@hwip/cli 0.1.2 → 0.1.4

package/dist/listener.js

@@ -25,9 +25,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fileViewBytes = exports.handleScreenRequest = exports.setSubscriberTrust = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.withSettledPrompts = exports.PROMPT_SEAL_WAIT_MS = exports.withBlockedPrompts = exports.setPromptSealer = exports.deriveSessionState = exports.resetSessionStates = exports.runIdOfEpoch = exports.__checkoutCacheSize = exports.parseSessionName = exports.tmuxTargetFor = exports.subagentTranscriptFor = exports.recordTargets = exports.recordSubagentTranscripts = exports.isSubagentSessionName = exports.detectRemoteAgent = exports.sessionLiveness = exports.sessionExists = exports.liveSessionNames = exports.tmuxArgs = exports.silenceListenerLog = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.probePane = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = exports.commandsReportDue = exports.commandsFingerprint = exports.COMMAND_SCAN_INTERVAL_MS = exports.sessionsReportDue = exports.sessionsFingerprint = exports.knownSessionsFingerprint = exports.knownSessionsToReport = exports.withRunSeqs = exports.KNOWN_SESSIONS_REPORTED = exports.staleConnectionAction = exports.askedToReconnect = exports.MAX_STALE_CONNECTION_DROPS = exports.createReportAckWatch = exports.REPORT_ACK_TIMEOUT_MS = exports.SESSION_REPORT_HEARTBEAT_MS = exports.SESSION_REPORT_INTERVAL_MS = exports.heartbeatVerdict = exports.pingDue = exports.PING_IDLE_MS = void 0;
-exports.writeRemoteMarker = exports.isInventoried = exports.syncTmuxAgentNames = exports.recordInventory = exports.collectSessionsVerbose = exports.handleCommandInput = exports.pendingInputDecrypts = exports.MAX_PENDING_DECRYPTS = exports.MAX_INPUT_LANES = exports.validateInputMessage = exports.MAX_INPUT_BODY_CHARS = exports.MAX_INPUT_KEYS = exports.handleStreamControl = exports.buildStreamFrame = exports.isStreamCapReached = exports.fitSealedFrame = exports.SEALED_FRAME_MAX_BYTES = exports.stopAllStreams = exports.stopStream = exports.stopStreamOf = exports.handleTurnWatch = exports.sealTurnBatch = exports.resolveWatchTranscript = exports.MAX_CONCURRENT_STREAMS = exports.STREAM_RENEW_FRESH_MS = exports.STREAM_LEASE_MS = exports.claimFrameSend = exports.hasFrameBudget = exports.streamCadence = exports.MAX_FRAMES_PER_SEC = exports.BURST_WINDOW_MS = exports.BURST_INTERVAL_MS = exports.STREAM_INTERVAL_MS = exports.STREAM_CAPTURE_LINES = exports.scheduleInjectSnapshots = exports.historyLinesIn = exports.cursorLineFor = exports.parsePaneGeometry = exports.STREAM_GEOMETRY_FORMAT = exports.handleScreenHistoryRequest = exports.SCREEN_HISTORY_MAX_LINES = exports.handleSessionForgetRequest = exports.handleSessionExitRequest = exports.SESSION_EXIT_STEP_MS = exports.handleSessionResumeRequest = exports.handleScheduleListRequest = exports.handleFileBlobRequest = exports.handleFileTreeRequest = exports.handleDiffFileRequest = exports.handleDiffFilesRequest = void 0;
-exports.handleListener = exports.liveScheduleRunnerDeps = exports.listenerSettings = exports.resolveWsUrl = exports.streamSession = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.displayFolder = exports.claimLanFile = exports.saveFileFromS3 = exports.downloadSealedEach = exports.answerFileBound = exports.downloadAttachments = exports.setAttachmentContext = exports.shellTextRefusal = void 0;
+exports.setSubscriberTrust = exports.collectWatchHits = exports.resetPatternWatches = exports.setPatternWatches = exports.withSettledPrompts = exports.PROMPT_SEAL_WAIT_MS = exports.withBlockedPrompts = exports.setPromptSealer = exports.deriveSessionState = exports.resetSessionStates = exports.continueRuns = exports.runIdOfEpoch = exports.__checkoutCacheSize = exports.parseSessionName = exports.resetPaneFitClaims = exports.tmuxTargetFor = exports.subagentTranscriptFor = exports.recordTargets = exports.recordSubagentTranscripts = exports.isSubagentSessionName = exports.detectRemoteAgent = exports.sessionLiveness = exports.sessionExists = exports.liveSessionNames = exports.tmuxArgs = exports.silenceListenerLog = exports.invalidateTmuxSocketCache = exports.resolveKeys = exports.probePane = exports.checkRateLimit = exports.AUTH_FAILURE_CODES = exports.commandsReportDue = exports.commandsFingerprint = exports.COMMAND_SCAN_INTERVAL_MS = exports.sessionsReportDue = exports.sessionsFingerprint = exports.knownSessionsFingerprint = exports.knownSessionsToReport = exports.withRunSeqs = exports.KNOWN_SESSIONS_REPORTED = exports.staleConnectionAction = exports.askedToReconnect = exports.MAX_STALE_CONNECTION_DROPS = exports.createReportAckWatch = exports.REPORT_ACK_TIMEOUT_MS = exports.SESSION_REPORT_HEARTBEAT_MS = exports.SESSION_REPORT_INTERVAL_MS = exports.heartbeatVerdict = exports.pingDue = exports.PING_IDLE_MS = void 0;
