@longleash/cli 0.1.0-rc.1 → 0.1.0-rc.11

package/runtime/daemon/bin/longleashd.mjs

@@ -7,8 +7,8 @@ var __export = (target, all) => {
 
 // ../daemon/bin/longleashd.ts
 import { existsSync as existsSync7 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { dirname as dirname4, join as join8, resolve as resolve5 } from "node:path";
+import { homedir as homedir5 } from "node:os";
+import { dirname as dirname4, join as join10, resolve as resolve6 } from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../daemon/src/daemon.ts
@@ -44,8 +44,8 @@ async function pauseCurrentSessionOwner(managed, external, session, actor, reaso
 }
 
 // ../daemon/src/daemon.ts
-import { homedir as homedir3 } from "node:os";
-import { delimiter, join as join6, resolve as resolve4 } from "node:path";
+import { homedir as homedir4 } from "node:os";
+import { delimiter, join as join7, resolve as resolve5 } from "node:path";
 
 // ../daemon/src/eventlog.ts
 import Database from "better-sqlite3";
@@ -5432,7 +5432,10 @@ var SessionOrigin = external_exports.enum(["phone", "daemon", "terminal", "vscod
 var WorkspaceMode = external_exports.enum(["auto", "shared", "isolated"]);
 var AgentEffort = external_exports.enum(["low", "medium", "high", "xhigh", "max"]);
 var ThinkingMode = external_exports.enum(["adaptive", "disabled", "fixed"]);
+var SessionMode = external_exports.enum(["manual", "auto", "plan"]);
 var SessionSettings = external_exports.object({
+  /** Omitted means LongLeash's conservative manual mode. */
+  mode: SessionMode.optional(),
   /** Omitted means the provider's current default; model ids never enter a shell command. */
   model: external_exports.string().trim().min(1).max(120).optional(),
   effort: AgentEffort.optional(),
@@ -5493,6 +5496,10 @@ var sessionStartedPayload = external_exports.object({
   origin: SessionOrigin.optional(),
   /** Who owns the process now; unlike origin, this changes after a safe handoff. */
   controller: external_exports.enum(["longleash", "external"]).optional(),
+  /** Where the process is controlled now; origin remains its historical birthplace. */
+  surface: SessionOrigin.optional(),
+  /** Observation-only means the native surface is visible but has not exposed process control. */
+  control: external_exports.enum(["full", "observe"]).optional(),
   /**
    * The agent's own conversation id. Carried to the phone so a person can pick the
    * SAME conversation back up at their keyboard — `claude --resume <id>` in the
@@ -5526,6 +5533,10 @@ var sessionStatusPayload = external_exports.object({
   /** LongLeash's own gate for this session: whether it should page the phone at all. */
   gate: SessionGate.optional(),
   controller: external_exports.enum(["longleash", "external"]).optional(),
+  /** Current UI/process surface after a handoff. */
+  surface: SessionOrigin.optional(),
+  /** Observation-only sessions are never presented as remotely stoppable or writable. */
+  control: external_exports.enum(["full", "observe"]).optional(),
   /** Current overrides. An empty object explicitly means provider defaults. */
   settings: SessionSettings.optional(),
   /** A second writer was observed in this checkout; text accompanies color for accessibility. */
@@ -5540,6 +5551,13 @@ var streamDeltaPayload = external_exports.object({
   kind: external_exports.enum(["text", "tool", "thinking", "user"]),
   text: external_exports.string()
 }).passthrough();
+var transcriptResetPayload = external_exports.object({
+  reason: external_exports.enum(["provider-snapshot", "recovery"]),
+  blocks: external_exports.array(external_exports.object({
+    kind: external_exports.enum(["text", "tool", "thinking", "user"]),
+    text: external_exports.string().max(12e4)
+  }).strict()).max(80).optional()
+}).passthrough();
 var QuestionOption = external_exports.object({
   label: external_exports.string().min(1),
   description: external_exports.string().default(""),
@@ -5599,6 +5617,7 @@ function event(type, payload) {
 var SessionEventSchema = external_exports.discriminatedUnion("type", [
   event("session.started", sessionStartedPayload),
   event("session.status", sessionStatusPayload),
+  event("session.transcript.reset", transcriptResetPayload),
   event("stream.delta", streamDeltaPayload),
   event("approval.requested", approvalRequestedPayload),
   event("approval.decided", approvalDecidedPayload),
@@ -5614,7 +5633,9 @@ var subscribeMessage = external_exports.object({
   ...clientBase,
