@clastres/groundcontrol 0.1.6 → 0.1.8

package/daemon.mjs

@@ -11,8 +11,10 @@ import { WebSocket } from 'ws';
 import qrcode from 'qrcode-terminal';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import net from 'node:net';
 import os from 'node:os';
 import path from 'node:path';
+import readline from 'node:readline';
 import { spawn, execFile, execSync } from 'node:child_process';
 import { promisify } from 'node:util';
 import { fileURLToPath } from 'node:url';
@@ -20,6 +22,9 @@ import { createRequire } from 'node:module';
 
 const execFileP = promisify(execFile);
 
+const VERSION = '0.1.8';
+const PACKAGE = '@clastres/groundcontrol';
+
 // ---------- config / pairing ----------
 
 if (process.argv.includes('--help') || process.argv.includes('-h')) {
@@ -42,6 +47,12 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
     service status      Check the background daemon
     service install     Set up the background daemon without pairing output
     service uninstall   Remove the background daemon
+    approvals status    Check remote permission approvals
+    approvals away      Send permission prompts to the phone only while you
+                        are away from the Mac (the default)
+    approvals always    Send them to the phone whenever it is connected
+    approvals off       Keep every permission prompt on the Mac
+    approvals uninstall Remove the permission hook from Claude Code
 
   Options:
     --relay <url>   Use a custom relay (default: wss://relay.groundcontrol.chat)
@@ -54,7 +65,7 @@ if (process.argv.includes('--help') || process.argv.includes('-h')) {
   process.exit(0);
 }
 if (process.argv.includes('--version')) {
-  console.log('0.1.6');
+  console.log(VERSION);
   process.exit(0);
 }
 
@@ -66,9 +77,10 @@ if (process.argv.includes('--version')) {
 
 const subcommand = process.argv[2];
 const LABEL = 'chat.groundcontrol.daemon';
-const SERVICE_DIR = path.join(os.homedir(), '.groundcontrol', 'service');
+const CONF_DIR = path.join(os.homedir(), '.groundcontrol');
+const SERVICE_DIR = path.join(CONF_DIR, 'service');
 const PLIST_PATH = path.join(os.homedir(), 'Library', 'LaunchAgents', `${LABEL}.plist`);
-const LOG_FILE = path.join(os.homedir(), '.groundcontrol', 'daemon.log');
+const LOG_FILE = path.join(CONF_DIR, 'daemon.log');
 const THIS_FILE = fs.realpathSync(fileURLToPath(import.meta.url));
 const runsFromServiceDir = THIS_FILE.startsWith(SERVICE_DIR + path.sep);
 
@@ -123,17 +135,36 @@ function explainStoppedService(printOut) {
 /// Returns true when launchd reports the job running.
 function installService() {
   const uid = process.getuid();
+
+  // Stage into a scratch directory first and only disturb the running service
+  // once every file is in place. The old order (bootout, delete, then copy)
+  // meant any failure mid copy left the user with no daemon at all, which is
+  // unacceptable now that self update runs this unattended.
+  const staging = `${SERVICE_DIR}.staging`;
+  try {
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.mkdirSync(path.join(staging, 'node_modules'), { recursive: true });
+    fs.copyFileSync(THIS_FILE, path.join(staging, 'daemon.mjs'));
+    // The permission hook ships beside the daemon and must travel with it, so a
+    // service copy can re-stage it after an upgrade without the npx cache.
+    fs.copyFileSync(hookSourceFile(), path.join(staging, 'hook.mjs'));
+    fs.writeFileSync(
+      path.join(staging, 'package.json'),
+      JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
+    );
+    for (const dep of ['ws', 'qrcode-terminal']) {
+      fs.cpSync(packageDirOf(dep), path.join(staging, 'node_modules', dep), { recursive: true });
+    }
+  } catch (e) {
+    // Nothing has been touched yet, so the existing service keeps running.
+    console.log(`[daemon] could not stage the service, leaving the current one alone: ${e.message}`);
+    fs.rmSync(staging, { recursive: true, force: true });
+    return false;
+  }
+
   launchctl(`bootout gui/${uid}/${LABEL}`);
   fs.rmSync(SERVICE_DIR, { recursive: true, force: true });
-  fs.mkdirSync(path.join(SERVICE_DIR, 'node_modules'), { recursive: true });
-  fs.copyFileSync(THIS_FILE, path.join(SERVICE_DIR, 'daemon.mjs'));
-  fs.writeFileSync(
-    path.join(SERVICE_DIR, 'package.json'),
-    JSON.stringify({ name: 'groundcontrol-service', private: true, type: 'module' }, null, 2),
-  );
-  for (const dep of ['ws', 'qrcode-terminal']) {
-    fs.cpSync(packageDirOf(dep), path.join(SERVICE_DIR, 'node_modules', dep), { recursive: true });
-  }
+  fs.renameSync(staging, SERVICE_DIR);
 
   const esc = (s) => s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
   const nodeBin = stableNodePath();
@@ -184,6 +215,181 @@ function installService() {
   return true;
 }
 
