@clastres/groundcontrol 0.1.5 → 0.1.7

package/daemon.mjs

@@ -11,8 +11,10 @@ import { WebSocket } from 'ws';
 import qrcode from 'qrcode-terminal';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
+import readline from 'node:readline';
 import { spawn, execFile, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
@@ -20,6 +22,9 @@ import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
+const VERSION = '0.1.7';
+const PACKAGE = '@clastres/groundcontrol';
+
 // ---------- config / pairing ----------
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
@@ -42,6 +47,12 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
     service status      Check the background daemon
     service install     Set up the background daemon without pairing output
     service uninstall   Remove the background daemon
+    approvals status    Check remote permission approvals
+    approvals away      Send permission prompts to the phone only while you
+                        are away from the Mac (the default)
+    approvals always    Send them to the phone whenever it is connected
+    approvals off       Keep every permission prompt on the Mac
+    approvals uninstall Remove the permission hook from Claude Code
 
   Options:
     --relay <url>   Use a custom relay (default: wss://relay.groundcontrol.chat)
@@ -54,7 +65,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   process.exit(0);
 }
 if (process.argv.includes('--version')) {
-  console.log('0.1.5');
+  console.log(VERSION);
   process.exit(0);
 }
 
@@ -66,9 +77,10 @@ if (process.argv.includes('--version')) {
 
 const subcommand = process.argv[2];
 const LABEL = 'chat.groundcontrol.daemon';
-const SERVICE_DIR = path.join(os.homedir(), '.groundcontrol', 'service');
+const CONF_DIR = path.join(os.homedir(), '.groundcontrol');
+const SERVICE_DIR = path.join(CONF_DIR, 'service');
 const PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
-const LOG_FILE = path.join(os.homedir(), '.groundcontrol', 'daemon.log');
+const LOG_FILE = path.join(CONF_DIR, 'daemon.log');
 const THIS_FILE = fs.realpathSync(fileURLToPath(import.meta.url));
 const runsFromServiceDir = THIS_FILE.startsWith(SERVICE_DIR + path.sep);
 
@@ -123,17 +135,36 @@ function explainStoppedService(printOut) {
 /// Returns true when launchd reports the job running.
 function installService() {
   const uid = process.getuid();
+
+  // Stage into a scratch directory first and only disturb the running service
+  // once every file is in place. The old order (bootout, delete, then copy)
+  // meant any failure mid copy left the user with no daemon at all, which is
+  // unacceptable now that self update runs this unattended.
+  const staging = `${SERVICE_DIR}.staging`;
+  try {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.mkdirSync(path.join(staging, 'node_modules'), { recursive: true });
+    fs.copyFileSync(THIS_FILE, path.join(staging, 'daemon.mjs'));
+    // The permission hook ships beside the daemon and must travel with it, so a
+    // service copy can re-stage it after an upgrade without the npx cache.
+    fs.copyFileSync(hookSourceFile(), path.join(staging, 'hook.mjs'));
+    fs.writeFileSync(
+      path.join(staging, 'package.json'),
+      JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
+    );
+    for (const dep of ['ws', 'qrcode-terminal']) {
+      fs.cpSync(packageDirOf(dep), path.join(staging, 'node_modules', dep), { recursive: true });
+    }
+  } catch (e) {
+    // Nothing has been touched yet, so the existing service keeps running.
+    console.log(`[daemon] could not stage the service, leaving the current one alone: ${e.message}`);
+    fs.rmSync(staging, { recursive: true, force: true });
+    return false;
+  }
+
   launchctl(`bootout gui/${uid}/${LABEL}`);
   fs.rmSync(SERVICE_DIR, { recursive: true, force: true });
-  fs.mkdirSync(path.join(SERVICE_DIR, 'node_modules'), { recursive: true });
-  fs.copyFileSync(THIS_FILE, path.join(SERVICE_DIR, 'daemon.mjs'));
-  fs.writeFileSync(
-    path.join(SERVICE_DIR, 'package.json'),
-    JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
-  );
-  for (const dep of ['ws', 'qrcode-terminal']) {
-    fs.cpSync(packageDirOf(dep), path.join(SERVICE_DIR, 'node_modules', dep), { recursive: true });
-  }
+  fs.renameSync(staging, SERVICE_DIR);
 
   const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
   const nodeBin = stableNodePath();
@@ -184,6 +215,181 @@ function installService() {
   return true;
 }
 