+exports.syncTmuxAgentNames = exports.recordInventory = exports.collectSessionsVerbose = exports.handleCommandInput = exports.pendingInputDecrypts = exports.MAX_PENDING_DECRYPTS = exports.MAX_INPUT_LANES = exports.validateInputMessage = exports.MAX_INPUT_BODY_CHARS = exports.MAX_INPUT_KEYS = exports.handleStreamControl = exports.buildStreamFrame = exports.isStreamCapReached = exports.fitSealedFrame = exports.SEALED_FRAME_MAX_BYTES = exports.stopAllStreams = exports.stopStream = exports.stopStreamOf = exports.handleTurnWatch = exports.sealTurnBatch = exports.resolveWatchTranscript = exports.MAX_CONCURRENT_STREAMS = exports.STREAM_RENEW_FRESH_MS = exports.STREAM_LEASE_MS = exports.claimFrameSend = exports.hasFrameBudget = exports.streamCadence = exports.MAX_FRAMES_PER_SEC = exports.BURST_WINDOW_MS = exports.BURST_INTERVAL_MS = exports.STREAM_INTERVAL_MS = exports.STREAM_CAPTURE_LINES = exports.scheduleInjectSnapshots = exports.historyLinesIn = exports.cursorLineFor = exports.parsePaneGeometry = exports.STREAM_GEOMETRY_FORMAT = exports.handleScreenHistoryRequest = exports.SCREEN_HISTORY_MAX_LINES = exports.handleSessionForgetRequest = exports.handleSessionExitRequest = exports.SESSION_EXIT_STEP_MS = exports.handleSessionResumeRequest = exports.handleScheduleListRequest = exports.handleFileBlobRequest = exports.handleFileTreeRequest = exports.handleDiffFileRequest = exports.handleDiffFilesRequest = exports.fileViewBytes = exports.handleScreenRequest = void 0;
+exports.handleListener = exports.liveScheduleRunnerDeps = exports.listenerSettings = exports.resolveWsUrl = exports.streamSession = exports.computeListenerDeviceId = exports.computeBackoff = exports.handlePush = exports.gcAttachments = exports.displayFolder = exports.claimLanFile = exports.saveFileFromS3 = exports.downloadSealedEach = exports.answerFileBound = exports.downloadAttachments = exports.setAttachmentContext = exports.shellTextRefusal = exports.writeRemoteMarker = exports.isInventoried = void 0;
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const fs_1 = require("fs");
@@ -318,16 +318,17 @@ const knownSessionsToReport = (live, now = Date.now(), seqs = (0, run_seqs_js_1.
         ...(e.runId ? { runId: e.runId } : {}),
         ...(e.startedAt ? { startedAt: e.startedAt } : {}),
         ...(e.runId ? seqs.get((0, run_seqs_js_1.runSeqsKey)(e.name, e.runId)) : undefined),
+        ...(e.tmuxRunIds?.length ? { tmuxRunIds: e.tmuxRunIds } : {}),
         lastSeenAt: e.lastSeenAt,
     }));
 };
 exports.knownSessionsToReport = knownSessionsToReport;
-const knownSessionsFingerprint = (known) => known.map((k) => `${k.name}${k.agentKind}${k.runId ?? ''}${k.lastSeenAt}${k.firstSeq ?? ''}${k.lastSeq ?? ''}`).sort().join('|');
+const knownSessionsFingerprint = (known) => known.map((k) => `${k.name}${k.agentKind}${k.runId ?? ''}${k.lastSeenAt}${k.firstSeq ?? ''}${k.lastSeq ?? ''}${k.tmuxRunIds?.join(',') ?? ''}`).sort().join('|');
 exports.knownSessionsFingerprint = knownSessionsFingerprint;
 const sessionsFingerprint = (sessions) => sessions
     .map((s) => JSON.stringify([
     s.name, s.attached, s.agentKind, s.agentSessionId ?? null,
-    s.project, s.label ?? null, s.providerSessionName ?? null, s.createdAt ?? null, s.runId ?? null, s.firstSeq ?? null,
+    s.project, s.label ?? null, s.providerSessionName ?? null, s.providerSessionNameSource ?? null, s.createdAt ?? null, s.runId ?? null, s.firstSeq ?? null,
     s.lastActivityAt ?? null, s.state ?? null,
     s.stateChangedAt ?? null, s.stateRuleId ?? null,
     s.blockedPrompt?.id ?? null, s.blockedPrompt?.at ?? null,
@@ -587,8 +588,13 @@ const worktreeCleanup = (0, listener_worktree_cleanup_js_1.createWorktreeCleanup
     notify: desktop_notify_js_1.notifyDesktop,
     tmux: (args, timeoutMs) => (0, worktree_js_1.tmuxRun)((0, tmux_socket_js_1.tmuxArgs)(args), timeoutMs),
 });
-/** Sizes a watched detached window to its viewer (pane-fit.ts). */
-const paneFitter = (0, pane_fit_js_1.createPaneFitter)(runTmux);
+/** Sizes a watched window to its viewer while the phone is its latest user (pane-fit.ts). */
+const paneFitter = (0, pane_fit_js_1.createPaneFitter)(runTmux, undefined, (0, pane_fit_js_1.macosLastKeyAt)());
+/** Test hook. */
+const resetPaneFitClaims = () => paneFitter.forgetClaims();
+exports.resetPaneFitClaims = resetPaneFitClaims;
+/** How often fitted windows are checked for a desktop that took them back; idle windows cost nothing. */
+const PANE_FIT_RECHECK_MS = 1_000;
 // ─── Session inventory ──────────────────────────────────────────────
 /**
  * Parse a `hwip-*` tmux session name into `{project, label}`. The wrapper
@@ -638,11 +644,33 @@ const epochToIso = (epoch) => {
  * from `createdAt` for listeners that do not send one (`runIdOf`), so the two
  * must agree: `epochToIso` keeps whole seconds and this floors them.
