder === 'legacy' && lapsedLegacy.has(sessionId)) watchTranscript(sessionId, 'legacy', now);
+}
+
+function unwatchTranscript(sessionId, holder = 'legacy') {
+  if (holder === 'legacy') lapsedLegacy.delete(sessionId);
+  const entry = watchers.get(sessionId);
+  if (!entry) return;
+  entry.leases.delete(holder);
+  if (!entry.leases.size) closeWatch(sessionId, entry);
+}
+
+/// keepIntent leaves the leases in place with no watcher behind them, so the
+/// next renewal or getTranscript starts a fresh one instead of the chat going
+/// quiet for good after one watcher error.
+function closeWatch(sessionId, entry, { keepIntent = false } = {}) {
+  clearTimeout(entry.debounce);
+  try { entry.watcher?.close(); } catch {}
+  entry.watcher = null;
+  if (!keepIntent && watchers.get(sessionId) === entry) watchers.delete(sessionId);
+}
+
+function expireWatches(now = Date.now()) {
+  for (const [sessionId, entry] of watchers) {
+    for (const [holder, until] of entry.leases) {
+      if (until > now) continue;
+      entry.leases.delete(holder);
+      if (holder === 'legacy') lapsedLegacy.set(sessionId, now);
+    }
+    if (!entry.leases.size) closeWatch(sessionId, entry);
+  }
+  for (const [sessionId, at] of lapsedLegacy) if (now - at > LAPSED_FORGET_MS) lapsedLegacy.delete(sessionId);
 }
 
 async function handleCommand(cmd) {
   if (cmd.type === 'getTranscript' && cmd.sessionId) {
-    ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
+    renewWatch(cmd.sessionId, holderOf(cmd));
+    toPhone({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) });
   } else if (cmd.type === 'watch' && cmd.sessionId) {
-    watchTranscript(cmd.sessionId);
-    ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
+    const how = watchTranscript(cmd.sessionId, holderOf(cmd));
+    // A renewal only keeps the lease; the phone already has the log, unless
+    // this daemon restarted since and the watch had to be started again.
+    if (!cmd.renew || how === 'created') {
+      toPhone({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) });
+    }
   } else if (cmd.type === 'unwatch' && cmd.sessionId) {
-    unwatchTranscript(cmd.sessionId);
+    unwatchTranscript(cmd.sessionId, holderOf(cmd));
   } else if (cmd.type === 'setApprovals') {
     // A deliberate tap in the app, with the app explaining what it adds, is
     // the consent for this. A backup is still written before any change.
@@ -1978,6 +2258,8 @@ async function handleCommand(cmd) {
     if (cmd.enabled === false) {
       writeApprovalConfig({ mode: 'off' });
       result = uninstallApprovalHook();
+      // Off means off for what is already held too, not just what comes next.
+      releaseAllAsks('remote approvals were turned off');
       console.log('[daemon] remote approvals turned off from the phone');
     } else {
       const mode = ['away', 'always'].includes(cmd.mode) ? cmd.mode : 'away';
@@ -1987,44 +2269,65 @@ async function handleCommand(cmd) {
     }
     bustHostCache();
     sendSnapshot(true);
-    ws?.send(seal({
+    toPhone({
       type: 'approvalsResult',
       ok: !!result.ok,
       error: result.ok ? '' : (result.reason || 'could not change the setting'),
       host: hostState(),
-    }));
-  } else if (cmd.type === 'approve' || cmd.type === 'deny') {
+    });
+  } else if (cmd.type === 'approve' || cmd.type === 'deny' || cmd.type === 'answer') {
     const ask = cmd.askId ? pendingAsks.get(cmd.askId) : null;
     if (!ask) {
       // Answered on the Mac, expired, or the session moved on while the tap
-      // was in flight. Tell the phone so the card clears instead of hanging.
-      return ws?.send(seal({
+      // was in flight. Tell the phone so the card clears instead of hanging,
+      // and send the fleet with it: the phone draws the card from the
+      // snapshot, and a deduped one would never come.
+      toPhone({
         type: 'askResolved', askId: cmd.askId || '', sessionId: cmd.sessionId || '',
         outcome: 'gone', note: 'that request is no longer waiting',
-      }));
+      });
+      sendSnapshot(true);
+      return;
     }
-    if (cmd.type === 'approve') {
-      settleAsk(ask, { behavior: 'allow', ...(cmd.always ? { alwaysAllow: true } : {}) },
-        'allowed', cmd.always ? 'from the phone, and always from now on' : 'from the phone');
+    if (cmd.type === 'answer') {
+      const answers = answersFor(ask, cmd.answers);
+      if (!answers) {
+        // Nothing usable picked. Leave the request held; the card stays up.
+        return toPhone({ type: 'askResolved', askId: ask.id, sessionId: ask.sessionId, outcome: 'invalid', note: 'pick an answer first' });
+      }
+      settleAsk(ask, { behavior: 'allow', updatedInput: { ...ask.input, answers } },
+        'answered', 'from the phone');
+    } else if (cmd.type === 'approve' && ask.questions) {
+      // An app too old to show the choices can only say yes, and yes with no
+      // answer is a question skipped. Hand it back so it gets a real answer.
+      settleAsk(ask, null, 'released', 'this needs a choice, update the app or pick it');
+    } else if (cmd.type === 'approve') {
+      // Claude Code reads only behavior, updatedInput and updatedPermissions.
+      // Up to 0.1.12 ALWAYS sent alwaysAllow, which it drops, so the next
+      // matching call asked again. The suggestions are the exact rules it
+      // would have saved from its own "don't ask again" option.
+      const always = cmd.always === true && ask.suggestions.length > 0;
+      settleAsk(ask, { behavior: 'allow', ...(always ? { updatedPermissions: ask.suggestions } : {}) },
+        'allowed', always ? 'from the phone, and always from now on' : 'from the phone');
     } else {
       const reason = (cmd.text || '').trim();
       settleAsk(ask, { behavior: 'deny', message: reason || 'Denied from the Ground Control app.' },
         'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
     }
   } else if (cmd.type === 'projects') {
-    ws?.send(seal({
+    toPhone({
       type: 'projects',
       projects: knownProjects().map((p) => ({ path: p.path, name: p.name, at: p.at })),
       providers: launchProviders(),
-    }));
+    });
   } else if (cmd.type === 'launch') {
     await launchSession(cmd);
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
-    ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
+    toPhone({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() });
   } else if (cmd.type === 'prompt' && cmd.sessionId && cmd.text) {
     const session = readSessions().find((s) => s.id === cmd.sessionId);
-    if (!session) return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' }));
+    if (!session) return toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' });
 