+// ---------- remote approvals: Claude Code hook installation ----------
+// Claude Code fires a PermissionRequest hook whenever a tool call needs a
+// decision. Our hook hands the request to this daemon, which either holds it
+// for the phone or passes immediately so the terminal prompts as usual.
+
+const CLAUDE_SETTINGS = path.join(os.homedir(), '.claude', 'settings.json');
+const HOOK_FILE = path.join(CONF_DIR, 'hook.mjs');
+// Generous, because the daemon settles every request itself. This only caps
+// the case where the daemon wedges while holding.
+const HOOK_TIMEOUT_SECONDS = 12 * 60 * 60;
+
+const hookSourceFile = () => path.join(path.dirname(THIS_FILE), 'hook.mjs');
+
+/// Copy the hook next to the key material so it survives npx cache eviction.
+function stageHookFile() {
+  fs.mkdirSync(CONF_DIR, { recursive: true });
+  fs.copyFileSync(hookSourceFile(), HOOK_FILE);
+}
+
+const hookCommand = () => `${JSON.stringify(stableNodePath())} ${JSON.stringify(HOOK_FILE)}`;
+
+/// Every command string an entry can carry, flattened, so a hook can be
+/// recognised whether it uses the nested or the shorthand form.
+const commandsOf = (entry) => [entry?.command, entry?.bash, ...(Array.isArray(entry?.hooks) ? entry.hooks.map((h) => h?.command) : [])]
+  .filter((c) => typeof c === 'string').join(' ');
+
+const isOurHook = (cmd) => cmd.includes('.groundcontrol') && cmd.includes('hook.mjs');
+
+/// Read settings.json. Returns null when it exists but cannot be parsed, which
+/// must never be treated as "empty": overwriting it would destroy real config.
+function readClaudeSettings() {
+  if (!fs.existsSync(CLAUDE_SETTINGS)) return {};
+  try {
+    const parsed = JSON.parse(fs.readFileSync(CLAUDE_SETTINGS, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch { return null; }
+}
+
+function backupClaudeSettings() {
+  if (!fs.existsSync(CLAUDE_SETTINGS)) return null;
+  const dest = `${CLAUDE_SETTINGS}.groundcontrol-backup`;
+  try { fs.copyFileSync(CLAUDE_SETTINGS, dest); return dest; } catch { return null; }
+}
+
+/// Add our hook to settings.json. Strictly additive: the only entry it ever
+/// removes is our own previous one, so an upgrade replaces it instead of
+/// stacking duplicates. Another tool's hooks are reported, never touched.
+/// Writes only when something actually changes, so restarts are inert.
+///
+/// Nothing is written unless `consent` is true. Editing another tool's config
+/// is not something to do behind someone's back, so the caller has to have
+/// asked first, or the user has to have run `groundcontrol approvals on`.
+function installApprovalHook({ consent = false } = {}) {
+  try { stageHookFile(); } catch (e) { return { ok: false, reason: `could not stage the hook file: ${e.message}` }; }
+  if (!fs.existsSync(path.dirname(CLAUDE_SETTINGS))) return { ok: false, reason: 'no ~/.claude directory on this Mac' };
+
+  const settings = readClaudeSettings();
+  if (settings === null) return { ok: false, reason: '~/.claude/settings.json is not valid JSON, leaving it untouched' };
+
+  const before = JSON.stringify(settings.hooks?.PermissionRequest ?? null);
+  const existing = Array.isArray(settings.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const foreign = [];
+  const kept = existing.filter((entry) => {
+    const cmd = commandsOf(entry);
+    if (isOurHook(cmd)) return false;               // ours, re-added fresh below
+    if (cmd) foreign.push(cmd.trim().slice(0, 70));
+    return true;                                     // everyone else stays, always
+  });
+  const next = [...kept, {
+    matcher: '*',
+    hooks: [{ type: 'command', command: hookCommand(), timeout: HOOK_TIMEOUT_SECONDS }],
+  }];
+  if (JSON.stringify(next) === before) return { ok: true, unchanged: true, foreign };
+  if (!consent) return { ok: false, needsConsent: true, foreign, reason: 'the permission hook is not installed yet' };
+
+  const raw = fs.existsSync(CLAUDE_SETTINGS) ? fs.readFileSync(CLAUDE_SETTINGS, 'utf8') : '';
+  // A rewrite goes through JSON.parse/stringify, so any // comments in the
+  // file are lost. Worth saying out loud rather than quietly dropping them.
+  const hadComments = /^\s*\/\//m.test(raw);
+  const backup = backupClaudeSettings();
+  settings.hooks = settings.hooks && typeof settings.hooks === 'object' ? settings.hooks : {};
+  settings.hooks.PermissionRequest = next;
+  try { fs.writeFileSync(CLAUDE_SETTINGS, JSON.stringify(settings, null, 2) + '\n'); }
+  catch (e) { return { ok: false, reason: `could not write settings.json: ${e.message}` }; }
+  return { ok: true, installed: true, foreign, backup, hadComments };
+}
+
+/// Remove only our own entry, leaving anything else in place.
+function uninstallApprovalHook() {
+  const settings = readClaudeSettings();
+  if (settings === null) return { ok: false, reason: '~/.claude/settings.json is not valid JSON, leaving it untouched' };
+  const existing = Array.isArray(settings.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const kept = existing.filter((entry) => !isOurHook(commandsOf(entry)));
+  if (kept.length === existing.length) return { ok: true, unchanged: true };
+  backupClaudeSettings();
+  if (kept.length) settings.hooks.PermissionRequest = kept;
+  else delete settings.hooks.PermissionRequest;
+  if (settings.hooks && !Object.keys(settings.hooks).length) delete settings.hooks;
+  try { fs.writeFileSync(CLAUDE_SETTINGS, JSON.stringify(settings, null, 2) + '\n'); }
+  catch (e) { return { ok: false, reason: `could not write settings.json: ${e.message}` }; }
+  return { ok: true };
+}
+
+/// Another tool answering the same event is worth knowing about: Claude Code
+/// runs every PermissionRequest hook and any deny wins, so a second one can
+/// overrule your tap. Ground Control says so and leaves it alone. Removing it
+/// is your call, not ours.
+function reportForeignHooks(foreign) {
+  if (!foreign?.length) return;
+  console.log('\n  Another app also answers permission requests on this Mac:');
+  for (const cmd of foreign) console.log(`    ${cmd}`);
+  console.log('  Both will run. If either denies, the tool call is denied, so a');
+  console.log('  tap on your phone can be overruled. Ground Control leaves it in');
+  console.log('  place; remove it yourself if you want only one app deciding.');
+}
+
+/// Ask before editing ~/.claude/settings.json. Anything but an interactive
+/// terminal answers no: a background or piped run must never decide this.
+async function askYesNo(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve) => rl.question(question, resolve));
+  rl.close();
+  return /^y(es)?$/i.test(answer.trim()) || answer.trim() === '';
+}
+
+/// Offer remote approvals during pairing, then do exactly what was answered.
+async function offerApprovals() {
+  const state = installApprovalHook();
+  if (state.ok && state.unchanged) {
+    console.log('  Permission prompts already reach your phone.');
+    reportForeignHooks(state.foreign);
+    return;
+  }
+  if (!state.ok && !state.needsConsent) {
+    console.log(`  Remote approvals unavailable: ${state.reason}`);
+    return;
+  }
+  console.log('  One more thing. Claude Code stops and asks before it runs');
+  console.log('  risky commands. Ground Control can send those to your phone');
+  console.log('  while you are away from the Mac, so a session does not sit');
+  console.log('  blocked until you get back. Sitting at your Mac, prompts stay');
+  console.log('  in the terminal exactly as they do now.');
+  console.log('');
+  console.log('  This adds one hook to ~/.claude/settings.json. Nothing else in');
+  console.log('  that file is changed, and a backup is written first.');
+  reportForeignHooks(state.foreign);
+  console.log('');
+  if (!await askYesNo('  Turn on remote approvals? [Y/n] ')) {
+    console.log('\n  Left alone. Turn it on later with: groundcontrol approvals on\n');
+    return;
+  }
+  const done = installApprovalHook({ consent: true });
+  console.log('');
+  reportHookInstall(done);
+  console.log('  Change it anytime: groundcontrol approvals <away|always|off>\n');
+}
+
+function reportHookInstall(result) {
+  if (result.needsConsent) {
+    console.log('  Remote approvals are not set up yet. Turn them on with:');
+    console.log('  groundcontrol approvals on');
+    reportForeignHooks(result.foreign);
+    return;
+  }
+  if (!result.ok) {
+    console.log(`  Remote approvals are off: ${result.reason}`);
+    return;
+  }
+  if (result.installed) console.log('  Permission prompts can now reach your phone.');
+  if (result.backup) console.log(`  Backed up your settings to ${result.backup}`);
+  if (result.hadComments) console.log('  Heads up: comments in settings.json were dropped by the rewrite.');
+  reportForeignHooks(result.foreign);
+}
+
 if (subcommand === 'service') {
   const action = process.argv[3];
   if (process.platform !== 'darwin') {
@@ -196,7 +402,10 @@ if (subcommand === 'service') {
     if (installService()) {
       console.log('\n  Ground Control daemon is now running in the background.');
       console.log('  It starts at login and restarts automatically if it stops.\n');
+      // Deliberately not installing the hook here: this path is the scripted,
+      // non-interactive one, so there is nobody to ask.
       console.log(`  Log:       ${LOG_FILE}`);
+      console.log('  Approvals: groundcontrol approvals on');
       console.log('  Pair:      groundcontrol qr');
       console.log('  Check:     groundcontrol service status');
       console.log('  Remove:    groundcontrol service uninstall\n');
@@ -234,12 +443,91 @@ if (subcommand === 'service') {
   process.exit(1);
 }
 
+// ---------- remote approvals: policy config ----------
+
+const APPROVALS_CONF = path.join(CONF_DIR, 'approvals.json');
+const APPROVAL_DEFAULTS = {
+  // away:   hold for the phone only while you are not using the Mac
+  // always: hold whenever a phone is connected
+  // off:    never hold; the terminal prompts exactly as it always has
+  mode: 'away',
+  awayAfterSeconds: 90,
+  holdMinutes: 720,
+};
+
+let approvalConfCache = { at: 0, value: APPROVAL_DEFAULTS };
+function approvalConfig() {
+  if (Date.now() - approvalConfCache.at < 5000) return approvalConfCache.value;
+  let value = APPROVAL_DEFAULTS;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(APPROVALS_CONF, 'utf8'));
+    if (parsed && typeof parsed === 'object') value = { ...APPROVAL_DEFAULTS, ...parsed };
+  } catch {}
+  if (!['away', 'always', 'off'].includes(value.mode)) value = { ...value, mode: 'away' };
+  approvalConfCache = { at: Date.now(), value };
+  return value;
+}
+
+function writeApprovalConfig(patch) {
+  fs.mkdirSync(CONF_DIR, { recursive: true });
+  let current = {};
+  try { current = JSON.parse(fs.readFileSync(APPROVALS_CONF, 'utf8')) || {}; } catch {}
+  const next = { ...APPROVAL_DEFAULTS, ...current, ...patch };
+  fs.writeFileSync(APPROVALS_CONF, JSON.stringify(next, null, 2) + '\n');
+  approvalConfCache = { at: 0, value: APPROVAL_DEFAULTS };
+  return next;
+}
+
+if (subcommand === 'approvals') {
+  const action = process.argv[3] || 'status';
+  if (action === 'on' || action === 'always' || action === 'away') {
+    const mode = action === 'on' ? 'away' : action;
+    console.log(`\n  Remote approvals: ${writeApprovalConfig({ mode }).mode}`);
+    reportHookInstall(installApprovalHook({ consent: true }));
+    console.log('');
+    process.exit(0);
+  }
+  if (action === 'off') {
+    writeApprovalConfig({ mode: 'off' });
+    console.log('\n  Remote approvals are off. Permission prompts stay on the Mac.');
+    console.log('  The hook stays installed and does nothing. Remove it fully with:');
+    console.log('  groundcontrol approvals uninstall\n');
+    process.exit(0);
+  }
+  if (action === 'install') {
+    reportHookInstall(installApprovalHook({ consent: true }));
+    console.log('');
+    process.exit(0);
+  }
+  if (action === 'uninstall') {
+    const r = uninstallApprovalHook();
+    console.log(r.ok ? '\n  Permission hook removed.\n' : `\n  ${r.reason}\n`);
+    process.exit(0);
+  }
+  if (action === 'status') {
+    const cfg = approvalConfig();
+    const settings = readClaudeSettings();
+    const entries = Array.isArray(settings?.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+    const installed = entries.some((e) => isOurHook(commandsOf(e)));
+    const others = entries.filter((e) => !isOurHook(commandsOf(e))).map((e) => commandsOf(e).trim().slice(0, 70));
+    console.log(`\n  Mode:        ${cfg.mode}${cfg.mode === 'away' ? ` (after ${cfg.awayAfterSeconds}s idle)` : ''}`);
+    console.log(`  Hook:        ${installed ? 'installed' : 'NOT installed'}`);
+    console.log(`  Hook file:   ${fs.existsSync(HOOK_FILE) ? HOOK_FILE : 'missing'}`);
+    console.log(`  Hold limit:  ${cfg.holdMinutes} minutes, then the Mac prompts instead`);
+    if (settings === null) console.log('  Settings:    ~/.claude/settings.json is not valid JSON');
+    for (const o of others) console.log(`  Also runs:   ${o}`);
+    console.log(`  Config:      ${APPROVALS_CONF}\n`);
+    process.exit(0);
+  }
+  console.log('\n  Usage: groundcontrol approvals <status|on|off|always|install|uninstall>\n');
+  process.exit(1);
+}
+
 const argRelay = (() => {
   const i = process.argv.indexOf('--relay');
   return i > -1 ? process.argv[i + 1] : null;
 })();
 