  */
-const runIdOfEpoch = (epoch) => {
-    const iso = epochToIso(epoch);
-    return iso ? String(Math.floor(Date.parse(iso) / 1000)) : undefined;
-};
+const runIdOfEpoch = (epoch) => runIdOfIso(epochToIso(epoch));
 exports.runIdOfEpoch = runIdOfEpoch;
+/** The run id of the tmux session that started at `iso` (a session's `createdAt`). */
+const runIdOfIso = (iso) => {
+    const ms = iso ? Date.parse(iso) : NaN;
+    return Number.isFinite(ms) ? String(Math.floor(ms / 1000)) : undefined;
+};
+/**
+ * Each live session's run once the sweep has read the conversations (hwip
+ * docs/session-runs.md §3): a session carrying on an earlier run's
+ * conversation reports — and its recorder tags — that run instead of its new
+ * tmux session. `sessions` and `recordable` are this sweep's, changed in place.
+ */
+const continueRuns = (sessions, recordable, conversationOf, known = (0, session_registry_js_1.knownSessions)()) => {
+    for (const s of sessions) {
+        if (s.parentName || !s.runId)
+            continue;
+        const runId = (0, session_registry_js_1.continuedRunId)(known, s.name, s.agentKind, s.runId, conversationOf(s.name));
+        if (runId === s.runId)
+            continue;
+        s.runId = runId;
+        const source = recordable[s.name];
+        if (source)
+            recordable[s.name] = { ...source, runId };
+    }
+};
+exports.continueRuns = continueRuns;
 // ─── Agent state detection (SPEC-AGENT-AWARENESS §S1) ──────────────
 // How many pane lines the state rules see. The live status area every
 // agent renders sits in the last handful of lines; 40 leaves margin for
@@ -1597,7 +1625,8 @@ const handleSessionForgetRequest = (req, send) => {
     // A name running again is not the run being forgotten: an ended run of it goes on its own (Q29).
     // The running run itself, a request naming no run, or a run tmux could not tell apart stay refused.
     if (liveness === 'running') {
-        const live = runId ? (0, tmux_liveness_js_1.liveRunIdOf)(sessionName) : undefined;
+        const tmuxRun = runId ? (0, tmux_liveness_js_1.liveRunIdOf)(sessionName) : undefined;
+        const live = tmuxRun ? (0, session_registry_js_1.runOfTmuxSession)(sessionName, tmuxRun) : undefined;
         if (!runId || !live || live === runId)
             return reply({ error: 'still_running' });
     }
@@ -2052,9 +2081,9 @@ const leaseFor = (renewing) => (renewing ? exports.STREAM_LEASE_MS : STREAM_MAX_
  * Live mirrors, one per (session, viewing device): every viewer keeps the whole of the machinery a
  * single viewer had — its own capture loop state, lease, nonce, epoch and seq, sealed frames — so
  * two devices watching one pane do not take each other's stream over. A viewer with no device id
- * (a web tab) shares the empty slot, one at a time, as before. The tmux pane is shared: its width
- * is whatever the last viewer to send input or `cols` asked for (pane-fit.ts), and every viewer
- * receives the pane at that width.
+ * (a web tab) shares the empty slot, one at a time, as before. The tmux pane is shared: while the
+ * phone is its latest user its width is whatever the last viewer to send input or `cols` asked for,
+ * and a desktop client used since takes it back (pane-fit.ts); every viewer receives the pane at that width.
  */
 const activeStreams = new Map();
 const streamKey = (sessionName, deviceId) => `${sessionName}\u0000${typeof deviceId === 'string' ? deviceId : ''}`;
@@ -2583,6 +2612,9 @@ const handleStreamControl = (req, send) => {
             const renewTarget = (0, tmux_pane_js_1.tmuxTargetFor)(req.sessionName);
             if (renewTarget !== null && (colsChanged || streamsOf(req.sessionName).length === 1))
                 paneFitter.fit(req.sessionName, renewTarget, req.cols);
+            // Otherwise keep the width the pane has, but still notice a desktop client used since (pane-fit.ts).
+            else
+                paneFitter.recheck(req.sessionName);
             return true;
         }
         // Addressed to us but we hold no such stream: it was reaped (lost
@@ -2624,6 +2656,8 @@ const handleStreamControl = (req, send) => {
         return true;
     }
     const fitTarget = (0, tmux_pane_js_1.tmuxTargetFor)(sessionName);
+    // Opening the mirror (or resubscribing) takes the width only from an idle desktop (pane-fit.ts).