+// ---------- remote approvals: Claude Code hook installation ----------
+// Claude Code fires a PermissionRequest hook whenever a tool call needs a
+// decision. Our hook hands the request to this daemon, which either holds it
+// for the phone or passes immediately so the terminal prompts as usual.
+
+const CLAUDE_SETTINGS = path.join(os.homedir(), '.claude', 'settings.json');
+const HOOK_FILE = path.join(CONF_DIR, 'hook.mjs');
+// Generous, because the daemon settles every request itself. This only caps
+// the case where the daemon wedges while holding.
+const HOOK_TIMEOUT_SECONDS = 12 * 60 * 60;
+
+const hookSourceFile = () => path.join(path.dirname(THIS_FILE), 'hook.mjs');
+
+/// Copy the hook next to the key material so it survives npx cache eviction.
+function stageHookFile() {
+  fs.mkdirSync(CONF_DIR, { recursive: true });
+  fs.copyFileSync(hookSourceFile(), HOOK_FILE);
+}
+
+const hookCommand = () => `${JSON.stringify(stableNodePath())} ${JSON.stringify(HOOK_FILE)}`;
+
+/// Every command string an entry can carry, flattened, so a hook can be
+/// recognised whether it uses the nested or the shorthand form.
+const commandsOf = (entry) => [entry?.command, entry?.bash, ...(Array.isArray(entry?.hooks) ? entry.hooks.map((h) => h?.command) : [])]
+  .filter((c) => typeof c === 'string').join(' ');
+
+const isOurHook = (cmd) => cmd.includes('.groundcontrol') && cmd.includes('hook.mjs');
+
+/// Read settings.json. Returns null when it exists but cannot be parsed, which
+/// must never be treated as "empty": overwriting it would destroy real config.
+function readClaudeSettings() {
+  if (!fs.existsSync(CLAUDE_SETTINGS)) return {};
+  try {
+    const parsed = JSON.parse(fs.readFileSync(CLAUDE_SETTINGS, 'utf8'));
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+  } catch { return null; }
+}
+
+function backupClaudeSettings() {
+  if (!fs.existsSync(CLAUDE_SETTINGS)) return null;
+  const dest = `${CLAUDE_SETTINGS}.groundcontrol-backup`;
+  try { fs.copyFileSync(CLAUDE_SETTINGS, dest); return dest; } catch { return null; }
+}
+
+/// Add our hook to settings.json. Strictly additive: the only entry it ever
+/// removes is our own previous one, so an upgrade replaces it instead of
+/// stacking duplicates. Another tool's hooks are reported, never touched.
+/// Writes only when something actually changes, so restarts are inert.
+///
+/// Nothing is written unless `consent` is true. Editing another tool's config
+/// is not something to do behind someone's back, so the caller has to have
+/// asked first, or the user has to have run `groundcontrol approvals on`.
+function installApprovalHook({ consent = false } = {}) {
+  try { stageHookFile(); } catch (e) { return { ok: false, reason: `could not stage the hook file: ${e.message}` }; }
+  if (!fs.existsSync(path.dirname(CLAUDE_SETTINGS))) return { ok: false, reason: 'no ~/.claude directory on this Mac' };
+
+  const settings = readClaudeSettings();
+  if (settings === null) return { ok: false, reason: '~/.claude/settings.json is not valid JSON, leaving it untouched' };
+
+  const before = JSON.stringify(settings.hooks?.PermissionRequest ?? null);
+  const existing = Array.isArray(settings.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const foreign = [];
+  const kept = existing.filter((entry) => {
+    const cmd = commandsOf(entry);
+    if (isOurHook(cmd)) return false;               // ours, re-added fresh below
+    if (cmd) foreign.push(cmd.trim().slice(0, 70));
+    return true;                                     // everyone else stays, always
+  });
+  const next = [...kept, {
+    matcher: '*',
+    hooks: [{ type: 'command', command: hookCommand(), timeout: HOOK_TIMEOUT_SECONDS }],
+  }];
+  if (JSON.stringify(next) === before) return { ok: true, unchanged: true, foreign };
+  if (!consent) return { ok: false, needsConsent: true, foreign, reason: 'the permission hook is not installed yet' };
+
+  const raw = fs.existsSync(CLAUDE_SETTINGS) ? fs.readFileSync(CLAUDE_SETTINGS, 'utf8') : '';
+  // A rewrite goes through JSON.parse/stringify, so any // comments in the
+  // file are lost. Worth saying out loud rather than quietly dropping them.
+  const hadComments = /^\s*\/\//m.test(raw);
+  const backup = backupClaudeSettings();
+  settings.hooks = settings.hooks && typeof settings.hooks === 'object' ? settings.hooks : {};
+  settings.hooks.PermissionRequest = next;
+  try { fs.writeFileSync(CLAUDE_SETTINGS, JSON.stringify(settings, null, 2) + '\n'); }
+  catch (e) { return { ok: false, reason: `could not write settings.json: ${e.message}` }; }
+  return { ok: true, installed: true, foreign, backup, hadComments };
+}
+
+/// Remove only our own entry, leaving anything else in place.
+function uninstallApprovalHook() {
+  const settings = readClaudeSettings();
+  if (settings === null) return { ok: false, reason: '~/.claude/settings.json is not valid JSON, leaving it untouched' };
+  const existing = Array.isArray(settings.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const kept = existing.filter((entry) => !isOurHook(commandsOf(entry)));
+  if (kept.length === existing.length) return { ok: true, unchanged: true };
+  backupClaudeSettings();
+  if (kept.length) settings.hooks.PermissionRequest = kept;
+  else delete settings.hooks.PermissionRequest;
+  if (settings.hooks && !Object.keys(settings.hooks).length) delete settings.hooks;
+  try { fs.writeFileSync(CLAUDE_SETTINGS, JSON.stringify(settings, null, 2) + '\n'); }
+  catch (e) { return { ok: false, reason: `could not write settings.json: ${e.message}` }; }
+  return { ok: true };
+}
+
+/// Another tool answering the same event is worth knowing about: Claude Code
+/// runs every PermissionRequest hook and any deny wins, so a second one can
+/// overrule your tap. Ground Control says so and leaves it alone. Removing it
+/// is your call, not ours.
+function reportForeignHooks(foreign) {
+  if (!foreign?.length) return;
+  console.log('\n  Another app also answers permission requests on this Mac:');
+  for (const cmd of foreign) console.log(`    ${cmd}`);
+  console.log('  Both will run. If either denies, the tool call is denied, so a');
+  console.log('  tap on your phone can be overruled. Ground Control leaves it in');
+  console.log('  place; remove it yourself if you want only one app deciding.');
+}
+
+/// Ask before editing ~/.claude/settings.json. Anything but an interactive
+/// terminal answers no: a background or piped run must never decide this.
+async function askYesNo(question) {
+  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  const answer = await new Promise((resolve) => rl.question(question, resolve));
+  rl.close();
+  return /^y(es)?$/i.test(answer.trim()) || answer.trim() === '';
+}
+
+/// Offer remote approvals during pairing, then do exactly what was answered.
+async function offerApprovals() {
+  const state = installApprovalHook();
+  if (state.ok && state.unchanged) {
+    console.log('  Permission prompts already reach your phone.');
+    reportForeignHooks(state.foreign);
+    return;
+  }
+  if (!state.ok && !state.needsConsent) {
+    console.log(`  Remote approvals unavailable: ${state.reason}`);
+    return;
+  }
+  console.log('  One more thing. Claude Code stops and asks before it runs');
+  console.log('  risky commands. Ground Control can send those to your phone');
+  console.log('  while you are away from the Mac, so a session does not sit');
+  console.log('  blocked until you get back. Sitting at your Mac, prompts stay');
+  console.log('  in the terminal exactly as they do now.');
+  console.log('');
+  console.log('  This adds one hook to ~/.claude/settings.json. Nothing else in');
+  console.log('  that file is changed, and a backup is written first.');
+  reportForeignHooks(state.foreign);
+  console.log('');
+  if (!await askYesNo('  Turn on remote approvals? [Y/n] ')) {
+    console.log('\n  Left alone. Turn it on later with: groundcontrol approvals on\n');
+    return;
+  }
+  const done = installApprovalHook({ consent: true });
+  console.log('');
+  reportHookInstall(done);
+  console.log('  Change it anytime: groundcontrol approvals <away|always|off>\n');
+}
+
+function reportHookInstall(result) {
+  if (result.needsConsent) {
+    console.log('  Remote approvals are not set up yet. Turn them on with:');
+    console.log('  groundcontrol approvals on');
+    reportForeignHooks(result.foreign);
+    return;
+  }
+  if (!result.ok) {
+    console.log(`  Remote approvals are off: ${result.reason}`);
+    return;
+  }
+  if (result.installed) console.log('  Permission prompts can now reach your phone.');
+  if (result.backup) console.log(`  Backed up your settings to ${result.backup}`);
+  if (result.hadComments) console.log('  Heads up: comments in settings.json were dropped by the rewrite.');
+  reportForeignHooks(result.foreign);
+}
+
 if (subcommand === 'service') {
   const action = process.argv[3];
   if (process.platform !== 'darwin') {
@@ -196,7 +402,10 @@ if (subcommand === 'service') {
     if (installService()) {
       console.log('\n  Ground Control daemon is now running in the background.');
       console.log('  It starts at login and restarts automatically if it stops.\n');
+      // Deliberately not installing the hook here: this path is the scripted,
+      // non-interactive one, so there is nobody to ask.
       console.log(`  Log:       ${LOG_FILE}`);
+      console.log('  Approvals: groundcontrol approvals on');
       console.log('  Pair:      groundcontrol qr');
       console.log('  Check:     groundcontrol service status');
       console.log('  Remove:    groundcontrol service uninstall\n');
@@ -234,12 +443,91 @@ if (subcommand === 'service') {
   process.exit(1);
 }
 