     if (session.provider && session.provider !== 'claude') return promptHeadless(session, cmd.text);
 
@@ -2033,27 +2336,27 @@ async function handleCommand(cmd) {
       const method = await injectPrompt(session.tty, cmd.text);
       if (method) {
         console.log(`[daemon] injected prompt into ${session.name} via ${method}`);
-        ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: true, text: '' }));
-        watchTranscript(cmd.sessionId);
+        toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: true, text: '' });
+        watchTranscript(cmd.sessionId, 'prompt');
         sendSnapshot(true);
         return;
       }
       if (automationDenied) {
         console.log('[daemon] prompt blocked: macOS Automation permission missing');
-        return ws?.send(seal({
+        return toPhone({
           type: 'promptResult', sessionId: cmd.sessionId, ok: false,
           error: 'Your Mac is blocking terminal control. Open System Settings, Privacy and Security, Automation, and allow node to control your terminal app. Then send again.',
-        }));
+        });
       }
     }
-    if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
+    if (session.status === 'busy') return toPhone({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' });
     const bin = claudeBin();
     if (!bin) {
       console.log('[daemon] prompt failed: claude binary not found on PATH');
-      return ws?.send(seal({
+      return toPhone({
         type: 'promptResult', sessionId: cmd.sessionId, ok: false,
         error: 'The daemon could not find the claude command on this Mac. Open a terminal, check that claude runs, then reinstall with: npx @clastres/groundcontrol',
-      }));
+      });
     }
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
@@ -2069,11 +2372,13 @@ async function handleCommand(cmd) {
       if (responded) return;
       responded = true;
       headlessActive.delete(cmd.sessionId);
-      ws?.send(seal(payload));
+      toPhone(payload);
       sendSnapshot(true);
     };
     child.stdout.on('data', (d) => { out += d; });
     child.stderr.on('data', (d) => { err += d; });
+    // Delivered is not done: the turn can run for minutes. See promptAccepted.
+    child.on('spawn', () => promptAccepted(cmd.sessionId));
     child.on('error', (e) => {
       console.log(`[daemon] claude spawn failed: ${e.message}`);
       respond({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: `could not run claude: ${e.message}` });
@@ -2082,6 +2387,7 @@ async function handleCommand(cmd) {
       respond({
         type: 'promptResult', sessionId: cmd.sessionId, ok: code === 0,
         text: (out || err).trim().slice(0, 4000),
+        ...(code === 0 ? {} : { error: failureText('claude', code, err || out) }),
       });
     });
   }
@@ -2110,15 +2416,15 @@ function bustProviderCaches() {
 function promptHeadless(session, text) {
   // Anything but idle means another writer owns the session right now: busy
   // is a running turn, waiting is a human approval the phone cannot answer.
-  if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' }));
-  if (session.status !== 'idle') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' }));
+  if (session.status === 'busy') return toPhone({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' });
+  if (session.status !== 'idle') return toPhone({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' });
   const spec = headlessPromptSpec[session.provider]?.();
   if (!spec) {
     console.log(`[daemon] ${session.provider} prompt failed: binary not found`);
-    return ws?.send(seal({
+    return toPhone({
       type: 'promptResult', sessionId: session.id, ok: false,
       error: `The daemon could not find the ${session.provider === 'codex' ? 'codex' : 'kimi'} command on this Mac, so it cannot reach this session. If you just installed it, try again in a minute.`,
-    }));
+    });
   }
   console.log(`[daemon] prompt -> ${session.provider} ${session.name}: ${text.slice(0, 60)}`);
   const promptedAt = Date.now();
@@ -2137,11 +2443,12 @@ function promptHeadless(session, text) {
     responded = true;
     headlessActive.delete(session.id);
     bustProviderCaches();
-    ws?.send(seal(payload));
+    toPhone(payload);
     sendSnapshot(true);
   };
   child.stderr.on('data', (d) => { err += d; });
   child.stdout.on('data', () => {});
+  child.on('spawn', () => promptAccepted(session.id));
   child.on('error', (e) => {
     console.log(`[daemon] ${session.provider} spawn failed: ${e.message}`);
     respond({ type: 'promptResult', sessionId: session.id, ok: false, error: `could not run ${session.provider}: ${e.message}` });
@@ -2156,9 +2463,26 @@ function promptHeadless(session, text) {
     respond({
       type: 'promptResult', sessionId: session.id, ok: code === 0,
       text: code === 0 ? (reply?.text || '').slice(0, 4000) : err.trim().slice(0, 4000),
+      ...(code === 0 ? {} : { error: failureText(session.provider, code, err) }),
     });
   });
-  watchTranscript(session.id);
+  watchTranscript(session.id, 'prompt');
+}
+
+/// Tell the phone a headless run has started. The run answers only when the
+/// whole turn is over, often minutes later, and the app gives up on a prompt
+/// after 30 seconds: up to 0.1.8 it then showed "no reply from mac yet" and
+/// kept showing it after the run succeeded. An ok now clears the pending
+/// prompt; a failure later still arrives as its own result.
+function promptAccepted(sessionId) {
+  toPhone({ type: 'promptResult', sessionId, ok: true, text: '', accepted: true });
+}
+
+/// A failed run's last words, for the phone. Whatever the agent printed on
+/// stderr last is usually the reason; the exit code is the fallback.
+function failureText(provider, code, output) {
+  const tail = String(output || '').trim().split('\n').filter(Boolean).slice(-3).join(' ').slice(0, 300);
+  return tail ? `${provider} stopped: ${tail}` : `${provider} exited with code ${code}`;
 }
 