+    paneFitter.open(sessionName);
     if (fitTarget !== null)
         paneFitter.fit(sessionName, fitTarget, req.cols);
     let lastContent = null;
@@ -3023,6 +3057,23 @@ const deliverInput = (input) => {
     // Only a reason that does not depend on the text: this input may be sealed.
     if (!injected)
         input.send(streamErrorFrame(input.sessionName, 'input_rejected', input, reason && (0, command_refusal_js_1.isSessionStateRefusal)(reason) ? reason : undefined));
+    else
+        takeWidthBack(input.sessionName, input.deviceId);
+};
+/**
+ * Typing from the phone makes it the session's latest user again (pane-fit.ts): a window a desktop
+ * client took back is sized to the sender's width once more.
+ */
+const takeWidthBack = (sessionName, deviceId) => {
+    paneFitter.claim(sessionName);
+    const viewer = activeStreams.get(streamKey(sessionName, deviceId)) ?? streamsOf(sessionName)[0];
+    // Already at the sender's width: the claim is enough, and a keystroke costs no tmux round trip (renew rechecks).
+    if (!viewer || paneFitter.fitted(sessionName, viewer.cols))
+        return;
+    const target = (0, tmux_pane_js_1.tmuxTargetFor)(sessionName);
+    if (target === null)
+        return;
+    paneFitter.fit(sessionName, target, viewer.cols);
 };
 /** Ceiling on concurrent sender lanes. The lane key includes a relay-stamped
  *  deviceId, but a relay older than the unconditional stamp lets a sender vary
@@ -3424,7 +3475,7 @@ const collectSessionsVerbose = () => {
         const agentSessionId = info.currentPath
             ? (main.agent.resolveSessionId?.(info.currentPath, info.panePid ?? undefined) ?? null)
             : null;
-        const providerSessionName = info.currentPath
+        const providerName = info.currentPath
             ? (main.agent.resolveSessionName?.(info.currentPath, info.panePid ?? undefined) ?? null)
             : null;
         if (info.currentPath)
@@ -3442,7 +3493,8 @@ const collectSessionsVerbose = () => {
             agentSessionId,
             project: parsed.project,
             label: parsed.label,
-            providerSessionName,
+            providerSessionName: providerName?.name ?? null,
+            ...(providerName?.source ? { providerSessionNameSource: providerName.source } : {}),
             createdAt: epochToIso(group.created),
             runId: (0, exports.runIdOfEpoch)(group.created),
             lastActivityAt: epochToIso(group.activity),
@@ -3566,6 +3618,7 @@ const collectSessionsVerbose = () => {
             return undefined;
         return resumeIdCount.get(id) === 1 ? id : null;
     };
+    (0, exports.continueRuns)(sessions, recordable, ownResumeId);
     // Write down what each live session IS, while it still exists to be read.
     // tmux forgets a session the moment it ends, which is exactly when the
     // phone wants it back — and a resume must take its directory and its binary
@@ -3584,6 +3637,7 @@ const collectSessionsVerbose = () => {
         label: s.label,
         runId: s.runId,
         startedAt: s.createdAt,
+        tmuxRunId: runIdOfIso(s.createdAt),
         agentSessionId: ownResumeId(s.name),
     })));
     return { sessions, rejected, targets, subagentTranscripts, recordable };
@@ -4909,6 +4963,10 @@ const streamSession = (wsUrl, apiKey) => {
                 clearInterval(commandsTimer);
                 commandsTimer = null;
             }
+            if (paneFitTimer) {
+                clearInterval(paneFitTimer);
+                paneFitTimer = null;
+            }
             if (connectTimer) {
                 clearTimeout(connectTimer);
                 connectTimer = null;
@@ -4955,6 +5013,7 @@ const streamSession = (wsUrl, apiKey) => {
         // rescan changes it. The rescan has its own slow timer — it reads the
         // filesystem, so it must never ride the 5 s session loop.
         let commandsTimer = null;
+        let paneFitTimer = null;
         // Per connection, like the inventory gate above: `sock.send` returning
         // is not delivery, and a fingerprint that outlived the socket would let
         // one lost frame leave the server's catalog stale until the user next
@@ -5131,6 +5190,8 @@ const streamSession = (wsUrl, apiKey) => {
             sessionsTimer = setInterval(() => void reportSessions(), exports.SESSION_REPORT_INTERVAL_MS);
             void reportCommands();
             commandsTimer = setInterval(reportCommands, exports.COMMAND_SCAN_INTERVAL_MS);
+            // A desktop key takes a fitted window back within a second, not at the phone's next renew (5 s).
+            paneFitTimer = setInterval(() => paneFitter.recheckAll(), PANE_FIT_RECHECK_MS);
             loopSampleAt = Date.now();
             loopMeterTimer = setInterval(() => {
                 const now = Date.now();

package/dist/mcp-command.d.ts

@@ -11,6 +11,13 @@
  */
 /** What the agents run. `hwip` resolves out of the same global bin dir as `npx`. */
 export declare const MCP_LAUNCH_ARGV: readonly ["hwip", "mcp"];
+/**
+ * Turns on the MCP server's `hwip_session_title` (mcp-server config `autoName`),
+ * so an agent with no title of its own names its session after its task. Set
+ * for Codex, Cursor, Windsurf and Gemini only: Claude Code and opencode title
+ * their sessions themselves, and the instruction would cost every turn.
+ */
+export declare const AUTONAME_ENV = "HWIP_AUTONAME";
 /**
  * `mcpServers.hwip` — what the installer writes for Cursor and Windsurf.