-const CONF_DIR = path.join(os.homedir(), '.groundcontrol');
 const KEY_FILE = path.join(CONF_DIR, 'key');
 const RELAY_FILE = path.join(CONF_DIR, 'relay');
 fs.mkdirSync(CONF_DIR, { recursive: true });
@@ -283,6 +571,7 @@ if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin'
   if (installService()) {
     console.log('\n  Done. The daemon now runs in the background: it starts at');
     console.log('  login and restarts by itself. You can close this window.\n');
+    await offerApprovals();
     console.log('  If macOS asks to allow "node" to control Terminal or iTerm2,');
     console.log('  click Allow. That is how phone messages reach your sessions.\n');
     console.log('  Scan the QR above with the Ground Control app to pair.');
@@ -346,10 +635,27 @@ function widenPath() {
 }
 widenPath();
 
-let claudeBin = null;
-try { claudeBin = execSync('command -v claude', { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() || null; } catch {}
+const which = (cmd) => { try { return execSync(`command -v ${cmd}`, { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() || null; } catch { return null; } };
+const executable = (p) => { try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { return null; } };
+
+const claudeBin = which('claude');
 console.log(`[daemon] claude binary: ${claudeBin || 'NOT FOUND (phone prompts to idle sessions without a visible terminal will fail)'}`);
 
+// Codex ships a full CLI inside the ChatGPT desktop app, so Codex Desktop
+// users can receive phone prompts even without a standalone install.
+const codexBin = which('codex') || executable('/Applications/ChatGPT.app/Contents/Resources/codex');
+
+// Kimi Code renames a legacy Python `kimi` shim to `kimi-legacy` on install,
+// so when the Kimi Code store (~/.kimi-code) exists, `kimi` on PATH belongs
+// to Kimi Code and `kimi-legacy` is the old CLI. Without the store, `kimi` is
+// the legacy one. The two binaries cannot resume each other's sessions, so
+// neither ever doubles for the other.
+const kimiCodeInstalled = fs.existsSync(path.join(os.homedir(), '.kimi-code'));
+const kimiCodeBin = kimiCodeInstalled
+  ? which('kimi') || executable(path.join(os.homedir(), '.kimi-code', 'bin', 'kimi'))
+  : null;
+const kimiLegacyBin = which('kimi-legacy') || (kimiCodeInstalled ? null : which('kimi'));
+
 // ---------- Claude Code session discovery ----------
 
 const CLAUDE = path.join(os.homedir(), '.claude');
@@ -541,6 +847,11 @@ function extractText(message) {
 function readMessages(sessionId, maxBytes = 512 * 1024, limit = 80) {
   const file = findTranscript(sessionId);
   if (!file) return [];
+  // path.sep keeps the prefixes unambiguous: without it ~/.kimi would also
+  // match every ~/.kimi-code path and routing would depend on check order.
+  if (file.startsWith(CODEX_SESS_DIR + path.sep)) return readCodexMessages(file, maxBytes, limit);
+  if (file.startsWith(KIMICODE_DIR + path.sep)) return readKimiCodeMessages(file, maxBytes, limit);
+  if (file.startsWith(KIMI_DIR + path.sep)) return readKimiLegacyMessages(file, maxBytes, limit);
   let raw;
   try {
     const size = fs.statSync(file).size;
@@ -566,7 +877,7 @@ function readMessages(sessionId, maxBytes = 512 * 1024, limit = 80) {
   return out.slice(-limit);
 }
 