   type: external_exports.literal("subscribe"),
   sessionId: external_exports.string().min(1),
-  fromCursor: external_exports.number().int().nonnegative()
+  fromCursor: external_exports.number().int().nonnegative(),
+  /** Optional replay barrier. New clients use the echoed id to paint catch-up only once. */
+  syncId: external_exports.string().min(1).max(120).optional()
 }).passthrough();
 var decisionMessage = external_exports.object({
   ...clientBase,
@@ -5700,6 +5721,20 @@ var takeOverMessage = external_exports.object({
   sessionId: external_exports.string().min(1),
   text: external_exports.string().min(1)
 }).passthrough();
+var reclaimSessionMessage = external_exports.object({
+  ...clientBase,
+  type: external_exports.literal("reclaimSession"),
+  sessionId: external_exports.string().min(1)
+}).passthrough();
+var renameSessionMessage = external_exports.object({
+  ...clientBase,
+  type: external_exports.literal("renameSession"),
+  sessionId: external_exports.string().min(1),
+  title: external_exports.string().trim().min(1).max(80).refine(
+    (value) => value.replace(/[\u0000-\u001f\u007f]/g, "").trim().length > 0,
+    "A session name needs visible text."
+  )
+}).passthrough();
 var previewDelegationMessage = external_exports.object({
   ...clientBase,
   type: external_exports.literal("previewDelegation"),
@@ -5842,6 +5877,8 @@ var ClientMessageSchema = external_exports.discriminatedUnion("type", [
   pushUnsubscribeMessage,
   pushTestMessage,
   takeOverMessage,
+  reclaimSessionMessage,
+  renameSessionMessage,
   setGateMessage,
   previewDelegationMessage,
   startDelegationMessage,
@@ -5859,6 +5896,7 @@ var EventLog = class {
   insertStmt;
   maxSeqStmt;
   minSeqStmt;
+  latestTsStmt;
   selectFromStmt;
   pruneStmt;
   constructor(path, opts = {}) {
@@ -5874,7 +5912,12 @@ var EventLog = class {
         type TEXT NOT NULL,
         payload TEXT NOT NULL,
         PRIMARY KEY (session_id, seq)
-      )
+      );
+      CREATE TABLE IF NOT EXISTS session_aliases (
+        session_id TEXT PRIMARY KEY,
+        title TEXT NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
     `);
     this.now = opts.now ?? Date.now;
     this.insertStmt = this.rawDb.prepare(
@@ -5886,6 +5929,9 @@ var EventLog = class {
     this.minSeqStmt = this.rawDb.prepare(
       "SELECT COALESCE(MIN(seq), 0) AS seq FROM events WHERE session_id = ?"
     );
+    this.latestTsStmt = this.rawDb.prepare(
+      "SELECT COALESCE(MAX(ts), 0) AS ts FROM events WHERE session_id = ?"
+    );
     this.selectFromStmt = this.rawDb.prepare(
       "SELECT * FROM events WHERE session_id = ? AND seq > ? ORDER BY seq ASC"
     );
@@ -5940,6 +5986,19 @@ var EventLog = class {
   latestSeq(sessionId) {
     return this.maxSeqStmt.get(sessionId).seq;
   }
+  latestTimestamp(sessionId) {
+    return this.latestTsStmt.get(sessionId).ts;
+  }
+  aliasFor(sessionId) {
+    const row = this.rawDb.prepare("SELECT title FROM session_aliases WHERE session_id = ?").get(sessionId);
+    return row?.title;
+  }
+  setAlias(sessionId, title) {
+    this.rawDb.prepare(
+      `INSERT INTO session_aliases (session_id, title, updated_at) VALUES (?, ?, ?)
+         ON CONFLICT(session_id) DO UPDATE SET title = excluded.title, updated_at = excluded.updated_at`
+    ).run(sessionId, title, this.now());
+  }
   pruneBefore(sessionId, uptoExclusive) {
     this.pruneStmt.run(sessionId, uptoExclusive);
   }
@@ -6668,13 +6727,13 @@ function workspaceFromRow(row) {
 }
 var newId = (prefix) => `${prefix}_${randomBytes2(9).toString("base64url")}`;
 function settlesWithin(promise, timeoutMs) {
-  return new Promise((resolve6) => {
+  return new Promise((resolve7) => {
     let settled = false;
     const finish = (value) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve6(value);
+      resolve7(value);
     };
     const timer = setTimeout(() => finish(false), timeoutMs);
     timer.unref?.();
@@ -7093,6 +7152,26 @@ var SessionManager = class {
       };
     });
   }
+  /** Find the stable LongLeash card that already owns this provider conversation id. */
+  sessionIdForAgentSession(agentSessionId) {
+    const row = this.approvals.rawDb.prepare("SELECT session_id FROM sessions WHERE agent_session_id = ? ORDER BY started_at DESC LIMIT 1").get(agentSessionId);
+    return row?.session_id;
+  }
+  /** Persist a human label independently of whatever title a provider derives later. */
+  renameSession(sessionId, title, emit = true) {