  * The env block is deliberate: both spawn the MCP server from a graphical
@@ -18,13 +25,15 @@ export declare const MCP_LAUNCH_ARGV: readonly ["hwip", "mcp"];
  * explicitly rather than left to inheritance.
  *
  * `hwipit/plugin`'s `.mcp.json` holds the same shape but is a HAND-KEPT COPY —
- * it lives in another repo and cannot import this. Change one, change both.
+ * it lives in another repo and cannot import this. Change one, change both —
+ * except AUTONAME_ENV, which the plugin (Claude Code) leaves out on purpose.
  */
 export declare const MCP_SERVERS_ENTRY: {
     command: "hwip";
     args: "mcp"[];
     env: {
         HWIP_API_KEY: string;
+        HWIP_AUTONAME: string;
     };
 };
 /**
@@ -42,4 +51,7 @@ export declare const OPENCODE_MCP_ENTRY: {
 export declare const GEMINI_MCP_ADD: string;
 /** Older gemini CLIs only accept `mcp add <name> -- <command…>`, with no scope flag. */
 export declare const GEMINI_MCP_ADD_LEGACY: string;
+/** The legacy form without `-e`, last: should a gemini that old refuse `-e`, the tools still load,
+ *  and `hwip verify` says auto session names are off. */
+export declare const GEMINI_MCP_ADD_BARE: string;
 //# sourceMappingURL=mcp-command.d.ts.map

package/dist/mcp-command.js

@@ -11,10 +11,17 @@
  * itself. Everything below is derived from MCP_LAUNCH_ARGV.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GEMINI_MCP_ADD_LEGACY = exports.GEMINI_MCP_ADD = exports.OPENCODE_MCP_ENTRY = exports.MCP_SERVERS_ENTRY = exports.MCP_LAUNCH_ARGV = void 0;
+exports.GEMINI_MCP_ADD_BARE = exports.GEMINI_MCP_ADD_LEGACY = exports.GEMINI_MCP_ADD = exports.OPENCODE_MCP_ENTRY = exports.MCP_SERVERS_ENTRY = exports.AUTONAME_ENV = exports.MCP_LAUNCH_ARGV = void 0;
 /** What the agents run. `hwip` resolves out of the same global bin dir as `npx`. */
 exports.MCP_LAUNCH_ARGV = ['hwip', 'mcp'];
 const [MCP_BIN, ...MCP_SUBCOMMAND] = exports.MCP_LAUNCH_ARGV;
+/**
+ * Turns on the MCP server's `hwip_session_title` (mcp-server config `autoName`),
+ * so an agent with no title of its own names its session after its task. Set
+ * for Codex, Cursor, Windsurf and Gemini only: Claude Code and opencode title
+ * their sessions themselves, and the instruction would cost every turn.
+ */
+exports.AUTONAME_ENV = 'HWIP_AUTONAME';
 /**
  * `mcpServers.hwip` — what the installer writes for Cursor and Windsurf.
  * The env block is deliberate: both spawn the MCP server from a graphical
@@ -22,12 +29,13 @@ const [MCP_BIN, ...MCP_SUBCOMMAND] = exports.MCP_LAUNCH_ARGV;
  * explicitly rather than left to inheritance.
  *
  * `hwipit/plugin`'s `.mcp.json` holds the same shape but is a HAND-KEPT COPY —
- * it lives in another repo and cannot import this. Change one, change both.
+ * it lives in another repo and cannot import this. Change one, change both —
+ * except AUTONAME_ENV, which the plugin (Claude Code) leaves out on purpose.
  */
 exports.MCP_SERVERS_ENTRY = {
     command: MCP_BIN,
     args: [...MCP_SUBCOMMAND],
-    env: { HWIP_API_KEY: '${HWIP_API_KEY}' },
+    env: { HWIP_API_KEY: '${HWIP_API_KEY}', [exports.AUTONAME_ENV]: '1' },
 };
 /**
  * opencode.json's own MCP schema — top-level `mcp` key (not `mcpServers`),
@@ -45,6 +53,11 @@ exports.OPENCODE_MCP_ENTRY = {
 // server NAME and the BINARY are both "hwip" here, so the doubled word below
 // is correct, not a copy-paste slip. Default scope is "project" (cwd-local
 // .gemini/), so user scope is pinned for a machine-wide install.
-exports.GEMINI_MCP_ADD = `gemini mcp add -s user hwip ${MCP_BIN} -- ${MCP_SUBCOMMAND.join(' ')}`;
+// `-e` lands in the entry's env. That a reinstall replaces an existing hwip entry whole, and so
+// adds the flag to it, is unverified (gemini CLI behaviour); `hwip verify` reports it if not.
+exports.GEMINI_MCP_ADD = `gemini mcp add -s user -e ${exports.AUTONAME_ENV}=1 hwip ${MCP_BIN} -- ${MCP_SUBCOMMAND.join(' ')}`;
 /** Older gemini CLIs only accept `mcp add <name> -- <command…>`, with no scope flag. */
-exports.GEMINI_MCP_ADD_LEGACY = `gemini mcp add hwip -- ${exports.MCP_LAUNCH_ARGV.join(' ')}`;
+exports.GEMINI_MCP_ADD_LEGACY = `gemini mcp add -e ${exports.AUTONAME_ENV}=1 hwip -- ${exports.MCP_LAUNCH_ARGV.join(' ')}`;
+/** The legacy form without `-e`, last: should a gemini that old refuse `-e`, the tools still load,
+ *  and `hwip verify` says auto session names are off. */
+exports.GEMINI_MCP_ADD_BARE = `gemini mcp add hwip -- ${exports.MCP_LAUNCH_ARGV.join(' ')}`;

package/dist/pane-fit.d.ts

@@ -1,18 +1,30 @@
+import { spawnSync } from 'child_process';
 /**
- * Fit a detached tmux window to the phone that is watching it.