+// ---------- remote approvals: policy config ----------
+
+const APPROVALS_CONF = path.join(CONF_DIR, 'approvals.json');
+const APPROVAL_DEFAULTS = {
+  // away:   hold for the phone only while you are not using the Mac
+  // always: hold whenever a phone is connected
+  // off:    never hold; the terminal prompts exactly as it always has
+  mode: 'away',
+  awayAfterSeconds: 90,
+  holdMinutes: 720,
+};
+
+let approvalConfCache = { at: 0, value: APPROVAL_DEFAULTS };
+function approvalConfig() {
+  if (Date.now() - approvalConfCache.at < 5000) return approvalConfCache.value;
+  let value = APPROVAL_DEFAULTS;
+  try {
+    const parsed = JSON.parse(fs.readFileSync(APPROVALS_CONF, 'utf8'));
+    if (parsed && typeof parsed === 'object') value = { ...APPROVAL_DEFAULTS, ...parsed };
+  } catch {}
+  if (!['away', 'always', 'off'].includes(value.mode)) value = { ...value, mode: 'away' };
+  approvalConfCache = { at: Date.now(), value };
+  return value;
+}
+
+function writeApprovalConfig(patch) {
+  fs.mkdirSync(CONF_DIR, { recursive: true });
+  let current = {};
+  try { current = JSON.parse(fs.readFileSync(APPROVALS_CONF, 'utf8')) || {}; } catch {}
+  const next = { ...APPROVAL_DEFAULTS, ...current, ...patch };
+  fs.writeFileSync(APPROVALS_CONF, JSON.stringify(next, null, 2) + '\n');
+  approvalConfCache = { at: 0, value: APPROVAL_DEFAULTS };
+  return next;
+}
+
+if (subcommand === 'approvals') {
+  const action = process.argv[3] || 'status';
+  if (action === 'on' || action === 'always' || action === 'away') {
+    const mode = action === 'on' ? 'away' : action;
+    console.log(`\n  Remote approvals: ${writeApprovalConfig({ mode }).mode}`);
+    reportHookInstall(installApprovalHook({ consent: true }));
+    console.log('');
+    process.exit(0);
+  }
+  if (action === 'off') {
+    writeApprovalConfig({ mode: 'off' });
+    console.log('\n  Remote approvals are off. Permission prompts stay on the Mac.');
+    console.log('  The hook stays installed and does nothing. Remove it fully with:');
+    console.log('  groundcontrol approvals uninstall\n');
+    process.exit(0);
+  }
+  if (action === 'install') {
+    reportHookInstall(installApprovalHook({ consent: true }));
+    console.log('');
+    process.exit(0);
+  }
+  if (action === 'uninstall') {
+    const r = uninstallApprovalHook();
+    console.log(r.ok ? '\n  Permission hook removed.\n' : `\n  ${r.reason}\n`);
+    process.exit(0);
+  }
+  if (action === 'status') {
+    const cfg = approvalConfig();
+    const settings = readClaudeSettings();
+    const entries = Array.isArray(settings?.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+    const installed = entries.some((e) => isOurHook(commandsOf(e)));
+    const others = entries.filter((e) => !isOurHook(commandsOf(e))).map((e) => commandsOf(e).trim().slice(0, 70));
+    console.log(`\n  Mode:        ${cfg.mode}${cfg.mode === 'away' ? ` (after ${cfg.awayAfterSeconds}s idle)` : ''}`);
+    console.log(`  Hook:        ${installed ? 'installed' : 'NOT installed'}`);
+    console.log(`  Hook file:   ${fs.existsSync(HOOK_FILE) ? HOOK_FILE : 'missing'}`);
+    console.log(`  Hold limit:  ${cfg.holdMinutes} minutes, then the Mac prompts instead`);
+    if (settings === null) console.log('  Settings:    ~/.claude/settings.json is not valid JSON');
+    for (const o of others) console.log(`  Also runs:   ${o}`);
+    console.log(`  Config:      ${APPROVALS_CONF}\n`);
+    process.exit(0);
+  }
+  console.log('\n  Usage: groundcontrol approvals <status|on|off|always|install|uninstall>\n');
+  process.exit(1);
+}
+
 const argRelay = (() => {
   const i = process.argv.indexOf('--relay');
   return i > -1 ? process.argv[i + 1] : null;
 })();
 
-const CONF_DIR = path.join(os.homedir(), '.groundcontrol');
 const KEY_FILE = path.join(CONF_DIR, 'key');
 const RELAY_FILE = path.join(CONF_DIR, 'relay');
 fs.mkdirSync(CONF_DIR, { recursive: true });
@@ -283,6 +571,7 @@ if (subcommand !== 'run' && !runsFromServiceDir && process.platform === 'darwin'
   if (installService()) {
     console.log('\n  Done. The daemon now runs in the background: it starts at');
     console.log('  login and restarts by itself. You can close this window.\n');
+    await offerApprovals();
     console.log('  If macOS asks to allow "node" to control Terminal or iTerm2,');
     console.log('  click Allow. That is how phone messages reach your sessions.\n');
     console.log('  Scan the QR above with the Ground Control app to pair.');
@@ -349,23 +638,40 @@ widenPath();
 const which = (cmd) => { try { return execSync(`command -v ${cmd}`, { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim() || null; } catch { return null; } };
 const executable = (p) => { try { fs.accessSync(p, fs.constants.X_OK); return p; } catch { return null; } };
 
-const claudeBin = which('claude');
-console.log(`[daemon] claude binary: ${claudeBin || 'NOT FOUND (phone prompts to idle sessions without a visible terminal will fail)'}`);
+// Every agent binary is resolved on use rather than at startup. launchd starts
+// this at login and it then runs for weeks, while CLIs get installed
+// underneath it. Session discovery already rescans the disk every few seconds,
+// so a `const` resolved at boot produces the worst possible split: the new
+// session appears on the phone, its transcript streams, and sending fails with
+// "binary not found" until someone restarts the daemon. Cached for a minute so
+// a prompt does not pay for a PATH scan.
+const binMemo = new Map(); // label -> { at, path }
+function resolveBin(label, find) {
+  const c = binMemo.get(label);
+  if (c && Date.now() - c.at < 60_000) return c.path;
+  let p = null;
+  try { p = find() || null; } catch {}
+  binMemo.set(label, { at: Date.now(), path: p });
+  return p;
+}
+
+const claudeBin = () => resolveBin('claude', () => which('claude'));
+console.log(`[daemon] claude binary: ${claudeBin() || 'NOT FOUND (phone prompts to idle sessions without a visible terminal will fail)'}`);
 
 // Codex ships a full CLI inside the ChatGPT desktop app, so Codex Desktop
 // users can receive phone prompts even without a standalone install.
-const codexBin = which('codex') || executable('/Applications/ChatGPT.app/Contents/Resources/codex');
+const codexBin = () => resolveBin('codex', () => which('codex') || executable('/Applications/ChatGPT.app/Contents/Resources/codex'));
 
 // Kimi Code renames a legacy Python `kimi` shim to `kimi-legacy` on install,
 // so when the Kimi Code store (~/.kimi-code) exists, `kimi` on PATH belongs
 // to Kimi Code and `kimi-legacy` is the old CLI. Without the store, `kimi` is
 // the legacy one. The two binaries cannot resume each other's sessions, so
 // neither ever doubles for the other.
-const kimiCodeInstalled = fs.existsSync(path.join(os.homedir(), '.kimi-code'));
-const kimiCodeBin = kimiCodeInstalled
+const kimiCodeInstalled = () => fs.existsSync(path.join(os.homedir(), '.kimi-code'));
+const kimiCodeBin = () => resolveBin('kimicode', () => (kimiCodeInstalled()
   ? which('kimi') || executable(path.join(os.homedir(), '.kimi-code', 'bin', 'kimi'))
-  : null;
-const kimiLegacyBin = which('kimi-legacy') || (kimiCodeInstalled ? null : which('kimi'));
+  : null));
+const kimiLegacyBin = () => resolveBin('kimi', () => which('kimi-legacy') || (kimiCodeInstalled() ? null : which('kimi')));
 