 // ---------- launching a new pilot ----------
@@ -2259,7 +2583,7 @@ const shq = (s) => `'${String(s).replace(/'/g, `'\\''`)}'`;
 let lastLaunchAt = 0;
 
 async function launchSession(cmd) {
-  const fail = (error) => ws?.send(seal({ type: 'launchResult', ok: false, error }));
+  const fail = (error) => toPhone({ type: 'launchResult', ok: false, error });
 
   const providers = launchProviders();
   const provider = cmd.provider || 'claude';
@@ -2317,18 +2641,60 @@ end tell`);
   // The new session reaches the island through the same discovery every other
   // one does, which takes a few seconds. Say so rather than implying the pilot
   // is already there.
-  ws?.send(seal({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` }));
+  toPhone({ type: 'launchResult', ok: true, cwd: target.path, note: `${provider} is starting in ${target.name}` });
   sendSnapshot(true);
 }
 
+// Replay protection. The relay only ever sees ciphertext, but it could send
+// a captured command again, and it would decrypt just fine. Every sealed
+// message opens with a random 12 byte nonce, so one seen twice is a replay.
+// Keyed on the decoded bytes, not the text: base64 decoding skips whitespace
+// and takes either alphabet, so one frame can be spelled many ways.
+// Apps from 0.1.9 also stamp each command with when it was sent, which turns
+// away old captures even after a restart has emptied this cache. Commands
+// from older apps carry no stamp and get the nonce check alone.
+const seenNonces = new Map();              // nonce, hex -> seen at
+const NONCE_TTL_MS = 24 * 60 * 60 * 1000;
+const NONCE_CAP = 20_000;
+const COMMAND_MAX_SKEW_MS = 10 * 60 * 1000;
+function freshCommand(b64, cmd, now = Date.now()) {
+  const nonce = Buffer.from(b64, 'base64').subarray(0, 12).toString('hex');
+  if (seenNonces.has(nonce)) return false;
+  if (typeof cmd?.at === 'number' && Math.abs(now - cmd.at) > COMMAND_MAX_SKEW_MS) return false;
+  seenNonces.set(nonce, now);
+  // Oldest first, so trimming stops at the first one worth keeping.
+  for (const [k, t] of seenNonces) {
+    if (now - t > NONCE_TTL_MS || seenNonces.size > NONCE_CAP) seenNonces.delete(k);
+    else break;
+  }
+  return true;
+}
+
 let lastPongAt = Date.now();
+let connectedAt = 0;
+let takeovers = 0;   // in a row; reset once a connection has held for a while
+
+/// How long to stay off the relay after another host took the channel.
+/// Exiting instead, as this did up to 0.1.11, hands the job to launchd, which
+/// starts us again five seconds later; we take the channel back, the other
+/// host takes it back, and round it goes. One Mac logged 1,123 restarts that
+/// way, in bursts of ten, against another machine sharing its key.
+function takeoverBackoffMs(n) {
+  return Math.min(15 * 60_000, 60_000 * 2 ** Math.max(0, n - 1));
+}
 