+ * Fit a tmux window to the phone that is watching it.
  *
  * A pane is as wide as the terminal that last drew it, usually a desktop's
  * 120-odd columns. The phone mirror shows about 45, so every full-width row a
  * prompt or TUI draws (a rule, a right-aligned clock, a status line) folds into
- * two. Nobody else sees a DETACHED window, so while a phone watches one it is
- * resized to the phone's width and the program redraws to fit; when the phone
- * leaves, the old width comes back.
+ * two. So while a phone watches a window it is resized to the phone's width
+ * and the program redraws to fit; when the phone leaves, the old width comes
+ * back.
  *
- * An attached window is left alone: shrinking it would shrink the desktop
- * terminal of whoever is attached. A window split into panes is left alone
- * too, since the window width is not any one pane's width. And when a client
- * attaches while the phone is watching, the next check hands the window back
- * to tmux, which sizes it to that client.
+ * A window with a desktop client attached is shared, and whoever used it last
+ * decides its width — the rule tmux's own `window-size latest` follows. The
+ * phone uses a window when it types into it ({@link claim}); a client uses it
+ * when it attaches or a key is pressed in it, which is what
+ * `#{client_activity}` records. tmux also moves that time on a mouse move
+ * over the window and on a focus change (herdr sends one to a pane whenever
+ * another pane is clicked), which are not using it. Where the time of the
+ * desktop's last key press is known ({@link macosLastKeyAt}), a client counts
+ * as used no later than that key, or than when it attached. Opening the mirror ({@link open}) is a weaker
+ * claim: it also covers an automatic resubscribe nobody asked for, so it only
+ * takes a window whose desktop has been idle for {@link DESKTOP_IDLE_SECONDS}.
+ * While the phone is the later of the two, the
+ * window is the phone's width (the desktop terminal shows it narrower); once a
+ * client is newer, the next check hands the window back to tmux, which sizes
+ * it to that client. A window split into panes is left alone, since the
+ * window width is not any one pane's width.
  *
  * A fitted window carries its old width in `@hwip_fit_width`. A listener that
  * died without releasing (a crash, a SIGKILL) leaves that mark behind, and
@@ -24,6 +36,8 @@ export type TmuxRun = (args: string[]) => {
     stdout: string;
 };
 export declare const PANE_FIT_MIN_COLS = 20;
+/** How long a desktop client must sit idle before opening the mirror takes its window. */
+export declare const DESKTOP_IDLE_SECONDS = 60;
 export declare const PANE_FIT_MAX_COLS = 400;
 /** A viewer's column count, or null when it did not send a usable one. */
 export declare const clampViewerCols: (cols: unknown) => number | null;
@@ -32,9 +46,23 @@ export declare const clampViewerCols: (cols: unknown) => number | null;
  * restore its width when detached, then drop the manual size and the mark.
  */
 export declare const releaseStaleFits: (run: TmuxRun) => number;
-export declare const createPaneFitter: (run: TmuxRun) => {
+/** When the desktop behind the tmux client `clientPid` last pressed a key, in seconds since the epoch, or null when it cannot tell. */
+export type LastKeyAt = (clientPid: number) => number | null;
+/**
+ * The Mac's last key press, from the HID system's own clock (no Input Monitoring permission needed), read
+ * through `osascript` at most once a second and not again for half a minute after a failed read. A client
+ * that came in over SSH types on another machine, so the Mac's clock says nothing about it: null, as off macOS.
+ */
+export declare const macosLastKeyAt: (now?: () => number, spawn?: typeof spawnSync, platform?: NodeJS.Platform) => LastKeyAt;
+/** `now` is in ms, as `Date.now`; tmux reports client use in whole seconds. */
+export declare const createPaneFitter: (run: TmuxRun, now?: () => number, lastKeyAt?: LastKeyAt) => {
     fit: (session: string, target: string, cols: unknown) => void;
+    recheck: (session: string) => void;
+    recheckAll: () => void;
+    claim: (session: string) => void;
+    open: (session: string) => void;
     release: (session: string) => void;
-    fitted: (session: string) => boolean;
+    fitted: (session: string, cols?: unknown) => boolean;
+    forgetClaims: () => void;
 };
 //# sourceMappingURL=pane-fit.d.ts.map

package/dist/pane-fit.js

@@ -1,27 +1,10 @@
 "use strict";
-/**
- * Fit a detached tmux window to the phone that is watching it.
- *
- * A pane is as wide as the terminal that last drew it, usually a desktop's
- * 120-odd columns. The phone mirror shows about 45, so every full-width row a
- * prompt or TUI draws (a rule, a right-aligned clock, a status line) folds into
- * two. Nobody else sees a DETACHED window, so while a phone watches one it is
- * resized to the phone's width and the program redraws to fit; when the phone
- * leaves, the old width comes back.