 // ---------- Claude Code session discovery ----------
 
@@ -561,6 +867,7 @@ function readMessages(sessionId, maxBytes = 512 * 1024, limit = 80) {
   // path.sep keeps the prefixes unambiguous: without it ~/.kimi would also
   // match every ~/.kimi-code path and routing would depend on check order.
   if (file.startsWith(CODEX_SESS_DIR + path.sep)) return readCodexMessages(file, maxBytes, limit);
+  if (file.startsWith(GROKBOT_DIR + path.sep)) return readGrokBotMessages(file, maxBytes, limit);
   if (file.startsWith(KIMICODE_DIR + path.sep)) return readKimiCodeMessages(file, maxBytes, limit);
   if (file.startsWith(KIMI_DIR + path.sep)) return readKimiLegacyMessages(file, maxBytes, limit);
   let raw;
@@ -606,6 +913,10 @@ function readClaudeSessions() {
       cwd: s.cwd || '',
       project: path.basename(s.cwd || '?'),
       status: headlessActive.has(s.sessionId) ? 'busy' : (s.status || 'idle'),
+      // Claude Code's own view, kept separate because readSessions overwrites
+      // status to 'waiting' for a held request. Answering on the Mac is only
+      // detectable by watching this drop back out of 'waiting'.
+      rawStatus: s.status || 'idle',
       updatedAt: s.statusUpdatedAt || s.updatedAt || 0,
       startedAt: s.startedAt || 0,
       lastMessage: msgs.length ? msgs[msgs.length - 1] : null,
@@ -1019,12 +1330,568 @@ function readKimiSessions() {
   return kimiCache.sessions;
 }
 
+// ---------- Grok Bot session discovery ----------
+// Grok Bot's agents run on a cloud VM, so unlike every other provider there is
+// nothing local to attach to: no process, no tty, no working directory, and no
+// way to send. What the desktop app does keep is a replica of what it has
+// synced, under ~/Library/Application Support/Grok Bot/sand-client-persistence,
+// one JSON blob per store key with the key base32 encoded into the filename.
+// Two keys matter:
+//   <account>.roster.last-roster        one row per Bot
+//   <account>.transcript.replicas.<id>  that Bot's conversation
+//
+// Read only, deliberately. The replica is the app's cache and not the source of
+// truth (that lives on the VM at /home/box/sand-data/agents/<id>/store.db), so
+// a message written in here is a message the app overwrites rather than sends.
+//
+// It also only advances while the desktop app is running. Bots keep working
+// with the app closed and the island cannot see it, so a Bot left mid turn is
+// the app having quit, not the Bot being stuck: busy expires on staleness the
+// same way the other journal-freshness providers do.
+
+const GROKBOT_DIR = path.join(os.homedir(), 'Library', 'Application Support', 'Grok Bot', 'sand-client-persistence');
+const GROKBOT_BUSY_STALE_MS = 5 * 60 * 1000;
+
+// RFC 4648 base32, lowercase and unpadded, which is how the app names blobs.
+// A name that is not one of ours decodes to junk and simply matches nothing,
+// so guessing wrong costs a string compare.
+const B32_ALPHABET = 'abcdefghijklmnopqrstuvwxyz234567';
+function b32decode(name) {
+  let bits = 0;
+  let value = 0;
+  const out = [];
+  for (const ch of name.toLowerCase()) {
+    if (ch === '=') break;
+    const i = B32_ALPHABET.indexOf(ch);
+    if (i < 0) return '';
+    value = (value << 5) | i;
+    bits += 5;
+    if (bits >= 8) { out.push((value >>> (bits - 8)) & 0xff); bits -= 8; }
+  }
+  return Buffer.from(out).toString('utf8');
+}
+
+// The names are long and never change, so decode each one once.
+const grokbotKeys = new Map(); // filename -> decoded store key
+const grokbotKeyOf = (name) => {
+  if (!grokbotKeys.has(name)) grokbotKeys.set(name, b32decode(name.replace(/\.blob$/, '')));
+  return grokbotKeys.get(name);
+};
+
+const grokbotEntriesOf = (file) => {
+  const entries = readJson(file)?.value?.entries;
+  return Array.isArray(entries) ? entries : [];
+};
+
+// Two entry kinds carry a turn: a typed one is {kind:'message', role, content}
+// and a Bot one is {kind:'send-message', message:{type,content}}. Everything
+// else in the stream (tool calls, approvals, status) has no place in a phone
+// transcript.
+function grokbotMessages(entries, limit = 80) {
+  const out = [];
+  for (const e of entries) {
+    let role = null;
+    let text = '';
+    if (e?.kind === 'message' && (e.role === 'user' || e.role === 'assistant')) {
+      role = e.role;
+      text = typeof e.content === 'string' ? e.content : '';
+    } else if (e?.kind === 'send-message' && e.message?.type === 'text') {
+      role = 'assistant';
+      text = typeof e.message.content === 'string' ? e.message.content : '';
+    }
+    text = text.trim();
+    if (!role || !text) continue;
+    out.push({ role, text: text.slice(0, 4000), ts: isoOf(e.timestampMs) });
+  }
+  return out.slice(-limit);
+}
+
+// One JSON object rather than a journal, so the tail slice every other provider
+// reads with would just be a syntax error. Whole file, with a ceiling that only
+// exists so a pathological blob cannot stall the daemon.
+function readGrokBotMessages(file, maxBytes = 512 * 1024, limit = 80) {
+  try { if (fs.statSync(file).size > 8 * 1024 * 1024) return []; } catch { return []; }
+  return grokbotMessages(grokbotEntriesOf(file), limit);
+}
+
+function scanGrokBotSessions() {
+  const sessions = [];
+  let files = [];
+  try { files = fs.readdirSync(GROKBOT_DIR); } catch { return sessions; }
+
+  let rosterFile = null;
+  const transcripts = new Map(); // botId -> blob path
+  for (const name of files) {
+    if (!name.endsWith('.blob')) continue;
+    const key = grokbotKeyOf(name);
+    if (key.endsWith('.roster.last-roster')) rosterFile = path.join(GROKBOT_DIR, name);
+    else {
+      const m = key.match(/\.transcript\.replicas\.([0-9a-f-]{36})$/);
+      if (m) transcripts.set(m[1], path.join(GROKBOT_DIR, name));
+    }
+  }
+  const rows = rosterFile ? readJson(rosterFile)?.value?.rows : null;
+  if (!Array.isArray(rows)) return sessions;
+
+  for (const row of rows) {
+    // A Bot is a standing teammate rather than a session that ends, so the
+    // roster is mirrored as it stands: what the Grok Bot sidebar lists, the
+    // island shows.
+    if (!row?.id || row.isHiddenFromSidebar) continue;
+    const file = transcripts.get(row.id) || null;
+    const scan = file
+      ? memoScan(`grokbot:${file}`, file, () => {
+        const entries = grokbotEntriesOf(file);
+        return { messages: grokbotMessages(entries, 1), streaming: entries.some((e) => e?.isStreaming === true) };
+      })
+      : { messages: [], streaming: false };
+    let updatedAt = row.lastActivityAt || row.updatedAt || 0;
+    if (file) { try { updatedAt = Math.max(updatedAt, fs.statSync(file).mtimeMs); } catch {} }
+    const busy = scan.streaming && Date.now() - updatedAt < GROKBOT_BUSY_STALE_MS;
+    if (file) transcriptCache.set(row.id, file);
+    sessions.push({
+      id: row.id,
+      provider: 'grokbot',
+      name: row.name || 'Bot',
+      // Its working directory is on a machine that is not this one, and
+      // claiming otherwise would put a path on the island you cannot open.
+      cwd: '',
+      project: 'Grok Bot',
+      // awaitingUserResponse is how the app marks a Bot stopped on you, which
+      // is the same pink invader as a held permission request.
+      status: row.awaitingUserResponse ? 'waiting' : (busy ? 'busy' : 'idle'),
+      updatedAt,
+      startedAt: row.createdAt || 0,
+      lastMessage: scan.messages.length ? scan.messages[scan.messages.length - 1] : null,
+      tty: '',
+      live: false,
+      // Nothing reads this yet. It is what a build that greys out the compose
+      // box will key on, instead of re-deriving read-only from the provider.
+      readOnly: true,
+    });
+  }
+  return sessions;
+}
+
+let grokbotCache = { at: 0, sessions: [] };
+function readGrokBotSessions() {
+  if (Date.now() - grokbotCache.at < 10_000) return grokbotCache.sessions;
+  grokbotCache.at = Date.now();
+  grokbotCache.sessions = scanGrokBotSessions();
+  return grokbotCache.sessions;
+}
+
+/// The phone-facing shape of a held request.
+const askPayload = (ask, queued) => ({
+  id: ask.id,
+  tool: ask.tool,
+  line: ask.line,
+  detail: ask.detail,
+  at: ask.at,
+  queued,
+});
+
 function readSessions() {
-  const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions()];
+  const sessions = [...readClaudeSessions(), ...readCodexSessions(), ...readKimiSessions(), ...readGrokBotSessions()];
+  const known = new Set(sessions.map((s) => s.id));
+  for (const s of sessions) {
+    const queue = askQueue.get(s.id);
+    const ask = queue?.length ? pendingAsks.get(queue[0]) : null;
+    if (!ask) continue;
+    // A held permission outranks busy: the session is stopped on a human, and
+    // that is the whole reason the invader turns pink on the island.
+    s.status = 'waiting';
+    s.ask = askPayload(ask, queue.length);
+  }
+
+  // A held request whose session is not in the fleet would never reach the
+  // phone, and one that cannot be seen cannot be answered, which strands the
+  // session until the hold expires. It happens for real: the session file is
+  // written slightly after the first tool call, a scan races a partial write,
+  // or the request comes from a session kind we do not discover. Surface the
+  // request on its own rather than dropping it.
+  for (const [sessionId, queue] of askQueue) {
+    if (known.has(sessionId) || !queue.length) continue;
+    const ask = pendingAsks.get(queue[0]);
+    if (!ask) continue;
+    sessions.push({
+      id: sessionId,
+      provider: 'claude',
+      name: path.basename(ask.cwd || '') || 'session',
+      cwd: ask.cwd || '',
+      project: path.basename(ask.cwd || '') || '?',
+      status: 'waiting',
+      updatedAt: ask.at,
+      startedAt: ask.at,
+      lastMessage: null,
+      tty: '',
+      live: false,
+      ask: askPayload(ask, queue.length),
+    });
+  }
+
   sessions.sort((a, b) => a.startedAt - b.startedAt);
   return sessions;
 }
 