 function connect() {
   // handshakeTimeout: a dial that never completes would otherwise sit in
   // CONNECTING forever without firing close, freezing the retry loop.
   ws = new WebSocket(`${RELAY}/ch/${CHANNEL}?role=host`, { handshakeTimeout: 15_000 });
   lastPongAt = Date.now();
-  ws.on('open', () => { lastPongAt = Date.now(); console.log('[daemon] connected to relay'); sendSnapshot(true); });
+  ws.on('open', () => {
+    lastPongAt = Date.now();
+    connectedAt = Date.now();
+    console.log('[daemon] connected to relay');
+    ensureApprovalSocket();
+    sendSnapshot(true);
+  });
   ws.on('pong', () => { lastPongAt = Date.now(); });
   ws.on('message', (data) => {
     const str = data.toString();
@@ -2343,14 +2709,30 @@ function connect() {
     // which is what the approval policy checks before holding a prompt.
     try {
       const cmd = open(str);
+      if (!freshCommand(str, cmd)) {
+        const off = typeof cmd?.at === 'number' ? Math.round((Date.now() - cmd.at) / 60_000) : 0;
+        console.log(`[daemon] dropped a repeated or stale ${cmd?.type || 'command'}`
+          + (Math.abs(off) >= 10 ? ` (stamped ${off} min off this Mac's clock)` : ''));
+        return;
+      }
       notePhoneSeen();
       handleCommand(cmd)?.catch?.(() => {});
     } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
   });
   ws.on('close', (code) => {
     if (code === 4001) {
-      console.log('[daemon] another daemon took over this channel, exiting. Run only one copy.');
-      process.exit(0);
+      // A copy someone started by hand should get out of the way and say why.
+      if (!runsFromServiceDir) {
+        console.log('[daemon] another daemon took over this channel, exiting. Run only one copy.');
+        process.exit(0);
+      }
+      if (connectedAt && Date.now() - connectedAt > 10 * 60_000) takeovers = 0;
+      takeovers++;
+      const wait = takeoverBackoffMs(takeovers);
+      console.log(`[daemon] another host took over this pairing (${takeovers} in a row), trying again in ${Math.round(wait / 60_000)} min. `
+        + 'Another Mac or a second copy is using this key; remove it there with: npx @clastres/groundcontrol service uninstall');
+      setTimeout(connect, wait);
+      return;
     }
     console.log('[daemon] relay disconnected, retrying in 3s');
     setTimeout(connect, 3000);
@@ -2374,6 +2756,7 @@ for (const cmd of hookState.foreign || []) console.log(`[daemon] another app als
 startApprovalServer();
 setInterval(releaseAsksIfBack, 3000);
 setInterval(releaseAnsweredOnMac, 2000);
+setInterval(expireWatches, 30_000);
 
 // Self update. Staggered off startup so a login storm does not hit the
 // registry at once, then re-checked hourly (the daily stamp does the gating).

package/hook.mjs

@@ -92,6 +92,9 @@ sock.on('connect', () => {
     cwd: payload.cwd || '',
     permissionMode: payload.permission_mode || '',
     permissionContext: payload.permission_context || null,
+    // The rules Claude Code would save for "don't ask again". ALWAYS on the
+    // phone hands these back; without them it has nothing to save.
+    permissionSuggestions: Array.isArray(payload.permission_suggestions) ? payload.permission_suggestions : [],
   }) + '\n');
 });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clastres/groundcontrol",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "See and command your coding agents from your iPhone. Pairs the Ground Control app with Claude Code, Codex and Kimi sessions running on this Mac, end to end encrypted.",
   "bin": {
     "groundcontrol": "bin/groundcontrol.mjs"

package/test/questions.mjs

@@ -0,0 +1,67 @@
+// Claude's question picker (AskUserQuestion) reaches the phone as questions,
+// and the phone's picks go back as the answers Claude Code reads from
+// updatedInput. Before this, the phone showed ALLOW and DENY for a question,
+// and allowing it let Claude carry on with nothing chosen.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
+const src = fs.readFileSync(DAEMON, 'utf8');
+const start = src.indexOf('/// The phone-facing shape of a held request.');
+const end = src.indexOf('function readSessions() {');
+if (start < 0 || end < 0 || end < start) throw new Error('could not locate the question helpers in daemon.mjs');
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+const { askPayload, questionsOf, answersFor } = new Function(
+  `${src.slice(start, end)}\n return { askPayload, questionsOf, answersFor };`,
+)();
+
+const input = {
+  questions: [
+    { question: 'Which database?', header: 'DB', multiSelect: false,
+      options: [{ label: 'Postgres', description: 'the usual' }, { label: 'SQLite' }] },
+    { question: 'Which extras?', header: 'Extras', multiSelect: true,
+      options: [{ label: 'Auth' }, { label: 'Billing' }, { label: 'Search' }] },
+  ],
+};
+
+const qs = questionsOf('AskUserQuestion', input);
+check('a question picker becomes questions for the phone', qs?.length === 2 && qs[0].options.length === 2);
+check('options keep their descriptions', qs[0].options[0].description === 'the usual');
+check('multi select survives', qs[1].multiSelect === true);
+check('any other tool has no questions', questionsOf('Bash', { command: 'ls' }) === null);
+check('a malformed input has none either', questionsOf('AskUserQuestion', { questions: 'nope' }) === null);
+
+const ask = { id: 'a1', tool: 'AskUserQuestion', line: 'Which database?', detail: '', at: 1, input, questions: qs, suggestions: [] };
+const payload = askPayload(ask, 1);
+check('the payload carries the questions', payload.questions === qs);
+check('and no ALWAYS without a rule to save', payload.canAlways === false);
+check('a request with a suggested rule offers ALWAYS',
+  askPayload({ ...ask, questions: null, suggestions: [{ type: 'addRules' }] }, 1).canAlways === true);
+check('a plain request sends no questions key', !('questions' in askPayload({ ...ask, questions: null }, 1)));
+
+const answers = answersFor(ask, { 'Which database?': 'Postgres', 'Which extras?': ['Auth', 'Search'] });
+check('a single pick answers by question text', answers?.['Which database?'] === 'Postgres');
+check('several picks go back joined', answers?.['Which extras?'] === 'Auth, Search');
+check('a question the phone was never shown is ignored',
+  !('Other?' in (answersFor(ask, { 'Which database?': 'SQLite', 'Other?': 'x' }) || {})));
+check('nothing picked is no answer at all', answersFor(ask, { 'Which database?': '  ' }) === null);
+const long = 'Why? '.repeat(200);
+const longInput = { questions: [{ question: long, options: [{ label: 'Because' }] }] };
+const longQs = questionsOf('AskUserQuestion', longInput);
+const longAnswers = answersFor({ input: longInput, questions: longQs }, { [longQs[0].question]: 'Because' });
+check('a long question is clipped for the phone', longQs[0].question.length === 600);
+check('but answered under its full text, which is what Claude looks up', longAnswers?.[long] === 'Because');
+check('free text is taken as is', answersFor(ask, { 'Which database?': 'MySQL, honestly' })?.['Which database?'] === 'MySQL, honestly');
+
+if (failures) {
+  console.log(`\n${failures} check(s) failed`);
+  process.exit(1);
+}
+console.log('\nall checks passed');