-function readSessions() {
+function readClaudeSessions() {
   const sessions = [];
   let files = [];
   try { files = fs.readdirSync(SESSIONS_DIR); } catch {}
@@ -579,10 +890,15 @@ function readSessions() {
     const tty = ttyOf(s.pid);
     sessions.push({
       id: s.sessionId,
+      provider: 'claude',
       name: s.name || path.basename(s.cwd || '?'),
       cwd: s.cwd || '',
       project: path.basename(s.cwd || '?'),
       status: headlessActive.has(s.sessionId) ? 'busy' : (s.status || 'idle'),
+      // Claude Code's own view, kept separate because readSessions overwrites
+      // status to 'waiting' for a held request. Answering on the Mac is only
+      // detectable by watching this drop back out of 'waiting'.
+      rawStatus: s.status || 'idle',
       updatedAt: s.statusUpdatedAt || s.updatedAt || 0,
       startedAt: s.startedAt || 0,
       lastMessage: msgs.length ? msgs[msgs.length - 1] : null,
@@ -590,22 +906,845 @@ function readSessions() {
       live: canInject(tty),
     });
   }
+  return sessions;
+}
+
+// ---------- Codex session discovery ----------
+// Codex (CLI, VS Code extension, and the Codex Desktop app) all write the same
+// rollout JSONL files under ~/.codex/sessions/YYYY/MM/DD/. There is no pid or
+// tty on disk, so a session counts as present while its rollout stays fresh,
+// and busy while its last task_started has no matching end event. Prompts go
+// through `codex exec resume`, which appends to the same rollout file.
+
+const CODEX_DIR = path.join(os.homedir(), '.codex');
+const CODEX_SESS_DIR = path.join(CODEX_DIR, 'sessions');
+const CODEX_INDEX = path.join(CODEX_DIR, 'session_index.jsonl');
+const CODEX_ACTIVE_WINDOW_MS = 2 * 60 * 60 * 1000; // rollout idle this long = off the island
+const CODEX_BUSY_STALE_MS = 10 * 60 * 1000; // a working turn keeps writing; silence means it died
+
+// Codex Desktop names threads ("Polish Slack message"); the index maps id -> name.
+// The index is append-only and grows for as long as Codex is used, so it is
+// only re-parsed when its size or mtime actually moved.
+let codexNames = new Map();
+let codexNamesAt = 0;
+let codexNamesStat = '';
+function codexThreadNames() {
+  if (Date.now() - codexNamesAt < 30_000) return codexNames;
+  codexNamesAt = Date.now();
+  try {
+    const st = fs.statSync(CODEX_INDEX);
+    const sig = `${st.size}:${st.mtimeMs}`;
+    if (sig === codexNamesStat) return codexNames;
+    codexNamesStat = sig;
+    for (const line of fs.readFileSync(CODEX_INDEX, 'utf8').split('\n')) {
+      if (!line.trim()) continue;
+      try {
+        const e = JSON.parse(line);
+        if (e.id && e.thread_name) codexNames.set(e.id, e.thread_name);
+      } catch {}
+    }
+  } catch {}
+  return codexNames;
+}
+
+const codexMetaCache = new Map(); // rollout path -> {size, meta} from the first line
+
+function codexMetaOf(file) {
+  // A parse failure usually means the scan raced Codex mid-write of the first
+  // line, so a failed result is only trusted while the file has not grown;
+  // caching null forever would hide the session for the daemon's lifetime.
+  let size = 0;
+  try { size = fs.statSync(file).size; } catch { return null; }
+  const cached = codexMetaCache.get(file);
+  if (cached && (cached.meta || cached.size === size)) return cached.meta;
+  let meta = null;
+  try {
+    // The first line nests the full system prompt, so it can run past 100KB;
+    // keep reading until the line actually ends.
+    const fd = fs.openSync(file, 'r');
+    const chunks = [];
+    const buf = Buffer.alloc(64 * 1024);
+    for (let pos = 0; pos < 1024 * 1024; ) {
+      const n = fs.readSync(fd, buf, 0, buf.length, pos);
+      if (n === 0) break;
+      chunks.push(Buffer.from(buf.subarray(0, n)));
+      pos += n;
+      if (buf.subarray(0, n).includes(0x0a)) break;
+    }
+    fs.closeSync(fd);
+    const j = JSON.parse(Buffer.concat(chunks).toString('utf8').split('\n')[0]);
+    if (j.type === 'session_meta' && j.payload?.session_id) {
+      meta = {
+        id: j.payload.session_id,
+        cwd: j.payload.cwd || '',
+        startedAt: Date.parse(j.payload.timestamp || j.timestamp) || 0,
+      };
+    }
+  } catch {}
+  codexMetaCache.set(file, { size, meta });
+  return meta;
+}
+
+function tailLines(file, maxBytes) {
+  const size = fs.statSync(file).size;
+  const fd = fs.openSync(file, 'r');
+  const start = Math.max(0, size - maxBytes);
+  const buf = Buffer.alloc(size - start);
+  fs.readSync(fd, buf, 0, buf.length, start);
+  fs.closeSync(fd);
+  return buf.toString('utf8').split('\n');
+}
+
+// Journal scans re-run on every cache refresh; keying results on (mtime, size)
+// makes the rescan free for every file that did not change since last time.
+const scanMemo = new Map(); // key -> {m, s, v}
+function memoScan(key, file, fn) {
+  let st;
+  try { st = fs.statSync(file); } catch { return fn(); }
+  const c = scanMemo.get(key);
+  if (c && c.m === st.mtimeMs && c.s === st.size) return c.v;
+  const v = fn();
+  scanMemo.set(key, { m: st.mtimeMs, s: st.size, v });
+  return v;
+}
+
+// The user_message / agent_message events carry only genuinely typed and
+// spoken turns; injected context blocks only appear as response_items.
+function readCodexMessages(file, maxBytes = 512 * 1024, limit = 80) {
+  let lines;
+  try { lines = tailLines(file, maxBytes); } catch { return []; }
+  const out = [];
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let e; try { e = JSON.parse(line); } catch { continue; }
+    if (e.type !== 'event_msg') continue;
+    const p = e.payload || {};
+    if (p.type === 'user_message' && p.message) {
+      out.push({ role: 'user', text: String(p.message).trim().slice(0, 4000), ts: e.timestamp || null });
+    } else if (p.type === 'agent_message' && p.message) {
+      out.push({ role: 'assistant', text: String(p.message).trim().slice(0, 4000), ts: e.timestamp || null });
+    }
+  }
+  return out.slice(-limit);
+}
+
+function codexActivityOf(file) {
+  let lines;
+  try { lines = tailLines(file, 64 * 1024); } catch { return { busy: false, sawMarkers: true, lastMessage: null }; }
+  let lastStart = 0, lastEnd = 0, lastMessage = null;
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let e; try { e = JSON.parse(line); } catch { continue; }
+    if (e.type !== 'event_msg') continue;
+    const p = e.payload || {};
+    const ts = Date.parse(e.timestamp) || 0;
+    if (p.type === 'task_started') lastStart = Math.max(lastStart, ts);
+    else if (p.type === 'task_complete' || p.type === 'task_aborted' || p.type === 'turn_aborted' || p.type === 'error') lastEnd = Math.max(lastEnd, ts);
+    else if (p.type === 'user_message' && p.message) lastMessage = { role: 'user', text: String(p.message).trim().slice(0, 4000), ts: e.timestamp || null };
+    else if (p.type === 'agent_message' && p.message) lastMessage = { role: 'assistant', text: String(p.message).trim().slice(0, 4000), ts: e.timestamp || null };
+  }
+  // No turn markers in the tail means a long streaming turn pushed them out
+  // (a finished turn always ends with its completion event in the tail), so
+  // the caller must treat freshness as the busy signal, not assume idle.
+  return { busy: lastStart > lastEnd, sawMarkers: lastStart > 0 || lastEnd > 0, lastMessage };
+}
+
+// Walking every date dir stays cheap at this scale, and a resumed months-old
+// thread appends to its original file, so no date cutoff during the walk.
+function codexRolloutFiles() {
+  const files = [];
+  const walk = (dir, depth) => {
+    let entries = [];
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      const p = path.join(dir, e.name);
+      if (e.isDirectory() && depth < 3) walk(p, depth + 1);
+      else if (e.isFile() && e.name.endsWith('.jsonl')) files.push(p);
+    }
+  };
+  walk(CODEX_SESS_DIR, 0);
+  return files;
+}
+
+let codexCache = { at: 0, sessions: [] };
+function readCodexSessions() {
+  if (Date.now() - codexCache.at < 10_000) return codexCache.sessions;
+  codexCache.at = Date.now();
+  const names = codexThreadNames();
+  const sessions = [];
+  for (const file of codexRolloutFiles()) {
+    let mtime;
+    try { mtime = fs.statSync(file).mtimeMs; } catch { continue; }
+    if (Date.now() - mtime > CODEX_ACTIVE_WINDOW_MS) continue;
+    const meta = codexMetaOf(file);
+    if (!meta) continue;
+    const act = memoScan(`codex:${file}`, file, () => codexActivityOf(file));
+    const busy = (act.busy || (!act.sawMarkers && Date.now() - mtime < 60_000))
+      && Date.now() - mtime < CODEX_BUSY_STALE_MS;
+    transcriptCache.set(meta.id, file);
+    sessions.push({
+      id: meta.id,
+      provider: 'codex',
+      name: names.get(meta.id) || path.basename(meta.cwd || '?'),
+      cwd: meta.cwd,
+      project: path.basename(meta.cwd || '?'),
+      status: headlessActive.has(meta.id) || busy ? 'busy' : 'idle',
+      updatedAt: mtime,
+      startedAt: meta.startedAt,
+      lastMessage: act.lastMessage,
+      tty: '',
+      live: false,
+    });
+  }
+  codexCache.sessions = sessions;
+  return sessions;
+}
+
+// ---------- Kimi session discovery ----------
+// Two on-disk generations exist. The legacy Python CLI keeps sessions in
+// ~/.kimi/sessions/<md5(workdir)>/<uuid>/ with a context.jsonl history and a
+// wire.jsonl event log (TurnBegin/TurnEnd bracket a working turn). The new
+// Kimi Code CLI keeps ~/.kimi-code/sessions/<wdKey>/<sessionId>/ with
+// state.json metadata and a per-agent journal in agents/main/wire.jsonl whose
+// records are {type, time, ...payload}. Neither writes a pid, so presence and
+// busyness come from journal freshness, like Codex.
+
+const KIMI_DIR = path.join(os.homedir(), '.kimi');
+const KIMICODE_DIR = path.join(os.homedir(), '.kimi-code');
+const KIMI_ACTIVE_WINDOW_MS = CODEX_ACTIVE_WINDOW_MS;
+// Wide enough that a turn quietly grinding through a long tool run (build,
+// test suite) does not flip to idle and admit a second writer.
+const KIMI_BUSY_STALE_MS = 5 * 60 * 1000;
+