+// ---------- remote approvals: runtime ----------
+// The hook connects here over a unix socket and blocks until this daemon
+// answers. Answering null means "no decision", which puts the prompt back on
+// the Mac exactly as it behaves without Ground Control installed.
+
+const ASK_SOCKET = path.join(CONF_DIR, 'approvals.sock');
+
+/// What the phone needs to render the approvals control without knowing
+/// anything about hooks or settings files. Cached: a snapshot goes out every
+/// 1.5s and this reads and parses settings.json.
+let hostCache = { at: 0, value: null };
+function hostState() {
+  if (Date.now() - hostCache.at < 5000 && hostCache.value) return hostCache.value;
+  const settings = readClaudeSettings();
+  const entries = Array.isArray(settings?.hooks?.PermissionRequest) ? settings.hooks.PermissionRequest : [];
+  const value = {
+    version: VERSION,
+    approvals: {
+      // Present at all means this daemon understands approvals; an older one
+      // simply omits the whole field and the app can say so.
+      installed: entries.some((e) => isOurHook(commandsOf(e))),
+      mode: approvalConfig().mode,
+      // Another app answering the same event can overrule a tap, so the phone
+      // should be able to say that out loud.
+      others: entries.filter((e) => !isOurHook(commandsOf(e))).length,
+      // A settings.json we cannot parse must not be silently overwritten, and
+      // the phone should explain why the toggle will not work.
+      settingsOk: settings !== null,
+      socketOk: approvalServerUp,
+    },
+    updateAvailable: availableUpdate,
+  };
+  hostCache = { at: Date.now(), value };
+  return value;
+}
+const bustHostCache = () => { hostCache.at = 0; };
+
+let approvalServerUp = false;
+let availableUpdate = null;   // version string once a newer release is seen
+
+const pendingAsks = new Map();  // askId -> ask record
+const askQueue = new Map();     // sessionId -> [askId], oldest first
+let askSeq = 0;
+
+/// Seconds since the last keyboard or mouse event on this Mac. A failure reads
+/// as 0 (you are here), which keeps prompts on the Mac rather than silently
+/// routing them to a phone that may not be watching.
+let idleCache = { at: 0, seconds: 0 };
+function macIdleSeconds() {
+  if (process.platform !== 'darwin') return Infinity; // no signal; treat a headless box as away
+  if (Date.now() - idleCache.at < 2000) return idleCache.seconds;
+  let seconds = 0;
+  try {
+    const out = execSync("ioreg -c IOHIDSystem -d 1 | awk '/HIDIdleTime/ {print $NF; exit}'", {
+      timeout: 3000, stdio: ['ignore', 'pipe', 'ignore'],
+    }).toString().trim();
+    const ns = Number(out);
+    if (Number.isFinite(ns) && ns >= 0) seconds = ns / 1e9;
+  } catch {}
+  idleCache = { at: Date.now(), seconds };
+  return seconds;
+}
+
+// Deliberately not a live presence check. iOS suspends the websocket the
+// moment the app is backgrounded, so a phone in a pocket looks offline, which
+// is exactly the situation this feature exists for. What matters is whether
+// this Mac belongs to someone who actually uses the app, so a request is worth
+// holding until they pick the phone up. Walking back to the Mac releases it
+// within seconds either way, so a hold costs a paired user nothing.
+const PHONE_SEEN_FILE = path.join(CONF_DIR, 'phone-seen');
+const PHONE_KNOWN_MS = 30 * 24 * 60 * 60 * 1000;
+
+let lastPhoneWrite = 0;
+function notePhoneSeen() {
+  if (Date.now() - lastPhoneWrite < 60_000) return; // the phone heartbeats; do not churn the disk
+  lastPhoneWrite = Date.now();
+  try { fs.writeFileSync(PHONE_SEEN_FILE, String(Date.now())); } catch {}
+}
+
+function phoneKnown() {
+  try { return Date.now() - Number(fs.readFileSync(PHONE_SEEN_FILE, 'utf8').trim()) < PHONE_KNOWN_MS; }
+  catch { return false; }
+}
+
+function holdPolicy() {
+  const cfg = approvalConfig();
+  if (cfg.mode === 'off') return { hold: false, why: 'remote approvals are off' };
+  if (!phoneKnown()) return { hold: false, why: 'no phone has paired with this Mac' };
+  if (cfg.mode === 'always') return { hold: true };
+  const idle = macIdleSeconds();
+  if (idle < cfg.awayAfterSeconds) return { hold: false, why: `you are at the Mac (idle ${Math.round(idle)}s)` };
+  return { hold: true };
+}
+
+const clip = (v, n) => {
+  const s = typeof v === 'string' ? v : (v == null ? '' : JSON.stringify(v));
+  return s.length > n ? `${s.slice(0, n)}\n...` : s;
+};
+
+/// Reduce a tool call to the one line that identifies it plus a longer preview.
+/// Tool inputs can carry whole file contents, and every byte here is encrypted,
+/// relayed, and rendered on a phone.
+function summarizeTool(tool, input) {
+  const i = input && typeof input === 'object' ? input : {};
+  switch (tool) {
+    case 'Bash':
+    case 'BashOutput':
+      return { line: clip(i.command, 400), detail: clip(i.description, 300) };
+    case 'Write':
+      return { line: clip(i.file_path, 300), detail: clip(i.content, 1000) };
+    case 'Edit':
+      return {
+        line: clip(i.file_path, 300),
+        detail: `${clip(i.old_string, 500)}\n\n->\n\n${clip(i.new_string, 500)}`,
+      };
+    case 'Read':
+      return { line: clip(i.file_path, 300), detail: '' };
+    case 'WebFetch':
+      return { line: clip(i.url, 300), detail: clip(i.prompt, 300) };
+    case 'WebSearch':
+      return { line: clip(i.query, 300), detail: '' };
+    default: {
+      // Unknown or MCP tools: show whichever field reads most like a target,
+      // and fall back to the whole input.
+      const pick = i.command || i.file_path || i.path || i.url || i.query || i.pattern;
+      return { line: clip(pick || tool, 300), detail: clip(i, 1000) };
+    }
+  }
+}
+
+function dropAsk(ask) {
+  pendingAsks.delete(ask.id);
+  const queue = askQueue.get(ask.sessionId);
+  if (!queue) return;
+  const at = queue.indexOf(ask.id);
+  if (at > -1) queue.splice(at, 1);
+  if (!queue.length) askQueue.delete(ask.sessionId);
+}
+
+/// Answer a held request exactly once. A null decision releases it back to the
+/// Mac; the hook prints nothing and Claude Code prompts in the terminal.
+function settleAsk(ask, decision, outcome, note) {
+  if (ask.done) return;
+  ask.done = true;
+  clearTimeout(ask.holdTimer);
+  dropAsk(ask);
+  try { ask.socket.write(JSON.stringify({ decision: decision || null }) + '\n'); } catch {}
+  try { ask.socket.end(); } catch {}
+  console.log(`[daemon] permission ${ask.tool} ${outcome}${note ? `: ${note}` : ''}`);
+  if (ws?.readyState === 1) {
+    ws.send(seal({ type: 'askResolved', askId: ask.id, sessionId: ask.sessionId, outcome, note: note || '' }));
+  }
+  sendSnapshot(true);
+}
+
+function onPermissionRequest(req, socket) {
+  const gate = holdPolicy();
+  if (!gate.hold) {
+    console.log(`[daemon] permission ${req.toolName} left on the Mac: ${gate.why}`);
+    try { socket.write('{"decision":null}\n'); } catch {}
+    try { socket.end(); } catch {}
+    return;
+  }
+  const { line, detail } = summarizeTool(req.toolName, req.toolInput);
+  const ask = {
+    id: `${Date.now().toString(36)}-${++askSeq}`,
+    sessionId: req.sessionId,
+    tool: req.toolName || 'tool',
+    line,
+    detail,
+    cwd: req.cwd || '',
+    at: Date.now(),
+    socket,
+    done: false,
+  };
+  ask.holdTimer = setTimeout(
+    () => settleAsk(ask, null, 'released', 'held too long, prompting on the Mac instead'),
+    Math.max(1, approvalConfig().holdMinutes) * 60_000,
+  );
+  // The hook dying (session quit, Ctrl+C, Claude restarted) closes the socket.
+  // Without this the card would linger on the phone with nothing behind it.