package/test/review-fixes.mjs

@@ -0,0 +1,339 @@
+// The fixes from the 2026-09-22 review, each pinned to the failure it fixes.
+// Same approach as the other files here: lift the real function out of
+// daemon.mjs and run it against fakes, so what is tested is what ships.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const DAEMON = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'daemon.mjs');
+const src = fs.readFileSync(DAEMON, 'utf8');
+
+/// The source between two markers, which must both exist and be in order.
+function slice(from, to) {
+  const start = src.indexOf(from);
+  const end = src.indexOf(to, start + 1);
+  if (start < 0 || end < 0) throw new Error(`could not locate ${from.slice(0, 50)} in daemon.mjs`);
+  return src.slice(start, end);
+}
+
+let failures = 0;
+const check = (label, cond, detail = '') => {
+  console.log(`${cond ? 'ok  ' : 'FAIL'} ${label}${detail ? `  ${detail}` : ''}`);
+  if (!cond) failures++;
+};
+
+// ---------- phone text never reaches a shell ----------
+{
+  const calls = [];
+  const { injectPrompt } = new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return { injectPrompt };`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { calls.push({ file, args }); return Buffer.from(''); },
+    (cmd) => { calls.push({ shell: cmd }); return Buffer.from(''); },
+    async () => {},
+    async () => 'notfound',
+    (s) => s,
+  );
+  const text = 'rename `foo` to $(whoami) and keep $HOME';
+  const method = await injectPrompt('ttys009', text);
+  check('a tmux session is typed into through tmux', method === 'tmux', `got ${method}`);
+  check('nothing goes through a shell', calls.every((c) => !c.shell), JSON.stringify(calls.filter((c) => c.shell)));
+  const typed = calls.find((c) => c.args?.includes('-l'));
+  check('the prompt arrives as one literal argument, backticks and all',
+    typed?.file === 'tmux' && typed.args.at(-1) === text, JSON.stringify(typed));
+  const dashed = [];
+  await new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return injectPrompt;`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { dashed.push(args); return Buffer.from(''); },
+    () => { throw new Error('shell'); },
+    async () => {}, async () => 'notfound', (s) => s,
+  )('ttys009', '-t is not a flag here');
+  // Two prompts at once into one terminal must not interleave.
+  const order = [];
+  const serial = new Function(
+    'terminalApps', 'execFileSync', 'execSync', 'sleep', 'osascript', 'escapeAS',
+    `${slice('// Returns the method used, or null if no terminal path was found.', 'const headlessActive = new Set();')}
+     return injectPrompt;`,
+  )(
+    () => ({ tmuxPanes: new Map([['/dev/ttys009', '%3']]), terminal: false, iterm: false }),
+    (file, args) => { order.push(args.includes('-l') ? args.at(-1) : 'Enter'); return Buffer.from(''); },
+    () => { throw new Error('shell'); },
+    () => new Promise((r) => setTimeout(r, 20)), async () => 'notfound', (s) => s,
+  );
+  await Promise.all([serial('ttys009', 'FIRST'), serial('ttys009', 'SECOND')]);
+  check('two prompts into one terminal go in one after the other',
+    order.join(',') === 'FIRST,Enter,SECOND,Enter', order.join(','));
+  check('a prompt starting with a dash is not read as a tmux option',
+    dashed[0]?.indexOf('--') === dashed[0]?.length - 2, JSON.stringify(dashed[0]));
+}
+
+// ---------- sends while reconnecting do not throw ----------
+{
+  const run = (ws) => new Function('ws', 'seal',
+    `${slice('/// Everything bound for the phone goes through here.', 'function sendSnapshot(')}
+     return toPhone;`)(ws, (o) => JSON.stringify(o));
+  const connecting = { readyState: 0, send() { throw new Error('WebSocket is not open: readyState 0 (CONNECTING)'); } };
+  let threw = false;
+  let sent;
+  try { sent = run(connecting)({ type: 'transcript' }); } catch { threw = true; }
+  check('a send while the next socket is still connecting does not throw', !threw && sent === false);
+  check('a send with no socket at all is dropped quietly', run(null)({ type: 'x' }) === false);
+  const out = [];
+  check('an open socket still gets the message', run({ readyState: 1, send: (d) => out.push(d) })({ type: 'x' }) === true && out.length === 1);
+}
+
+// ---------- self update asks npm a question it answers ----------
+{
+  const requests = [];
+  // The registry's real behaviour: the abbreviated document only exists for
+  // the package root, so /latest with that accept header is a 406.
+  const fakeFetch = async (url, opts) => {
+    requests.push({ url, accept: opts?.headers?.accept });