+const readJson = (file) => { try { return JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; } };
+
+const kosongText = (content) => {
+  if (typeof content === 'string') return content;
+  if (Array.isArray(content)) return content.filter((p) => p && (p.type === 'text' || p.text)).map((p) => p.text || '').join('\n');
+  return '';
+};
+
+// Legacy ~/.kimi: kimi.json maps workdirs to their md5 bucket names.
+function kimiWorkdirByBucket() {
+  const map = new Map();
+  const meta = readJson(path.join(KIMI_DIR, 'kimi.json'));
+  for (const wd of meta?.work_dirs || []) {
+    if (wd?.path) map.set(crypto.createHash('md5').update(wd.path).digest('hex'), wd.path);
+  }
+  return map;
+}
+
+function readKimiLegacyMessages(file, maxBytes = 512 * 1024, limit = 80) {
+  let lines;
+  try { lines = tailLines(file, maxBytes); } catch { return []; }
+  const out = [];
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let e; try { e = JSON.parse(line); } catch { continue; }
+    if (e.partial || (e.role !== 'user' && e.role !== 'assistant')) continue;
+    const text = kosongText(e.content).trim();
+    if (!text) continue;
+    out.push({ role: e.role, text: text.slice(0, 4000), ts: null });
+  }
+  return out.slice(-limit);
+}
+
+function kimiLegacyBusy(wireFile) {
+  let lines;
+  try { lines = tailLines(wireFile, 64 * 1024); } catch { return { busy: false, sawMarkers: true }; }
+  let busy = false, sawMarkers = false;
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let e; try { e = JSON.parse(line); } catch { continue; }
+    const t = e.message?.type;
+    if (t === 'TurnBegin') { busy = true; sawMarkers = true; }
+    else if (t === 'TurnEnd' || t === 'StepInterrupted') { busy = false; sawMarkers = true; }
+  }
+  return { busy, sawMarkers };
+}
+
+function readKimiLegacySessions() {
+  const sessions = [];
+  const root = path.join(KIMI_DIR, 'sessions');
+  let buckets = [];
+  try { buckets = fs.readdirSync(root); } catch { return sessions; }
+  const workdirs = kimiWorkdirByBucket();
+  for (const bucket of buckets) {
+    let ids = [];
+    try { ids = fs.readdirSync(path.join(root, bucket)); } catch { continue; }
+    for (const id of ids) {
+      const dir = path.join(root, bucket, id);
+      const context = path.join(dir, 'context.jsonl');
+      const wire = path.join(dir, 'wire.jsonl');
+      let mtime = 0, started = 0;
+      try {
+        const st = fs.statSync(context);
+        mtime = st.mtimeMs;
+        started = st.birthtimeMs || st.ctimeMs;
+      } catch { continue; }
+      try { mtime = Math.max(mtime, fs.statSync(wire).mtimeMs); } catch {}
+      if (Date.now() - mtime > KIMI_ACTIVE_WINDOW_MS) continue;
+      const cwd = workdirs.get(bucket) || '';
+      const state = readJson(path.join(dir, 'state.json'));
+      if (state?.archived) continue;
+      const msgs = memoScan(`kimi:${context}`, context, () => readKimiLegacyMessages(context, 64 * 1024, 1));
+      const act = memoScan(`kimi:${wire}`, wire, () => kimiLegacyBusy(wire));
+      const busy = (act.busy || (!act.sawMarkers && Date.now() - mtime < 60_000))
+        && Date.now() - mtime < KIMI_BUSY_STALE_MS;
+      transcriptCache.set(id, context);
+      sessions.push({
+        id,
+        provider: 'kimi',
+        name: state?.custom_title || path.basename(cwd || '?'),
+        cwd,
+        project: path.basename(cwd || '?'),
+        status: headlessActive.has(id) || busy ? 'busy' : 'idle',
+        updatedAt: mtime,
+        startedAt: started,
+        lastMessage: msgs.length ? msgs[msgs.length - 1] : null,
+        tty: '',
+        live: false,
+      });
+    }
+  }
+  return sessions;
+}
+
+// A truthy but unparseable time value must not throw: this runs inside the
+// snapshot interval, where an exception would crash-loop the whole daemon.
+const isoOf = (t) => { try { return t ? new Date(t).toISOString() : null; } catch { return null; } };
+
+// Kimi Code journal: turn.prompt opens a turn; a text-only assistant message
+// (no tool calls), a turn.cancel, or an Interrupt closes it.
+function kimiCodeScan(wireFile, maxBytes = 512 * 1024, limit = 80) {
+  let lines;
+  try { lines = tailLines(wireFile, maxBytes); } catch { return { messages: [], busy: false, sawMarkers: true, waiting: false }; }
+  const messages = [];
+  let lastPrompt = 0, lastEnd = 0;
+  const pendingInteractions = new Set();
+  for (const line of lines) {
+    if (!line.trim()) continue;
+    let e; try { e = JSON.parse(line); } catch { continue; }
+    const ts = isoOf(e.time);
+    if (e.type === 'turn.prompt' || e.type === 'turn.steer') {
+      lastPrompt = Math.max(lastPrompt, e.time || 0);
+      const text = kosongText(e.input).trim();
+      if (text) messages.push({ role: 'user', text: text.slice(0, 4000), ts });
+    } else if (e.type === 'turn.cancel') {
+      lastEnd = Math.max(lastEnd, e.time || 0, lastPrompt);
+    } else if (e.type === 'context.append_message') {
+      const m = e.message || {};
+      const text = kosongText(m.content).trim();
+      const toolCalls = m.toolCalls || m.tool_calls;
+      if (m.role === 'assistant' && !(toolCalls && toolCalls.length)) {
+        if (text) messages.push({ role: 'assistant', text: text.slice(0, 4000), ts });
+        lastEnd = Math.max(lastEnd, e.time || 0);
+      }
+    } else if (e.type === 'interaction.request') {
+      const key = e.id ?? e.interaction_id;
+      if (key) pendingInteractions.add(key);
+    } else if (e.type === 'interaction.resolved') {
+      const key = e.id ?? e.interaction_id;
+      if (key) pendingInteractions.delete(key); else pendingInteractions.clear();
+    }
+  }
+  return {
+    messages: messages.slice(-limit),
+    busy: lastPrompt > lastEnd,
+    // Same tail-window caveat as Codex: no markers seen means a long turn
+    // pushed them out, so freshness decides.
+    sawMarkers: lastPrompt > 0 || lastEnd > 0,
+    waiting: pendingInteractions.size > 0,
+  };
+}
+
+function readKimiCodeMessages(file, maxBytes = 512 * 1024, limit = 80) {
+  return kimiCodeScan(file, maxBytes, limit).messages;
+}
+
+function readKimiCodeSessions() {
+  const sessions = [];
+  const root = path.join(KIMICODE_DIR, 'sessions');
+  let wdKeys = [];
+  try { wdKeys = fs.readdirSync(root); } catch { return sessions; }
+  for (const wdKey of wdKeys) {
+    let ids = [];
+    try { ids = fs.readdirSync(path.join(root, wdKey)); } catch { continue; }
+    for (const id of ids) {
+      const dir = path.join(root, wdKey, id);
+      const state = readJson(path.join(dir, 'state.json'));
+      if (!state?.id || state.archived) continue;
+      const wire = path.join(dir, 'agents', 'main', 'wire.jsonl');
+      // A brand new session has state.json before its first journal write;
+      // state.updatedAt keeps it visible during that gap.
+      let mtime = state.updatedAt || 0;
+      try { mtime = Math.max(mtime, fs.statSync(wire).mtimeMs); } catch {}
+      if (Date.now() - mtime > KIMI_ACTIVE_WINDOW_MS) continue;
+      const scan = memoScan(`kimicode:${wire}`, wire, () => kimiCodeScan(wire, 64 * 1024, 1));
+      const busy = (scan.busy || (!scan.sawMarkers && Date.now() - mtime < 60_000))
+        && Date.now() - mtime < KIMI_BUSY_STALE_MS;
+      // A pending approval outranks busy: the agent is stopped on a human.
+      const status = scan.waiting ? 'waiting' : (headlessActive.has(state.id) || busy ? 'busy' : 'idle');
+      transcriptCache.set(state.id, wire);
+      sessions.push({
+        id: state.id,
+        provider: 'kimicode',
+        name: state.title || (state.lastPrompt || '').slice(0, 40) || path.basename(state.cwd || '?'),
+        cwd: state.cwd || '',
+        project: path.basename(state.cwd || '?'),
+        status,
+        updatedAt: mtime,
+        startedAt: state.createdAt || 0,
+        lastMessage: scan.messages.length ? scan.messages[scan.messages.length - 1] : null,
+        tty: '',
+        live: false,
+      });
+    }
+  }
+  return sessions;
+}
+
+let kimiCache = { at: 0, sessions: [] };
+function readKimiSessions() {
+  if (Date.now() - kimiCache.at < 10_000) return kimiCache.sessions;
+  kimiCache.at = Date.now();
+  kimiCache.sessions = [...readKimiLegacySessions(), ...readKimiCodeSessions()];
+  return kimiCache.sessions;
+}
+
+/// The phone-facing shape of a held request.
+const askPayload = (ask, queued) => ({
+  id: ask.id,
+  tool: ask.tool,
+  line: ask.line,
+  detail: ask.detail,
+  at: ask.at,
+  queued,
+});
+
+function readSessions() {
+  const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions()];
+  const known = new Set(sessions.map((s) => s.id));
+  for (const s of sessions) {
+    const queue = askQueue.get(s.id);
+    const ask = queue?.length ? pendingAsks.get(queue[0]) : null;
+    if (!ask) continue;
+    // A held permission outranks busy: the session is stopped on a human, and
+    // that is the whole reason the invader turns pink on the island.
+    s.status = 'waiting';
+    s.ask = askPayload(ask, queue.length);
+  }
+
+  // A held request whose session is not in the fleet would never reach the
+  // phone, and one that cannot be seen cannot be answered, which strands the
+  // session until the hold expires. It happens for real: the session file is
+  // written slightly after the first tool call, a scan races a partial write,
+  // or the request comes from a session kind we do not discover. Surface the
+  // request on its own rather than dropping it.
+  for (const [sessionId, queue] of askQueue) {
+    if (known.has(sessionId) || !queue.length) continue;
+    const ask = pendingAsks.get(queue[0]);
+    if (!ask) continue;
+    sessions.push({
+      id: sessionId,
+      provider: 'claude',
+      name: path.basename(ask.cwd || '') || 'session',
+      cwd: ask.cwd || '',
+      project: path.basename(ask.cwd || '') || '?',
+      status: 'waiting',
+      updatedAt: ask.at,
+      startedAt: ask.at,
+      lastMessage: null,
+      tty: '',
+      live: false,
+      ask: askPayload(ask, queue.length),
+    });
+  }
+
   sessions.sort((a, b) => a.startedAt - b.startedAt);
   return sessions;
 }
 