+  socket.on('close', () => settleAsk(ask, null, 'gone', 'the session stopped waiting'));
+  socket.on('error', () => {});
+  pendingAsks.set(ask.id, ask);
+  askQueue.set(ask.sessionId, [...(askQueue.get(ask.sessionId) || []), ask.id]);
+  console.log(`[daemon] permission held for the phone: ${ask.tool} ${ask.line.slice(0, 60)}`);
+  sendSnapshot(true);
+}
+
+function startApprovalServer(attempt = 0) {
+  // sun_path is 104 bytes on macOS. Over that, the bind fails in ways that
+  // read as EADDRINUSE rather than "path too long", so say it plainly.
+  if (Buffer.byteLength(ASK_SOCKET) > 100) {
+    console.log(`[daemon] home path too long for the approvals socket, permission prompts stay on the Mac: ${ASK_SOCKET}`);
+    return;
+  }
+  // A hard killed daemon leaves the socket file behind and bind fails with
+  // EADDRINUSE, so clear it first. If the bind still fails, another daemon is
+  // genuinely listening; it is about to be displaced on the relay and exit, so
+  // retry a few times rather than losing approvals until the next restart.
+  try { fs.unlinkSync(ASK_SOCKET); } catch {}
+  const server = net.createServer((socket) => {
+    socket.setEncoding('utf8');
+    let buf = '';
+    let handled = false;
+    socket.on('data', (chunk) => {
+      if (handled) return;
+      buf += chunk;
+      const nl = buf.indexOf('\n');
+      if (nl === -1) {
+        if (buf.length > 2_000_000) socket.destroy(); // a tool input this big is not real
+        return;
+      }
+      handled = true;
+      let req;
+      try { req = JSON.parse(buf.slice(0, nl)); } catch { req = null; }
+      if (!req || !req.sessionId) {
+        try { socket.write('{"decision":null}\n'); } catch {}
+        try { socket.end(); } catch {}
+        return;
+      }
+      onPermissionRequest(req, socket);
+    });
+    socket.on('error', () => {});
+  });
+  server.on('error', (e) => {
+    if (e.code === 'EADDRINUSE' && attempt < 5) {
+      setTimeout(() => startApprovalServer(attempt + 1), 1000);
+      return;
+    }
+    console.log(`[daemon] approvals socket unavailable, permission prompts stay on the Mac: ${e.message}`);
+  });
+  server.listen(ASK_SOCKET, () => {
+    try { fs.chmodSync(ASK_SOCKET, 0o600); } catch {}
+    approvalServerUp = true;
+    bustHostCache();
+    console.log(`[daemon] remote approvals ready (mode: ${approvalConfig().mode})`);
+  });
+}
+
+// Claude Code's own status for each session, as last seen on disk.
+const lastRawStatus = new Map(); // sessionId -> 'busy' | 'idle' | 'waiting' | ...
+
+/// Clear a held request that was answered on the Mac.
+///
+/// The socket closing is the fast path, but it cannot be relied on: Claude
+/// Code does not always kill the hook process when the human answers in the
+/// terminal, and a hook nobody killed keeps its socket open, so the phone
+/// would keep showing a card for a question that is already settled.
+///
+/// Claude Code writes "waiting" into its own session file while a prompt is
+/// on screen, so that dropping back to busy or idle is the real signal that
+/// the prompt is gone. The grace period covers the gap between our hook being
+/// called and Claude getting round to writing the status.
+const ANSWERED_GRACE_MS = 6000;
+function releaseAnsweredOnMac() {
+  if (!pendingAsks.size) return;
+  for (const ask of [...pendingAsks.values()]) {
+    if (Date.now() - ask.at < ANSWERED_GRACE_MS) continue;
+    const status = lastRawStatus.get(ask.sessionId);
+    // Unknown session: nothing to conclude, leave it to the socket or the cap.
+    if (!status || status === 'waiting') continue;
+    settleAsk(ask, null, 'gone', 'answered on the Mac');
+  }
+}
+
+/// Sitting back down at the Mac clears the phone card. Not because the Mac
+/// needs it back: Claude Code shows its own terminal prompt the whole time a
+/// hook is running (verified on 2.1.220), so the Mac is never blocked and can
+/// always answer. This just stops the phone showing a request you are about
+/// to deal with in front of you.
+function releaseAsksIfBack() {
+  if (!pendingAsks.size) return;
+  const cfg = approvalConfig();
+  if (cfg.mode !== 'away') return;
+  if (macIdleSeconds() >= cfg.awayAfterSeconds) return;
+  for (const ask of [...pendingAsks.values()]) {
+    settleAsk(ask, null, 'released', 'you came back to the Mac');
+  }
+}
+
+// ---------- self update ----------
+// The service runs from a frozen copy under ~/.groundcontrol/service, so
+// without this a user who installed once never sees another release. Checked
+// daily, always announced in the log and surfaced in the app.
+
+const UPDATE_CHECK_MS = 24 * 60 * 60 * 1000;
+const UPDATE_STAMP = path.join(CONF_DIR, 'last-update-check');
+
+/// Compare dotted numeric versions. Anything unparseable sorts as older, so a
+/// junk value from the registry can never trigger an update.
+function isNewer(candidate, current) {
+  const parse = (v) => String(v).split('.').map((n) => Number(n));
+  const a = parse(candidate), b = parse(current);
+  if (a.length !== 3 || a.some((n) => !Number.isInteger(n) || n < 0)) return false;
+  for (let i = 0; i < 3; i++) {
+    if ((a[i] || 0) > (b[i] || 0)) return true;
+    if ((a[i] || 0) < (b[i] || 0)) return false;
+  }
+  return false;
+}
+
+async function latestPublishedVersion() {
+  const res = await fetch(`https://registry.npmjs.org/${PACKAGE}/latest`, {
+    headers: { accept: 'application/vnd.npm.install-v1+json' },
+    signal: AbortSignal.timeout(15_000),
+  });
+  if (!res.ok) throw new Error(`registry ${res.status}`);
+  const body = await res.json();
+  if (!body?.version) throw new Error('registry response had no version');
+  return body.version;
+}
+
+/// Re-install the service from the newly published version. Runs detached
+/// because `service install` boots this very process out partway through;
+/// launchd then starts the replacement. installService stages everything
+/// before it touches the running service, so a failure here leaves the
+/// current daemon in place rather than nothing at all.
+function applyUpdate(version) {
+  console.log(`[daemon] updating to ${version}`);
+  const child = spawn('npx', ['-y', `${PACKAGE}@${version}`, 'service', 'install'], {
+    detached: true,
+    stdio: ['ignore', fs.openSync(LOG_FILE, 'a'), fs.openSync(LOG_FILE, 'a')],
+    env: process.env,
+  });
+  child.unref();
+}
+
+async function checkForUpdate({ force = false } = {}) {
+  // Only the launchd copy updates itself. A daemon someone is running by hand
+  // in a terminal must never swap itself out from under them.
+  if (!runsFromServiceDir && !force) return;
+  try {
+    const last = Number(fs.readFileSync(UPDATE_STAMP, 'utf8').trim());
+    if (!force && Number.isFinite(last) && Date.now() - last < UPDATE_CHECK_MS) return;
+  } catch {}
+  try { fs.writeFileSync(UPDATE_STAMP, String(Date.now())); } catch {}
+  let latest;
+  try { latest = await latestPublishedVersion(); }
+  catch (e) { console.log(`[daemon] update check failed: ${e.message}`); return; }
+  if (!isNewer(latest, VERSION)) return;
+  availableUpdate = latest;
+  bustHostCache();
+  sendSnapshot(true);
+  console.log(`[daemon] a newer version is available: ${latest} (running ${VERSION})`);
+  // Held requests belong to sessions that are about to lose their socket.
+  releaseAllAsks();
+  applyUpdate(latest);
+}
+
+/// A daemon shutting down must hand every held request back rather than leave
+/// sessions blocked on a socket that will never answer.
+function releaseAllAsks() {
+  for (const ask of [...pendingAsks.values()]) {
+    settleAsk(ask, null, 'released', 'the daemon stopped');
+  }
+}
+
 // ---------- relay connection ----------
 