- *
- * An attached window is left alone: shrinking it would shrink the desktop
- * terminal of whoever is attached. A window split into panes is left alone
- * too, since the window width is not any one pane's width. And when a client
- * attaches while the phone is watching, the next check hands the window back
- * to tmux, which sizes it to that client.
- *
- * A fitted window carries its old width in `@hwip_fit_width`. A listener that
- * died without releasing (a crash, a SIGKILL) leaves that mark behind, and
- * the next one to start gives those windows back ({@link releaseStaleFits}).
- */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createPaneFitter = exports.releaseStaleFits = exports.clampViewerCols = exports.PANE_FIT_MAX_COLS = exports.PANE_FIT_MIN_COLS = void 0;
+exports.createPaneFitter = exports.macosLastKeyAt = exports.releaseStaleFits = exports.clampViewerCols = exports.PANE_FIT_MAX_COLS = exports.DESKTOP_IDLE_SECONDS = exports.PANE_FIT_MIN_COLS = void 0;
+const child_process_1 = require("child_process");
 exports.PANE_FIT_MIN_COLS = 20;
+/** How long a desktop client must sit idle before opening the mirror takes its window. */
+exports.DESKTOP_IDLE_SECONDS = 60;
 exports.PANE_FIT_MAX_COLS = 400;
 /** A viewer's column count, or null when it did not send a usable one. */
 const clampViewerCols = (cols) => {
@@ -55,6 +38,74 @@ const releaseStaleFits = (run) => {
     return released;
 };
 exports.releaseStaleFits = releaseStaleFits;
+/**
+ * The Mac's last key press, from the HID system's own clock (no Input Monitoring permission needed), read
+ * through `osascript` at most once a second and not again for half a minute after a failed read. A client
+ * that came in over SSH types on another machine, so the Mac's clock says nothing about it: null, as off macOS.
+ */
+const macosLastKeyAt = (now = () => Date.now(), spawn = child_process_1.spawnSync, platform = process.platform) => {
+    let cached;
+    const remote = new Map();
+    const overSsh = (clientPid) => {
+        const known = remote.get(clientPid);
+        if (known !== undefined)
+            return known;
+        let found = false;
+        for (let pid = clientPid, depth = 0; pid > 1 && depth < 32; depth++) {
+            const r = spawn('ps', ['-o', 'ppid=,comm=', '-p', String(pid)], { encoding: 'utf8', timeout: 2000 });
+            const m = r.status === 0 ? /^\s*(\d+)\s+(.*)$/.exec(String(r.stdout).trim()) : null;
+            if (!m)
+                break;
+            if (/(^|\/)sshd\b/.test(m[2])) {
+                found = true;
+                break;
+            }
+            pid = Number(m[1]);
+        }
+        remote.set(clientPid, found);
+        return found;
+    };
+    const keyAt = () => {
+        const readAt = now();
+        if (cached && readAt < cached.until)
+            return cached.keyAt;
+        // kCGEventSourceStateHIDSystemState = 1, kCGEventKeyDown = 10.
+        const r = spawn('osascript', ['-l', 'JavaScript', '-e',
+            "ObjC.import('CoreGraphics'); $.CGEventSourceSecondsSinceLastEventType(1, 10)"], { encoding: 'utf8', timeout: 2000 });
+        const out = String(r.stdout ?? '').trim();
+        const idle = Number(out);
+        const read = r.status === 0 && out !== '' && Number.isFinite(idle) ? Math.floor(readAt / 1000 - idle) : null;
+        // A hung or failing osascript blocks the listener for its timeout: do not ask again soon.
+        cached = { until: now() + (read === null ? 30_000 : 1000), keyAt: read };
+        return read;
+    };
+    return (clientPid) => {
+        if (platform !== 'darwin')
+            return null;
+        if (Number.isFinite(clientPid) && overSsh(clientPid))
+            return null;
+        return keyAt();
+    };
+};
+exports.macosLastKeyAt = macosLastKeyAt;
+/** The clients on `target`'s session, or null when tmux cannot tell. */
+const readClients = (run, target) => {
+    const r = run(['list-clients', '-t', target, '-F', `#{client_activity}${SEP}#{client_created}${SEP}#{client_pid}`]);
+    if (r.status !== 0)
+        return null;
+    return r.stdout.split('\n').filter(Boolean).flatMap((line) => {
+        const [activity, created, pid] = line.split(SEP).map(Number);
+        return Number.isFinite(activity) ? [{ activity, created: Number.isFinite(created) ? created : 0, pid }] : [];
+    });
+};
+/**
+ * When a client was last used (seconds). With the desktop's key clock, its activity counts only up to the last
+ * key press, or when it attached: a mouse move or focus change after the last key is not use.
+ */
+const clientUse = (client, lastKeyAt) => {
+    const keyAt = lastKeyAt(client.pid);
+    return keyAt === null ? client.activity : Math.max(Math.min(client.activity, keyAt), client.created);
+};
 const readWindow = (run, target) => {
     const r = run(['display-message', '-p', '-t', target,
         `#{session_attached}${SEP}#{window_panes}${SEP}#{window_width}`]);
@@ -65,15 +116,30 @@ const readWindow = (run, target) => {
         return null;
     return { attached, panes, width };
 };
-const createPaneFitter = (run) => {
+/** `now` is in ms, as `Date.now`; tmux reports client use in whole seconds. */
+const createPaneFitter = (run, now = () => Date.now(), lastKeyAt = () => null) => {
     const fits = new Map();
+    /** When the phone last typed into and last opened each session, in tmux's seconds. */
+    const claims = new Map();
+    const seconds = () => Math.floor(now() / 1000);
+    /** The phone typed into `session` just now: it is the latest user until a client is used after it. */
+    const claim = (session) => {
+        claims.set(session, { ...claims.get(session), typedAt: seconds() });
+    };
+    /**
+     * The phone opened the mirror of `session` just now: it takes the window once the desktop is idle. The time
+     * the phone last typed is kept: a reconnect is not a reason to hand an untouched desktop its width back.