+// ---------- remote approvals: runtime ----------
+// The hook connects here over a unix socket and blocks until this daemon
+// answers. Answering null means "no decision", which puts the prompt back on
+// the Mac exactly as it behaves without Ground Control installed.
+
+const ASK_SOCKET = path.join(CONF_DIR, 'approvals.sock');
+
+/// What the phone needs to render the approvals control without knowing
+/// anything about hooks or settings files. Cached: a snapshot goes out every
+/// 1.5s and this reads and parses settings.json.
+let hostCache = { at: 0, value: null };
+function hostState() {
+  if (Date.now() - hostCache.at < 5000 && hostCache.value) return hostCache.value;
+  const settings = readClaudeSettings();
+  const entries = Array.isArray(settings?.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const value = {
+    version: VERSION,
+    approvals: {
+      // Present at all means this daemon understands approvals; an older one
+      // simply omits the whole field and the app can say so.
+      installed: entries.some((e) => isOurHook(commandsOf(e))),
+      mode: approvalConfig().mode,
+      // Another app answering the same event can overrule a tap, so the phone
+      // should be able to say that out loud.
+      others: entries.filter((e) => !isOurHook(commandsOf(e))).length,
+      // A settings.json we cannot parse must not be silently overwritten, and
+      // the phone should explain why the toggle will not work.
+      settingsOk: settings !== null,
+      socketOk: approvalServerUp,
+    },
+    updateAvailable: availableUpdate,
+  };
+  hostCache = { at: Date.now(), value };
+  return value;
+}
+const bustHostCache = () => { hostCache.at = 0; };
+
+let approvalServerUp = false;
+let availableUpdate = null;   // version string once a newer release is seen
+
+const pendingAsks = new Map();  // askId -> ask record
+const askQueue = new Map();     // sessionId -> [askId], oldest first
+let askSeq = 0;
+
+/// Seconds since the last keyboard or mouse event on this Mac. A failure reads
+/// as 0 (you are here), which keeps prompts on the Mac rather than silently
+/// routing them to a phone that may not be watching.
+let idleCache = { at: 0, seconds: 0 };
+function macIdleSeconds() {
+  if (process.platform !== 'darwin') return Infinity; // no signal; treat a headless box as away
+  if (Date.now() - idleCache.at < 2000) return idleCache.seconds;
+  let seconds = 0;
+  try {
+    const out = execSync("ioreg -c IOHIDSystem -d 1 | awk '/HIDIdleTime/ {print $NF; exit}'", {
+      timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString().trim();
+    const ns = Number(out);
+    if (Number.isFinite(ns) && ns >= 0) seconds = ns / 1e9;
+  } catch {}
+  idleCache = { at: Date.now(), seconds };
+  return seconds;
+}
+
+// Deliberately not a live presence check. iOS suspends the websocket the
+// moment the app is backgrounded, so a phone in a pocket looks offline, which
+// is exactly the situation this feature exists for. What matters is whether
+// this Mac belongs to someone who actually uses the app, so a request is worth
+// holding until they pick the phone up. Walking back to the Mac releases it
+// within seconds either way, so a hold costs a paired user nothing.
+const PHONE_SEEN_FILE = path.join(CONF_DIR, 'phone-seen');
+const PHONE_KNOWN_MS = 30 * 24 * 60 * 60 * 1000;
+
+let lastPhoneWrite = 0;
+function notePhoneSeen() {
+  if (Date.now() - lastPhoneWrite < 60_000) return; // the phone heartbeats; do not churn the disk
+  lastPhoneWrite = Date.now();
+  try { fs.writeFileSync(PHONE_SEEN_FILE, String(Date.now())); } catch {}
+}
+
+function phoneKnown() {
+  try { return Date.now() - Number(fs.readFileSync(PHONE_SEEN_FILE, 'utf8').trim()) < PHONE_KNOWN_MS; }
+  catch { return false; }
+}
+
+function holdPolicy() {
+  const cfg = approvalConfig();
+  if (cfg.mode === 'off') return { hold: false, why: 'remote approvals are off' };
+  if (!phoneKnown()) return { hold: false, why: 'no phone has paired with this Mac' };
+  if (cfg.mode === 'always') return { hold: true };
+  const idle = macIdleSeconds();
+  if (idle < cfg.awayAfterSeconds) return { hold: false, why: `you are at the Mac (idle ${Math.round(idle)}s)` };
+  return { hold: true };
+}
+
+const clip = (v, n) => {
+  const s = typeof v === 'string' ? v : (v == null ? '' : JSON.stringify(v));
+  return s.length > n ? `${s.slice(0, n)}\n...` : s;
+};
+
+/// Reduce a tool call to the one line that identifies it plus a longer preview.
+/// Tool inputs can carry whole file contents, and every byte here is encrypted,
+/// relayed, and rendered on a phone.
+function summarizeTool(tool, input) {
+  const i = input && typeof input === 'object' ? input : {};
+  switch (tool) {
+    case 'Bash':
+    case 'BashOutput':
+      return { line: clip(i.command, 400), detail: clip(i.description, 300) };
+    case 'Write':
+      return { line: clip(i.file_path, 300), detail: clip(i.content, 1000) };
+    case 'Edit':
+      return {
+        line: clip(i.file_path, 300),
+        detail: `${clip(i.old_string, 500)}\n\n->\n\n${clip(i.new_string, 500)}`,
+      };
+    case 'Read':
+      return { line: clip(i.file_path, 300), detail: '' };
+    case 'WebFetch':
+      return { line: clip(i.url, 300), detail: clip(i.prompt, 300) };
+    case 'WebSearch':
+      return { line: clip(i.query, 300), detail: '' };
+    default: {
+      // Unknown or MCP tools: show whichever field reads most like a target,
+      // and fall back to the whole input.
+      const pick = i.command || i.file_path || i.path || i.url || i.query || i.pattern;
+      return { line: clip(pick || tool, 300), detail: clip(i, 1000) };
+    }
+  }
+}
+
+function dropAsk(ask) {
+  pendingAsks.delete(ask.id);
+  const queue = askQueue.get(ask.sessionId);
+  if (!queue) return;
+  const at = queue.indexOf(ask.id);
+  if (at > -1) queue.splice(at, 1);
+  if (!queue.length) askQueue.delete(ask.sessionId);
+}
+
+/// Answer a held request exactly once. A null decision releases it back to the
+/// Mac; the hook prints nothing and Claude Code prompts in the terminal.
+function settleAsk(ask, decision, outcome, note) {
+  if (ask.done) return;
+  ask.done = true;
+  clearTimeout(ask.holdTimer);
+  dropAsk(ask);
+  try { ask.socket.write(JSON.stringify({ decision: decision || null }) + '\n'); } catch {}
+  try { ask.socket.end(); } catch {}
+  console.log(`[daemon] permission ${ask.tool} ${outcome}${note ? `: ${note}` : ''}`);
+  if (ws?.readyState === 1) {
+    ws.send(seal({ type: 'askResolved', askId: ask.id, sessionId: ask.sessionId, outcome, note: note || '' }));
+  }
+  sendSnapshot(true);
+}
+
+function onPermissionRequest(req, socket) {
+  const gate = holdPolicy();
+  if (!gate.hold) {
+    console.log(`[daemon] permission ${req.toolName} left on the Mac: ${gate.why}`);
+    try { socket.write('{"decision":null}\n'); } catch {}
+    try { socket.end(); } catch {}
+    return;
+  }
+  const { line, detail } = summarizeTool(req.toolName, req.toolInput);
+  const ask = {
+    id: `${Date.now().toString(36)}-${++askSeq}`,
+    sessionId: req.sessionId,
+    tool: req.toolName || 'tool',
+    line,
+    detail,
+    cwd: req.cwd || '',
+    at: Date.now(),
+    socket,
+    done: false,
+  };
+  ask.holdTimer = setTimeout(
+    () => settleAsk(ask, null, 'released', 'held too long, prompting on the Mac instead'),
+    Math.max(1, approvalConfig().holdMinutes) * 60_000,
+  );
+  // The hook dying (session quit, Ctrl+C, Claude restarted) closes the socket.
+  // Without this the card would linger on the phone with nothing behind it.
+  socket.on('close', () => settleAsk(ask, null, 'gone', 'the session stopped waiting'));
+  socket.on('error', () => {});
+  pendingAsks.set(ask.id, ask);
+  askQueue.set(ask.sessionId, [...(askQueue.get(ask.sessionId) || []), ask.id]);
+  console.log(`[daemon] permission held for the phone: ${ask.tool} ${ask.line.slice(0, 60)}`);
+  sendSnapshot(true);
+}
+
+function startApprovalServer(attempt = 0) {
+  // sun_path is 104 bytes on macOS. Over that, the bind fails in ways that
+  // read as EADDRINUSE rather than "path too long", so say it plainly.
+  if (Buffer.byteLength(ASK_SOCKET) > 100) {
+    console.log(`[daemon] home path too long for the approvals socket, permission prompts stay on the Mac: ${ASK_SOCKET}`);
+    return;
+  }
+  // A hard killed daemon leaves the socket file behind and bind fails with
+  // EADDRINUSE, so clear it first. If the bind still fails, another daemon is
+  // genuinely listening; it is about to be displaced on the relay and exit, so
+  // retry a few times rather than losing approvals until the next restart.
+  try { fs.unlinkSync(ASK_SOCKET); } catch {}
+  const server = net.createServer((socket) => {
+    socket.setEncoding('utf8');
+    let buf = '';
+    let handled = false;
+    socket.on('data', (chunk) => {
+      if (handled) return;
+      buf += chunk;
+      const nl = buf.indexOf('\n');
+      if (nl === -1) {
+        if (buf.length > 2_000_000) socket.destroy(); // a tool input this big is not real
+        return;
+      }
+      handled = true;
+      let req;
+      try { req = JSON.parse(buf.slice(0, nl)); } catch { req = null; }
+      if (!req || !req.sessionId) {
+        try { socket.write('{"decision":null}\n'); } catch {}
+        try { socket.end(); } catch {}
+        return;
+      }
+      onPermissionRequest(req, socket);
+    });
+    socket.on('error', () => {});
+  });
+  server.on('error', (e) => {
+    if (e.code === 'EADDRINUSE' && attempt < 5) {
+      setTimeout(() => startApprovalServer(attempt + 1), 1000);
+      return;
+    }
+    console.log(`[daemon] approvals socket unavailable, permission prompts stay on the Mac: ${e.message}`);
+  });
+  server.listen(ASK_SOCKET, () => {
+    try { fs.chmodSync(ASK_SOCKET, 0o600); } catch {}
+    approvalServerUp = true;
+    bustHostCache();
+    console.log(`[daemon] remote approvals ready (mode: ${approvalConfig().mode})`);
+  });
+}
+
+// Claude Code's own status for each session, as last seen on disk.
+const lastRawStatus = new Map(); // sessionId -> 'busy' | 'idle' | 'waiting' | ...
+
+/// Clear a held request that was answered on the Mac.
+///
+/// The socket closing is the fast path, but it cannot be relied on: Claude
+/// Code does not always kill the hook process when the human answers in the
+/// terminal, and a hook nobody killed keeps its socket open, so the phone
+/// would keep showing a card for a question that is already settled.
+///
+/// Claude Code writes "waiting" into its own session file while a prompt is
+/// on screen, so that dropping back to busy or idle is the real signal that
+/// the prompt is gone. The grace period covers the gap between our hook being
+/// called and Claude getting round to writing the status.
+const ANSWERED_GRACE_MS = 6000;
+function releaseAnsweredOnMac() {
+  if (!pendingAsks.size) return;
+  for (const ask of [...pendingAsks.values()]) {
+    if (Date.now() - ask.at < ANSWERED_GRACE_MS) continue;
+    const status = lastRawStatus.get(ask.sessionId);
+    // Unknown session: nothing to conclude, leave it to the socket or the cap.
+    if (!status || status === 'waiting') continue;
+    settleAsk(ask, null, 'gone', 'answered on the Mac');
+  }
+}
+
+/// Sitting back down at the Mac clears the phone card. Not because the Mac
+/// needs it back: Claude Code shows its own terminal prompt the whole time a
+/// hook is running (verified on 2.1.220), so the Mac is never blocked and can
+/// always answer. This just stops the phone showing a request you are about
+/// to deal with in front of you.
+function releaseAsksIfBack() {
+  if (!pendingAsks.size) return;
+  const cfg = approvalConfig();
+  if (cfg.mode !== 'away') return;
+  if (macIdleSeconds() >= cfg.awayAfterSeconds) return;
+  for (const ask of [...pendingAsks.values()]) {
+    settleAsk(ask, null, 'released', 'you came back to the Mac');
+  }
+}
+
+// ---------- self update ----------
+// The service runs from a frozen copy under ~/.groundcontrol/service, so
+// without this a user who installed once never sees another release. Checked
+// daily, always announced in the log and surfaced in the app.
+
+const UPDATE_CHECK_MS = 24 * 60 * 60 * 1000;
+const UPDATE_STAMP = path.join(CONF_DIR, 'last-update-check');
+
+/// Compare dotted numeric versions. Anything unparseable sorts as older, so a
+/// junk value from the registry can never trigger an update.
+function isNewer(candidate, current) {
+  const parse = (v) => String(v).split('.').map((n) => Number(n));
+  const a = parse(candidate), b = parse(current);
+  if (a.length !== 3 || a.some((n) => !Number.isInteger(n) || n < 0)) return false;
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] || 0) > (b[i] || 0)) return true;
+    if ((a[i] || 0) < (b[i] || 0)) return false;
+  }
+  return false;
+}
+
+async function latestPublishedVersion() {
+  const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
+    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    signal: AbortSignal.timeout(15_000),
+  });
+  if (!res.ok) throw new Error(`registry ${res.status}`);
+  const body = await res.json();
+  if (!body?.version) throw new Error('registry response had no version');
+  return body.version;
+}
+
+/// Re-install the service from the newly published version. Runs detached
+/// because `service install` boots this very process out partway through;
+/// launchd then starts the replacement. installService stages everything
+/// before it touches the running service, so a failure here leaves the
+/// current daemon in place rather than nothing at all.
+function applyUpdate(version) {
+  console.log(`[daemon] updating to ${version}`);
+  const child = spawn('npx', ['-y', `${PACKAGE}@${version}`, 'service', 'install'], {
+    detached: true,
+    stdio: ['ignore', fs.openSync(LOG_FILE, 'a'), fs.openSync(LOG_FILE, 'a')],
+    env: process.env,
+  });
+  child.unref();
+}
+
+async function checkForUpdate({ force = false } = {}) {
+  // Only the launchd copy updates itself. A daemon someone is running by hand
+  // in a terminal must never swap itself out from under them.
+  if (!runsFromServiceDir && !force) return;
+  try {
+    const last = Number(fs.readFileSync(UPDATE_STAMP, 'utf8').trim());
+    if (!force && Number.isFinite(last) && Date.now() - last < UPDATE_CHECK_MS) return;
+  } catch {}
+  try { fs.writeFileSync(UPDATE_STAMP, String(Date.now())); } catch {}
+  let latest;
+  try { latest = await latestPublishedVersion(); }
+  catch (e) { console.log(`[daemon] update check failed: ${e.message}`); return; }
+  if (!isNewer(latest, VERSION)) return;
+  availableUpdate = latest;
+  bustHostCache();
+  sendSnapshot(true);
+  console.log(`[daemon] a newer version is available: ${latest} (running ${VERSION})`);
+  // Held requests belong to sessions that are about to lose their socket.
+  releaseAllAsks();
+  applyUpdate(latest);
+}
+
+/// A daemon shutting down must hand every held request back rather than leave
+/// sessions blocked on a socket that will never answer.
+function releaseAllAsks() {
+  for (const ask of [...pendingAsks.values()]) {
+    settleAsk(ask, null, 'released', 'the daemon stopped');
+  }
+}
+
 // ---------- relay connection ----------
 