 let ws = null;
@@ -1038,11 +1905,15 @@ function sendSnapshot(force = false) {
     console.log(`[daemon] snapshot failed: ${e.message}`);
     return;
   }
-  const json = JSON.stringify(sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })));
+  for (const s of sessions) if (s.rawStatus) lastRawStatus.set(s.id, s.rawStatus);
+  const host = hostState();
+  // Host state joins the dedupe key, otherwise flipping approvals on would not
+  // reach a phone whose session list happened not to change.
+  const json = JSON.stringify([sessions.map(({ lastMessage, ...s }) => ({ ...s, last: lastMessage?.text?.slice(0, 120) })), host]);
   if (!force && json === lastSnapshotJson) return;
   lastSnapshotJson = json;
   if (ws?.readyState === 1) {
-    ws.send(seal({ type: 'snapshot', at: Date.now(), sessions }));
+    ws.send(seal({ type: 'snapshot', at: Date.now(), sessions, host }));
     console.log(`[daemon] snapshot -> ${sessions.length} session(s): ${sessions.map((s) => `${s.name}:${s.status}`).join(', ') || 'none'}`);
   }
 }
@@ -1056,7 +1927,14 @@ function watchTranscript(sessionId) {
   if (!file) return;
   let debounce;
   try {
-    const w = fs.watch(file, () => {
+    // Journals are appended to, so watching the file is enough. Grok Bot
+    // rewrites its replica blob wholesale, and a rename leaves a file watch
+    // bound to an inode nothing writes to again: watch the directory instead
+    // and filter, which survives the swap.
+    const inGrokBot = file.startsWith(GROKBOT_DIR + path.sep);
+    const target = inGrokBot ? GROKBOT_DIR : file;
+    const w = fs.watch(target, (_ev, changed) => {
+      if (inGrokBot && changed && changed !== path.basename(file)) return;
       clearTimeout(debounce);
       debounce = setTimeout(() => {
         ws?.send(seal({ type: 'transcript', sessionId, messages: readMessages(sessionId) }));
@@ -1079,6 +1957,46 @@ async function handleCommand(cmd) {
     ws?.send(seal({ type: 'transcript', sessionId: cmd.sessionId, messages: readMessages(cmd.sessionId) }));
   } else if (cmd.type === 'unwatch' && cmd.sessionId) {
     unwatchTranscript(cmd.sessionId);
+  } else if (cmd.type === 'setApprovals') {
+    // A deliberate tap in the app, with the app explaining what it adds, is
+    // the consent for this. A backup is still written before any change.
+    let result;
+    if (cmd.enabled === false) {
+      writeApprovalConfig({ mode: 'off' });
+      result = uninstallApprovalHook();
+      console.log('[daemon] remote approvals turned off from the phone');
+    } else {
+      const mode = ['away', 'always'].includes(cmd.mode) ? cmd.mode : 'away';
+      writeApprovalConfig({ mode });
+      result = installApprovalHook({ consent: true });
+      console.log(`[daemon] remote approvals turned on from the phone (mode: ${mode})`);
+    }
+    bustHostCache();
+    sendSnapshot(true);
+    ws?.send(seal({
+      type: 'approvalsResult',
+      ok: !!result.ok,
+      error: result.ok ? '' : (result.reason || 'could not change the setting'),
+      host: hostState(),
+    }));
+  } else if (cmd.type === 'approve' || cmd.type === 'deny') {
+    const ask = cmd.askId ? pendingAsks.get(cmd.askId) : null;
+    if (!ask) {
+      // Answered on the Mac, expired, or the session moved on while the tap
+      // was in flight. Tell the phone so the card clears instead of hanging.
+      return ws?.send(seal({
+        type: 'askResolved', askId: cmd.askId || '', sessionId: cmd.sessionId || '',
+        outcome: 'gone', note: 'that request is no longer waiting',
+      }));
+    }
+    if (cmd.type === 'approve') {
+      settleAsk(ask, { behavior: 'allow', ...(cmd.always ? { alwaysAllow: true } : {}) },
+        'allowed', cmd.always ? 'from the phone, and always from now on' : 'from the phone');
+    } else {
+      const reason = (cmd.text || '').trim();
+      settleAsk(ask, { behavior: 'deny', message: reason || 'Denied from the Ground Control app.' },
+        'denied', reason ? `from the phone: ${reason.slice(0, 60)}` : 'from the phone');
+    }
   } else if (cmd.type === 'ping' && cmd.sessionId) {
     const s = readSessions().find((x) => x.id === cmd.sessionId);
     ws?.send(seal({ type: 'pong', sessionId: cmd.sessionId, alive: !!s, status: s?.status || 'gone', at: Date.now() }));
@@ -1086,6 +2004,15 @@ async function handleCommand(cmd) {
     const session = readSessions().find((s) => s.id === cmd.sessionId);
     if (!session) return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session not found' }));
 