+    if (/\/latest$/.test(url) && String(opts?.headers?.accept).includes('vnd.npm.install-v1')) {
+      return { ok: false, status: 406, json: async () => ({}) };
+    }
+    return { ok: true, status: 200, json: async () => ({ name: '@clastres/groundcontrol', version: '0.1.12' }) };
+  };
+  const latest = new Function('fetch', 'PACKAGE',
+    `${slice('async function latestPublishedVersion() {', '/// Re-install the service from the newly published version.')}
+     return latestPublishedVersion;`)(fakeFetch, '@clastres/groundcontrol');
+  let version = null;
+  let error = null;
+  try { version = await latest(); } catch (e) { error = e.message; }
+  check('the update check gets a version back', version === '0.1.12', error || '');
+  check('it asks the latest endpoint of the right package',
+    requests[0]?.url === 'https://registry.npmjs.org/@clastres/groundcontrol/latest', requests[0]?.url);
+}
+
+// ---------- a takeover backs off instead of restarting ----------
+{
+  const backoff = new Function(`${slice('/// How long to stay off the relay', 'function connect() {')} return takeoverBackoffMs;`)();
+  const mins = [1, 2, 3, 4, 5, 6, 9].map((n) => backoff(n) / 60_000);
+  check('the first takeover waits a minute, then doubles', mins[0] === 1 && mins[1] === 2 && mins[2] === 4 && mins[3] === 8, mins.join(','));
+  check('and never waits more than fifteen minutes', mins.slice(4).every((m) => m === 15), mins.join(','));
+  const closeHandler = slice("  ws.on('close', (code) => {", "  ws.on('error', () => {});");
+  check('the service copy no longer exits on a takeover',
+    /if \(!runsFromServiceDir\) \{[\s\S]*process\.exit\(0\);[\s\S]*\}[\s\S]*setTimeout\(connect, wait\)/.test(closeHandler));
+}
+
+// ---------- replayed and stale commands are refused ----------
+{
+  const fresh = new Function(`${slice('// Replay protection.', 'let lastPongAt = Date.now();')} return freshCommand;`)();
+  const now = Date.now();
+  const frame = (tag) => `${tag.padEnd(16, 'A')}restOfTheCiphertext==`;
+  check('a new command is accepted', fresh(frame('n1'), { type: 'prompt', at: now }, now));
+  check('the same frame again is a replay', !fresh(frame('n1'), { type: 'prompt', at: now }, now + 1000));
+  check('a stamped command from twenty minutes ago is stale', !fresh(frame('n2'), { type: 'prompt', at: now - 20 * 60_000 }, now));
+  check('a clock a little ahead is fine', fresh(frame('n3'), { type: 'prompt', at: now + 60_000 }, now));
+  check('an older app with no stamp still gets through once', fresh(frame('n4'), { type: 'watch' }, now));
+  check('but not twice', !fresh(frame('n4'), { type: 'watch' }, now));
+
+  // The relay can respell a frame: base64 decoding skips whitespace and takes
+  // either alphabet. Every spelling must still count as the same frame.
+  const key = crypto.randomBytes(32);
+  const open = new Function('key', 'crypto', 'Buffer',
+    `${slice('function open(b64) {', '// ---------- environment hardening ----------')} return open;`)(key, crypto, Buffer);
+  const seal = (obj) => {
+    const nonce = crypto.randomBytes(12);
+    const c = crypto.createCipheriv('chacha20-poly1305', key, nonce, { authTagLength: 16 });
+    const ct = Buffer.concat([c.update(JSON.stringify(obj)), c.final()]);
+    return Buffer.concat([nonce, ct, c.getAuthTag()]).toString('base64');
+  };
+  const real = seal({ type: 'prompt', sessionId: 's', text: 'hi', at: now });
+  const spellings = [` ${real}`, `\n${real}`, `${real.slice(0, 8)} ${real.slice(8)}`, real.replace(/\+/g, '-').replace(/\//g, '_')];
+  check('a real frame is accepted', fresh(real, open(real), now));
+  for (const alt of spellings) {
+    let decoded = null;
+    try { decoded = open(alt); } catch {}
+    check(`respelled ${JSON.stringify(alt.slice(0, 3))}... still decrypts, and is still a replay`, decoded?.text === 'hi' && !fresh(alt, decoded, now + 5));
+  }
+}
+
+// ---------- the pairing key stays out of the log ----------
+{
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gc-scrub-'));
+  const LOG_FILE = path.join(dir, 'daemon.log');
+  const qrRow = '█ ▄▄▄▄▄ █ █▄▀▀█▄█ ▀█ ▄▀█ █▀  ▄█▄▄  █▀▄█ ▄▄▄▄▄ █';
+  fs.writeFileSync(LOG_FILE, [
+    '[daemon] connected to relay',
+    '▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄',
+    qrRow,
+    '  Pairing code (paste into the app):',
+    '  groundcontrol://pair#eyJ2IjoxLCJrIjoic2VjcmV0In0',
+    '[daemon] snapshot -> 2 session(s): a:idle, b:busy',
+    '',
+  ].join('\n'), { mode: 0o644 });
+  new Function('fs', 'path', 'LOG_FILE', 'CONF_DIR',
+    `${slice('/// Versions up to 0.1.11 printed the pairing code', "if (subcommand === 'qr') process.exit(0);")}