+     */
+    const open = (session) => {
+        claims.set(session, { ...claims.get(session), openedAt: seconds() });
+    };
     /**
      * Give the window back: restore its width if nobody is attached, then drop
      * the manual size `resize-window` set, so the next client to attach sizes
      * it again. With a client attached, dropping the option alone resizes it to
      * that client.
      */
-    const release = (session) => {
+    const unfit = (session) => {
         const fit = fits.get(session);
         if (!fit)
             return;
@@ -85,9 +151,50 @@ const createPaneFitter = (run) => {
         run(['set-option', '-w', '-u', '-t', fit.target, FIT_MARK]);
     };
     /**
-     * Size `session`'s window to `cols` if it is detached and unsplit. Safe to
-     * call on every renew: an unchanged width costs one display-message, and a
-     * window that gained a client since is released.
+     * The window is not the phone's to size: it is split, or an attached client was used at or after the
+     * phone's claim, or — when the phone only opened the mirror — within the last {@link DESKTOP_IDLE_SECONDS}.
+     * A tie goes to the desktop: tmux counts in whole seconds, and shrinking a terminal in use is the worse mistake.
+     */
+    const notOurs = (session, target, win) => {
+        if (win.panes !== 1)
+            return true;
+        if (win.attached === 0)
+            return false;
+        const clients = readClients(run, target);
+        if (!clients || clients.length === 0)
+            return true;
+        const claimed = claims.get(session);
+        const desktops = (use) => {
+            const typedSince = claimed?.typedAt !== undefined && use < claimed.typedAt;
+            const openedOnIdle = claimed?.openedAt !== undefined && use < claimed.openedAt
+                && seconds() - use >= exports.DESKTOP_IDLE_SECONDS;
+            return !typedSince && !openedOnIdle;
+        };
+        // A use is never later than the raw activity: when that already leaves the window to the phone, the key
+        // clock (an osascript on macOS) is not read.
+        if (!desktops(Math.max(...clients.map((c) => c.activity))))
+            return false;
+        return desktops(Math.max(...clients.map((c) => clientUse(c, lastKeyAt))));
+    };
+    /**
+     * The phone left: give the window back. When it typed, that is kept: the phone comes and goes (a screen
+     * locks, the app is left a moment, the mirror resubscribes), and on its return it is still the latest user
+     * unless the desktop was used since — the same test a renew applies.
+     */
+    const release = (session) => {
+        const typedAt = claims.get(session)?.typedAt;
+        if (typedAt === undefined)
+            claims.delete(session);
+        else
+            claims.set(session, { typedAt });
+        unfit(session);
+    };
+    /**
+     * Size `session`'s window to `cols` if it is unsplit and the phone used it
+     * after every attached client. Safe to call on every renew: an unchanged
+     * width costs one display-message (and one list-clients when attached), and
+     * a window a client used since is handed back. The first call for a session
+     * counts as opening the mirror when nothing claimed it yet.
      */
     const fit = (session, target, cols) => {
         const want = (0, exports.clampViewerCols)(cols);
@@ -97,9 +204,12 @@ const createPaneFitter = (run) => {
         if (!win)
             return;
         const held = fits.get(session);
-        if (win.attached > 0 || win.panes !== 1) {
+        if (!claims.has(session))
+            open(session);
+        if (notOurs(session, target, win)) {
+            // Only the fit goes: the claim stays, so the desktop keeps the window until the phone uses it again.
             if (held)
-                release(session);
+                unfit(session);
             return;
         }
         if (held && held.cols === want && win.width === want)
@@ -114,6 +224,29 @@ const createPaneFitter = (run) => {
         }
         fits.set(session, { target, width, cols: want });
     };
-    return { fit, release, fitted: (session) => fits.has(session) };
+    /** Hand a held window back if a client was used since or it was split, without touching its width otherwise. */
+    const recheck = (session) => {
+        const held = fits.get(session);
+        if (!held)
+            return;
+        const win = readWindow(run, held.target);
+        if (win && notOurs(session, held.target, win))
+            unfit(session);
+    };
+    /** {@link recheck} every fitted window: a desktop key is answered within a tick, not a renew. */
+    const recheckAll = () => {
+        for (const session of [...fits.keys()])
+            recheck(session);
+    };
+    /** Whether `session`'s window is fitted — at `cols`, when given. */
+    const fitted = (session, cols) => {
+        const held = fits.get(session);
+        if (!held)
+            return false;
+        return cols === undefined || held.cols === (0, exports.clampViewerCols)(cols);
+    };
+    /** Test hook: forget every claim, as a new listener starts with none. */
+    const forgetClaims = () => claims.clear();
+    return { fit, recheck, recheckAll, claim, open, release, fitted, forgetClaims };
 };
 exports.createPaneFitter = createPaneFitter;