 let ws = null;
 let lastSnapshotJson = '';
 
 function sendSnapshot(force = false) {
-  const sessions = readSessions();
-  const json = JSON.stringify(sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })));
+  // A parser tripping on a malformed journal must never take the daemon down:
+  // this runs on a bare interval with nothing above it to catch a throw.
+  let sessions;
+  try { sessions = readSessions(); } catch (e) {
+    console.log(`[daemon] snapshot failed: ${e.message}`);
+    return;
+  }
+  for (const s of sessions) if (s.rawStatus) lastRawStatus.set(s.id, s.rawStatus);
+  const host = hostState();
+  // Host state joins the dedupe key, otherwise flipping approvals on would not
+  // reach a phone whose session list happened not to change.
+  const json = JSON.stringify([sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })), host]);
   if (!force && json === lastSnapshotJson) return;
   lastSnapshotJson = json;
   if (ws?.readyState === 1) {
-    ws.send(seal({ type: 'snapshot', at: Date.now(), sessions }));
+    ws.send(seal({ type: 'snapshot', at: Date.now(), sessions, host }));
     console.log(`[daemon] snapshot -> ${sessions.length} session(s): ${sessions.map((s) => `${s.name}:${s.status}`).join(', ') || 'none'}`);
   }
 }
@@ -642,6 +1781,46 @@ async function handleCommand(cmd) {
     ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
   } else if (cmd.type === 'unwatch' && cmd.sessionId) {
     unwatchTranscript(cmd.sessionId);
+  } else if (cmd.type === 'setApprovals') {
+    // A deliberate tap in the app, with the app explaining what it adds, is
+    // the consent for this. A backup is still written before any change.
+    let result;
+    if (cmd.enabled === false) {
+      writeApprovalConfig({ mode: 'off' });
+      result = uninstallApprovalHook();
+      console.log('[daemon] remote approvals turned off from the phone');
+    } else {
+      const mode = ['away', 'always'].includes(cmd.mode) ? cmd.mode : 'away';
+      writeApprovalConfig({ mode });
+      result = installApprovalHook({ consent: true });
+      console.log(`[daemon] remote approvals turned on from the phone (mode: ${mode})`);
+    }
+    bustHostCache();
+    sendSnapshot(true);
+    ws?.send(seal({
+      type: 'approvalsResult',
+      ok: !!result.ok,
+      error: result.ok ? '' : (result.reason || 'could not change the setting'),
+      host: hostState(),
+    }));
+  } else if (cmd.type === 'approve' || cmd.type === 'deny') {
+    const ask = cmd.askId ? pendingAsks.get(cmd.askId) : null;
+    if (!ask) {
+      // Answered on the Mac, expired, or the session moved on while the tap
+      // was in flight. Tell the phone so the card clears instead of hanging.
+      return ws?.send(seal({
+        type: 'askResolved', askId: cmd.askId || '', sessionId: cmd.sessionId || '',
+        outcome: 'gone', note: 'that request is no longer waiting',
+      }));
+    }
+    if (cmd.type === 'approve') {
+      settleAsk(ask, { behavior: 'allow', ...(cmd.always ? { alwaysAllow: true } : {}) },
+        'allowed', cmd.always ? 'from the phone, and always from now on' : 'from the phone');
+    } else {
+      const reason = (cmd.text || '').trim();
+      settleAsk(ask, { behavior: 'deny', message: reason || 'Denied from the Ground Control app.' },
+        'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
+    }
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
     ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
@@ -649,6 +1828,8 @@ async function handleCommand(cmd) {
     const session = readSessions().find((s) => s.id === cmd.sessionId);
     if (!session) return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' }));
 