+     scrubLogSecrets();`)(fs, path, LOG_FILE, dir);
+  const after = fs.readFileSync(LOG_FILE, 'utf8');
+  check('the pairing code is gone from the log', !after.includes('eyJ2IjoxLCJrIjoic2VjcmV0In0'));
+  check('so is the QR that encodes it', !after.includes(qrRow) && !after.includes('▄▄▄▄▄▄▄▄'));
+  check('everything else in the log is kept', after.includes('[daemon] connected to relay') && after.includes('b:busy'));
+  check('the log is readable by its owner only', (fs.statSync(LOG_FILE).mode & 0o777) === 0o600,
+    (fs.statSync(LOG_FILE).mode & 0o777).toString(8));
+  let writes = 0;
+  const spyFs = { ...fs, writeFileSync: (...a) => { writes++; return fs.writeFileSync(...a); } };
+  new Function('fs', 'path', 'LOG_FILE', 'CONF_DIR',
+    `${slice('/// Versions up to 0.1.11 printed the pairing code', "if (subcommand === 'qr') process.exit(0);")}
+     scrubLogSecrets();`)(spyFs, path, LOG_FILE, dir);
+  check('a log already scrubbed is not rewritten on the next start', writes === 0, `${writes} write(s)`);
+  const print = slice("if (subcommand === 'qr' || process.stdout.isTTY) {", "if (runsFromServiceDir) scrubLogSecrets();");
+  check('a daemon writing to a file prints no pairing code', /else \{\s*console\.log\('  Pairing code hidden here/.test(print));
+  fs.rmSync(dir, { recursive: true, force: true });
+}
+
+// ---------- watch leases ----------
+{
+  const opened = [];
+  const fakeFs = {
+    watch(file, cb) {
+      const w = { file, cb, closed: false, close() { this.closed = true; } };
+      opened.push(w);
+      return w;
+    },
+  };
+  const sent = [];
+  const api = new Function('fs', 'findTranscript', 'readMessages', 'toPhone',
+    `${slice('const WATCH_LEASE_MS', 'async function handleCommand(cmd) {')}
+     return { watchTranscript, unwatchTranscript, renewWatch, expireWatches, holderOf, watchers, WATCH_LEASE_MS, LEGACY_LEASE_MS };`,
+  )(fakeFs, (id) => `/tmp/${id}.jsonl`, () => [], (m) => sent.push(m));
+  const { watchTranscript, unwatchTranscript, renewWatch, expireWatches, holderOf, watchers, WATCH_LEASE_MS, LEGACY_LEASE_MS } = api;
+  const a = holderOf({ client: 'phone-a' });
+  const b = holderOf({ client: 'phone-b' });
+
+  check('the first watch starts one', watchTranscript('s1', a) === 'created' && opened.length === 1);
+  check('a second phone shares it', watchTranscript('s1', b) === 'renewed' && opened.length === 1);
+  unwatchTranscript('s1', a);
+  check('one phone closing the chat keeps it streaming for the other', watchers.has('s1') && !opened[0].closed);
+  unwatchTranscript('s1', b);
+  check('the last one closing stops it', !watchers.has('s1') && opened[0].closed);
+
+  watchTranscript('s2', a);
+  const now = Date.now();
+  expireWatches(now + WATCH_LEASE_MS - 1000);
+  check('a lease inside its window stays', watchers.has('s2'));
+  expireWatches(now + WATCH_LEASE_MS + 1000);
+  check('a phone that vanished without an unwatch is let go', !watchers.has('s2') && opened[1].closed);
+
+  watchTranscript('s3');
+  expireWatches(now + WATCH_LEASE_MS + 1000);
+  check('an older app, which never renews, keeps its watch well past that', watchers.has('s3'));
+  renewWatch('s3', 'legacy', now + LEGACY_LEASE_MS - 5000);
+  expireWatches(now + LEGACY_LEASE_MS + 1000);
+  check('asking for the log renews it', watchers.has('s3'));
+  expireWatches(now + 2 * LEGACY_LEASE_MS);
+  check('and it still ends', !watchers.has('s3'));
+
+  renewWatch('s4', a);
+  check('a renewal never starts a watch by itself', !watchers.has('s4'));
+
+  // An older app with the chat still open lets its lease lapse while the
+  // session sits idle, then asks for the log when the session moves again.
+  watchTranscript('s5', 'legacy', now);
+  expireWatches(now + LEGACY_LEASE_MS + 1000);
+  check('an idle legacy chat lapses', !watchers.has('s5'));
+  renewWatch('s5', 'legacy', now + LEGACY_LEASE_MS + 60_000);
+  check('and asking for the log after that resumes the stream', watchers.has('s5'));
+  unwatchTranscript('s5', 'legacy');
+  watchTranscript('s6', 'legacy', now);
+  unwatchTranscript('s6', 'legacy');
+  renewWatch('s6', 'legacy', now + 1000);
+  check('a chat that was closed is not reopened by a later fetch', !watchers.has('s6'));
+
+  // A watcher that errors (journal replaced, volume hiccup) must not leave
+  // the chat silent for good: the next renewal starts a fresh one.
+  watchTranscript('s7', a, now);
+  const first = opened[opened.length - 1];
+  watchers.get('s7').watcher = null;          // what an 'error' leaves behind
+  check('a renewal after a watcher error watches again', watchTranscript('s7', a, now) === 'created'