+    // A Bot lives on a cloud VM this daemon has no channel to. Saying so beats
+    // a send that looks accepted and arrives nowhere.
+    if (session.provider === 'grokbot') {
+      return ws?.send(seal({
+        type: 'promptResult', sessionId: cmd.sessionId, ok: false,
+        error: 'Grok Bot runs in the cloud, so Ground Control can only watch it. Open the Grok Bot app to reply.',
+      }));
+    }
+
     if (session.provider && session.provider !== 'claude') return promptHeadless(session, cmd.text);
 
     // Preferred path: type into the real terminal so the desktop updates live.
@@ -1107,7 +2034,8 @@ async function handleCommand(cmd) {
       }
     }
     if (session.status === 'busy') return ws?.send(seal({ type: 'promptResult', sessionId: cmd.sessionId, ok: false, error: 'session is busy, wait for it to go idle' }));
-    if (!claudeBin) {
+    const bin = claudeBin();
+    if (!bin) {
       console.log('[daemon] prompt failed: claude binary not found on PATH');
       return ws?.send(seal({
         type: 'promptResult', sessionId: cmd.sessionId, ok: false,
@@ -1117,7 +2045,7 @@ async function handleCommand(cmd) {
     console.log(`[daemon] prompt -> ${session.name}: ${cmd.text.slice(0, 60)}`);
     headlessActive.add(cmd.sessionId);
     sendSnapshot(true);
-    const child = spawn(claudeBin, ['--resume', cmd.sessionId, '-p', cmd.text], {
+    const child = spawn(bin, ['--resume', cmd.sessionId, '-p', cmd.text], {
       cwd: fs.existsSync(session.cwd || '') ? session.cwd : os.homedir(),
       env: process.env,
       stdio: ['ignore', 'pipe', 'pipe'],
@@ -1156,14 +2084,15 @@ async function handleCommand(cmd) {
 // dash there (the models do not care about leading whitespace).
 const defuse = (text) => (/^\s*-/.test(text) ? ` ${text}` : text);
 const headlessPromptSpec = {
-  codex: () => codexBin && { bin: codexBin, args: (id, text) => ['exec', 'resume', id, '--skip-git-repo-check', '--', text] },
-  kimicode: () => kimiCodeBin && { bin: kimiCodeBin, args: (id, text) => ['--session', id, '-p', defuse(text)] },
-  kimi: () => kimiLegacyBin && { bin: kimiLegacyBin, args: (id, text) => ['--print', '--session', id, '-p', defuse(text)] },
+  codex: () => { const bin = codexBin(); return bin && { bin, args: (id, text) => ['exec', 'resume', id, '--skip-git-repo-check', '--', text] }; },
+  kimicode: () => { const bin = kimiCodeBin(); return bin && { bin, args: (id, text) => ['--session', id, '-p', defuse(text)] }; },
+  kimi: () => { const bin = kimiLegacyBin(); return bin && { bin, args: (id, text) => ['--print', '--session', id, '-p', defuse(text)] }; },
 };
 
 function bustProviderCaches() {
   codexCache.at = 0;
   kimiCache.at = 0;
+  grokbotCache.at = 0;
 }
 
 function promptHeadless(session, text) {
@@ -1176,7 +2105,7 @@ function promptHeadless(session, text) {
     console.log(`[daemon] ${session.provider} prompt failed: binary not found`);
     return ws?.send(seal({
       type: 'promptResult', sessionId: session.id, ok: false,
-      error: `The daemon could not find the ${session.provider === 'codex' ? 'codex' : 'kimi'} command on this Mac, so it cannot reach this session.`,
+      error: `The daemon could not find the ${session.provider === 'codex' ? 'codex' : 'kimi'} command on this Mac, so it cannot reach this session. If you just installed it, try again in a minute.`,
     }));
   }
   console.log(`[daemon] prompt -> ${session.provider} ${session.name}: ${text.slice(0, 60)}`);
@@ -1231,9 +2160,20 @@ function connect() {
   ws.on('pong', () => { lastPongAt = Date.now(); });
   ws.on('message', (data) => {
     const str = data.toString();
-    if (str === '{"sys":"client-joined"}') { console.log('[daemon] phone connected'); sendSnapshot(true); return; }
+    if (str === '{"sys":"client-joined"}') {
+      notePhoneSeen();
+      console.log('[daemon] phone connected');
+      sendSnapshot(true);
+      return;
+    }
     if (str.startsWith('{"sys"')) return;
-    try { handleCommand(open(str))?.catch?.(() => {}); } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
+    // A command that decrypts proves a real paired phone is on the other end,
+    // which is what the approval policy checks before holding a prompt.
+    try {
+      const cmd = open(str);
+      notePhoneSeen();
+      handleCommand(cmd)?.catch?.(() => {});
+    } catch (e) { console.log('[daemon] bad message (wrong key?)'); }
   });
   ws.on('close', (code) => {
     if (code === 4001) {
@@ -1248,6 +2188,32 @@ function connect() {
 
 connect();
 if (process.platform === 'darwin') requestAutomationGrant();
+
+// Remote approvals. The daemon refreshes the hook script itself, which is our
+// own file, but never edits ~/.claude/settings.json: a background process is
+// the last thing that should rewrite another tool's config unasked. Turning it
+// on is an explicit `groundcontrol approvals on`.
+try { stageHookFile(); } catch (e) { console.log(`[daemon] could not refresh the permission hook: ${e.message}`); }
+const hookState = installApprovalHook();  // consent defaults to false: reports, never writes
+if (hookState.unchanged) console.log('[daemon] permission hook installed, remote approvals available');
+else if (hookState.needsConsent) console.log('[daemon] permission hook not installed (run: groundcontrol approvals on)');
+else if (!hookState.ok) console.log(`[daemon] permission hook unavailable: ${hookState.reason}`);
+for (const cmd of hookState.foreign || []) console.log(`[daemon] another app also answers permission requests: ${cmd}`);
+startApprovalServer();
+setInterval(releaseAsksIfBack, 3000);
+setInterval(releaseAnsweredOnMac, 2000);
+
+// Self update. Staggered off startup so a login storm does not hit the
+// registry at once, then re-checked hourly (the daily stamp does the gating).
+setTimeout(() => { checkForUpdate().catch(() => {}); }, 60_000);
+setInterval(() => { checkForUpdate().catch(() => {}); }, 60 * 60 * 1000);
+
+// Held requests are sockets a Claude session is blocked on. Hand them back
+// before going away, or those sessions sit frozen until the hook times out.
+for (const sig of ['SIGINT', 'SIGTERM']) {
+  process.on(sig, () => { releaseAllAsks(); process.exit(0); });
+}
+
 setInterval(sendSnapshot, 1500);
 // Heartbeat traffic keeps the Cloudflare socket alive in both directions and
 // lets the phone detect a dead link; missing pongs force a reconnect here.
@@ -1281,6 +2247,7 @@ function watchProviderDir(dir, cache, label) {
     console.log(`[daemon] ${label}: watching ${dir}`);
   } catch {}
 }
-watchProviderDir(CODEX_SESS_DIR, codexCache, `codex sessions (codex binary: ${codexBin || 'not found, sessions will be read only'})`);
+watchProviderDir(CODEX_SESS_DIR, codexCache, `codex sessions (codex binary: ${codexBin() || 'not found yet, rechecked on each prompt'})`);
 watchProviderDir(path.join(KIMI_DIR, 'sessions'), kimiCache, 'kimi sessions');
 watchProviderDir(path.join(KIMICODE_DIR, 'sessions'), kimiCache, 'kimi code sessions');
+watchProviderDir(GROKBOT_DIR, grokbotCache, 'grok bot roster (read only, replies happen in the Grok Bot app)');