+    if (session.provider && session.provider !== 'claude') return promptHeadless(session, cmd.text);
+
     // Preferred path: type into the real terminal so the desktop updates live.
     if (session.live) {
       const method = await injectPrompt(session.tty, cmd.text);
@@ -679,7 +1860,7 @@ async function handleCommand(cmd) {
     headlessActive.add(cmd.sessionId);
     sendSnapshot(true);
     const child = spawn(claudeBin, ['--resume', cmd.sessionId, '-p', cmd.text], {
-      cwd: session.cwd || os.homedir(),
+      cwd: fs.existsSync(session.cwd || '') ? session.cwd : os.homedir(),
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
     });
@@ -707,6 +1888,80 @@ async function handleCommand(cmd) {
   }
 }
 
+// Sends a phone prompt to a Codex or Kimi session. There is no tty path for
+// these (their session files record no pid), so every prompt goes through the
+// provider's headless resume command, which appends the turn to the same
+// journal the transcript watcher follows — desktop app threads included.
+// Codex takes the prompt as a positional, so `--` stops phone text that
+// begins with a dash from being read as CLI flags. The kimi CLIs take it as
+// the -p option value where `--` cannot help, so a leading space defuses a
+// dash there (the models do not care about leading whitespace).
+const defuse = (text) => (/^\s*-/.test(text) ? ` ${text}` : text);
+const headlessPromptSpec = {
+  codex: () => codexBin && { bin: codexBin, args: (id, text) => ['exec', 'resume', id, '--skip-git-repo-check', '--', text] },
+  kimicode: () => kimiCodeBin && { bin: kimiCodeBin, args: (id, text) => ['--session', id, '-p', defuse(text)] },
+  kimi: () => kimiLegacyBin && { bin: kimiLegacyBin, args: (id, text) => ['--print', '--session', id, '-p', defuse(text)] },
+};
+
+function bustProviderCaches() {
+  codexCache.at = 0;
+  kimiCache.at = 0;
+}
+
+function promptHeadless(session, text) {
+  // Anything but idle means another writer owns the session right now: busy
+  // is a running turn, waiting is a human approval the phone cannot answer.
+  if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is busy, wait for it to go idle' }));
+  if (session.status !== 'idle') return ws?.send(seal({ type: 'promptResult', sessionId: session.id, ok: false, error: 'session is waiting for an approval, answer it in the app or terminal first' }));
+  const spec = headlessPromptSpec[session.provider]?.();
+  if (!spec) {
+    console.log(`[daemon] ${session.provider} prompt failed: binary not found`);
+    return ws?.send(seal({
+      type: 'promptResult', sessionId: session.id, ok: false,
+      error: `The daemon could not find the ${session.provider === 'codex' ? 'codex' : 'kimi'} command on this Mac, so it cannot reach this session.`,
+    }));
+  }
+  console.log(`[daemon] prompt -> ${session.provider} ${session.name}: ${text.slice(0, 60)}`);
+  const promptedAt = Date.now();
+  headlessActive.add(session.id);
+  bustProviderCaches();
+  sendSnapshot(true);
+  const child = spawn(spec.bin, spec.args(session.id, text), {
+    cwd: fs.existsSync(session.cwd || '') ? session.cwd : os.homedir(),
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  let err = '';
+  let responded = false;
+  const respond = (payload) => {
+    if (responded) return;
+    responded = true;
+    headlessActive.delete(session.id);
+    bustProviderCaches();
+    ws?.send(seal(payload));
+    sendSnapshot(true);
+  };
+  child.stderr.on('data', (d) => { err += d; });
+  child.stdout.on('data', () => {});
+  child.on('error', (e) => {
+    console.log(`[daemon] ${session.provider} spawn failed: ${e.message}`);
+    respond({ type: 'promptResult', sessionId: session.id, ok: false, error: `could not run ${session.provider}: ${e.message}` });
+  });
+  child.on('close', (code) => {
+    // The reply is already in the journal; surface the last assistant turn,
+    // but only one written after this prompt. An older message here would
+    // present a stale answer as the reply (the live transcript stream shows
+    // the real one either way, so an empty text is fine).
+    const msgs = readMessages(session.id, 64 * 1024, 10);
+    const reply = [...msgs].reverse().find((m) => m.role === 'assistant' && Date.parse(m.ts || '') > promptedAt);
+    respond({
+      type: 'promptResult', sessionId: session.id, ok: code === 0,
+      text: code === 0 ? (reply?.text || '').slice(0, 4000) : err.trim().slice(0, 4000),
+    });
+  });
+  watchTranscript(session.id);
+}
+
 let lastPongAt = Date.now();
 
 function connect() {
@@ -718,9 +1973,20 @@ function connect() {
   ws.on('pong', () => { lastPongAt = Date.now(); });
   ws.on('message', (data) => {
     const str = data.toString();
-    if (str === '{"sys":"client-joined"}') { console.log('[daemon] phone connected'); sendSnapshot(true); return; }
+    if (str === '{"sys":"client-joined"}') {
+      notePhoneSeen();
+      console.log('[daemon] phone connected');
+      sendSnapshot(true);
+      return;
+    }
     if (str.startsWith('{"sys"')) return;
-    try { handleCommand(open(str))?.catch?.(() => {}); } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
+    // A command that decrypts proves a real paired phone is on the other end,
+    // which is what the approval policy checks before holding a prompt.
+    try {
+      const cmd = open(str);
+      notePhoneSeen();
+      handleCommand(cmd)?.catch?.(() => {});
+    } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
   });
   ws.on('close', (code) => {
     if (code === 4001) {
@@ -735,6 +2001,32 @@ function connect() {
 
 connect();
 if (process.platform === 'darwin') requestAutomationGrant();
+
+// Remote approvals. The daemon refreshes the hook script itself, which is our
+// own file, but never edits ~/.claude/settings.json: a background process is
+// the last thing that should rewrite another tool's config unasked. Turning it
+// on is an explicit `groundcontrol approvals on`.
+try { stageHookFile(); } catch (e) { console.log(`[daemon] could not refresh the permission hook: ${e.message}`); }
+const hookState = installApprovalHook();  // consent defaults to false: reports, never writes
+if (hookState.unchanged) console.log('[daemon] permission hook installed, remote approvals available');
+else if (hookState.needsConsent) console.log('[daemon] permission hook not installed (run: groundcontrol approvals on)');
+else if (!hookState.ok) console.log(`[daemon] permission hook unavailable: ${hookState.reason}`);
+for (const cmd of hookState.foreign || []) console.log(`[daemon] another app also answers permission requests: ${cmd}`);
+startApprovalServer();
+setInterval(releaseAsksIfBack, 3000);
+setInterval(releaseAnsweredOnMac, 2000);
+
+// Self update. Staggered off startup so a login storm does not hit the
+// registry at once, then re-checked hourly (the daily stamp does the gating).
+setTimeout(() => { checkForUpdate().catch(() => {}); }, 60_000);
+setInterval(() => { checkForUpdate().catch(() => {}); }, 60 * 60 * 1000);
+
+// Held requests are sockets a Claude session is blocked on. Hand them back
+// before going away, or those sessions sit frozen until the hook times out.
+for (const sig of ['SIGINT', 'SIGTERM']) {
+  process.on(sig, () => { releaseAllAsks(); process.exit(0); });
+}
+
 setInterval(sendSnapshot, 1500);
 // Heartbeat traffic keeps the Cloudflare socket alive in both directions and
 // lets the phone detect a dead link; missing pongs force a reconnect here.
@@ -754,3 +2046,20 @@ setInterval(() => {
   }
 }, 20_000);
 try { fs.watch(SESSIONS_DIR, () => sendSnapshot()); } catch {}
+// Recursive watches (macOS supports them) so a fresh Codex or Kimi turn busts
+// the scan cache immediately instead of waiting out the 10s refresh. Debounced:
+// a streaming turn appends to its journal many times a second, and every
+// uncached snapshot is a full rescan.
+function watchProviderDir(dir, cache, label) {
+  let debounce;
+  try {
+    fs.watch(dir, { recursive: true }, () => {
+      clearTimeout(debounce);
+      debounce = setTimeout(() => { cache.at = 0; sendSnapshot(); }, 500);
+    });
+    console.log(`[daemon] ${label}: watching ${dir}`);
+  } catch {}
+}
+watchProviderDir(CODEX_SESS_DIR, codexCache, `codex sessions (codex binary: ${codexBin || 'not found, sessions will be read only'})`);
+watchProviderDir(path.join(KIMI_DIR, 'sessions'), kimiCache, 'kimi sessions');
+watchProviderDir(path.join(KIMICODE_DIR, 'sessions'), kimiCache, 'kimi code sessions');