+    && opened[opened.length - 1] !== first && watchers.has('s7'));
+  watchers.get('s7').watcher = null;
+  renewWatch('s7', a, now);
+  check('so does asking for the log', !!watchers.get('s7').watcher);
+}
+
+// ---------- a turn that never stops writing still streams ----------
+{
+  const opened = [];
+  const fakeFs = { watch(file, cb) { const w = { cb, close() {} }; opened.push(w); return w; } };
+  const sent = [];
+  const api = new Function('fs', 'findTranscript', 'readMessages', 'toPhone',
+    `${slice('const WATCH_LEASE_MS', 'async function handleCommand(cmd) {')}
+     return { watchTranscript };`,
+  )(fakeFs, (id) => `/tmp/${id}.jsonl`, () => [], (m) => sent.push(m));
+  api.watchTranscript('busy', 'phone:x');
+  const realNow = Date.now;
+  let t = realNow();
+  Date.now = () => t;
+  try {
+    for (let i = 0; i < 30; i++) { t += 100; opened[0].cb(); }   // a write every 100 ms for 3 s
+  } finally { Date.now = realNow; }
+  check('continuous writes reach the phone while they last, not only after', sent.length >= 2, `${sent.length} push(es) in 3 s`);
+}
+
+// ---------- the approvals socket comes back after a local takeover ----------
+{
+  const run = (inoOnDisk) => {
+    const log = { restarted: 0, closed: 0 };
+    const api = new Function('fs', 'ASK_SOCKET', 'bustHostCache', 'startApprovalServer', 'console', 'log',
+      `let approvalServer = { close() { log.closed++; } };
+       let approvalSocketIno = 41;
+       let approvalServerUp = true;
+       ${slice('/// A second copy started on this Mac unlinks the approvals socket', "// Claude Code's own status for each session")}
+       return () => { ensureApprovalSocket(); return approvalServerUp; };`,
+    )({ statSync: () => { if (inoOnDisk === null) throw new Error('ENOENT'); return { ino: inoOnDisk }; } },
+      '/tmp/approvals.sock', () => {}, () => { log.restarted++; }, { log() {} }, log);
+    const upAfter = api();
+    return { ...log, upAfter };
+  };
+  const same = run(41);
+  check('our own socket is left alone', same.restarted === 0 && same.closed === 0 && same.upAfter);
+  const replaced = run(99);
+  check('a socket another copy bound is taken back', replaced.restarted === 1 && replaced.closed === 1);
+  const gone = run(null);
+  check('so is a socket file that disappeared', gone.restarted === 1);
+  const onOpen = slice("  ws.on('open', () => {", "  ws.on('pong'");
+  check('and it is checked every time the relay is ours again', onOpen.includes('ensureApprovalSocket()'));
+}
+
+// ---------- prompts are acknowledged when they start ----------
+{
+  const sent = [];
+  const { promptAccepted, failureText } = new Function('toPhone',
+    `${slice('/// Tell the phone a headless run has started.', '// ---------- launching a new pilot ----------')}
+     return { promptAccepted, failureText };`)((m) => sent.push(m));
+  promptAccepted('abc');
+  check('a started run tells the phone ok at once', sent[0]?.type === 'promptResult' && sent[0].ok === true && sent[0].sessionId === 'abc');
+  check('a failure says why', failureText('codex', 1, 'warn: x\nerror: not logged in\n') === 'codex stopped: warn: x error: not logged in');
+  check('and falls back to the exit code', failureText('kimi', 2, '') === 'kimi exited with code 2');
+  for (const provider of ['claude --resume', 'spec.bin']) {
+    const at = src.indexOf(provider === 'spec.bin' ? 'const child = spawn(spec.bin' : "const child = spawn(bin, ['--resume'");
+    const block = src.slice(at, at + 1600);
+    check(`the ${provider === 'spec.bin' ? 'codex and kimi' : 'claude'} path acks on spawn`, /child\.on\('spawn', \(\) => promptAccepted\(/.test(block));
+  }
+}
+
+// ---------- turning approvals off lets go of what is held ----------
+{
+  const released = [];
+  const releaseAsksIfBack = new Function('pendingAsks', 'approvalConfig', 'releaseAllAsks', 'macIdleSeconds', 'settleAsk',
+    `${slice('function releaseAsksIfBack() {', '// ---------- self update ----------')} return releaseAsksIfBack;`,
+  )(new Map([['a1', {}]]), () => ({ mode: 'off' }), (note) => released.push(note), () => 0, () => {});
+  releaseAsksIfBack();
+  check('approvals off from the CLI hands held requests back', released[0] === 'remote approvals were turned off');
+  const phoneOff = slice('if (cmd.enabled === false) {', '} else {');
+  check('approvals off from the phone does too', phoneOff.includes("releaseAllAsks('remote approvals were turned off')"));
+}
+
+console.log(failures ? `\n${failures} check(s) failed` : '\nall checks passed');
+process.exit(failures ? 1 : 0);