+    const changed = this.approvals.rawDb.prepare("UPDATE sessions SET title = ? WHERE session_id = ?").run(title, sessionId).changes;
+    if (changed === 0) return false;
+    const live = this.sessions.get(sessionId);
+    if (live !== void 0) live.title = title;
+    this.eventLog.setAlias(sessionId, title);
+    if (emit) {
+      this.emit(sessionId, {
+        type: "session.status",
+        payload: { status: live?.status ?? "waiting", live: live !== void 0, title }
+      });
+    }
+    return true;
+  }
   /**
    * Adopt a finished TERMINAL session so a phone reply can wake it: the
    * conversation lives in Claude Code's own storage, keyed by its resume id,
@@ -7609,7 +7688,7 @@ var SessionManager = class {
     this.approvals.rawDb.prepare("DELETE FROM session_deliveries WHERE delivery_id = ?").run(deliveryId);
   }
   releasePending(session, message) {
-    for (const [approvalId, resolve6] of session.waiting) {
+    for (const [approvalId, resolve7] of session.waiting) {
       const decided = this.approvals.decide(approvalId, "denied", "system:session-ended", message);
       if (decided) {
         this.emit(session.sessionId, {
@@ -7622,7 +7701,7 @@ var SessionManager = class {
           }
         });
       }
-      resolve6({ behavior: "deny", message });
+      resolve7({ behavior: "deny", message });
     }
     session.waiting.clear();
   }
@@ -7643,9 +7722,9 @@ var SessionManager = class {
   waitForApproval(sessionId) {
     const alreadyPending = this.approvals.listPending().some((a) => a.sessionId === sessionId);
     if (alreadyPending) return Promise.resolve();
-    return new Promise((resolve6) => {
+    return new Promise((resolve7) => {
       const waiters = this.approvalWaiters.get(sessionId) ?? [];
-      waiters.push(resolve6);
+      waiters.push(resolve7);
       this.approvalWaiters.set(sessionId, waiters);
     });
   }
@@ -7694,8 +7773,8 @@ var SessionManager = class {
         outsideRoot
       }
     });
-    const decision = new Promise((resolve6) => {
-      waiting.set(approvalId, resolve6);
+    const decision = new Promise((resolve7) => {
+      waiting.set(approvalId, resolve7);
     });
     for (const waiter of this.approvalWaiters.get(sessionId) ?? []) waiter();
     this.approvalWaiters.delete(sessionId);
@@ -7864,6 +7943,7 @@ var ExternalSessions = class {
   stopTimeoutMs;
   onEnded;
   workspace;
+  resolveSessionId;
   unsubscribeWorkspace;
   constructor(opts) {
     this.eventLog = opts.eventLog;
@@ -7883,6 +7963,7 @@ var ExternalSessions = class {
     this.waitForExit = opts.waitForExit ?? ((pid, timeoutMs) => this.pollForExit(pid, timeoutMs));
     this.onEnded = opts.onEnded;
     this.workspace = opts.workspace;
+    this.resolveSessionId = opts.resolveSessionId;
     this.unsubscribeWorkspace = this.workspace?.subscribe(() => this.reconcileWorkspace());
     for (const orphan of this.approvals.closeOrphans(
       "The daemon restarted; this was answered in the terminal."
@@ -7906,6 +7987,38 @@ var ExternalSessions = class {
   hasLiveSession(sessionId) {
     return [...this.sessions.values()].some((session) => session.sessionId === sessionId);
   }
+  renameSession(sessionId, title) {
+    const entry = [...this.sessions.entries()].find(([, session2]) => session2.sessionId === sessionId);
+    if (entry === void 0) return false;
+    const [agentSessionId, session] = entry;
+    session.title = title;
+    session.named = true;
+    this.eventLog.setAlias(sessionId, title);
+    this.persist(agentSessionId, session);
+    this.emit(sessionId, {
+      type: "session.status",
+      payload: {
+        status: session.status,
+        live: true,
+        title,
+        controller: "external",
+        control: session.observedOnly ? "observe" : "full",
+        surface: session.surface
+      }
+    });
+    return true;
+  }
+  /**
+   * End a native writer so the same conversation can be parked on the phone.
+   * Observation-only sessions have no authenticated PID and are never remotely terminated.
+   */
+  async reclaimToPhone(externalSessionId, decidedBy) {
+    const session = [...this.sessions.values()].find((item) => item.sessionId === externalSessionId);
+    if (session === void 0) return "not-found";
+    if (session.observedOnly) return "observe-only";
+    if (session.pid === null) return "unverified";
+    return await this.stop(externalSessionId, decidedBy) ? "reclaimed" : "unverified";
+  }
   /**
    * Take back the sessions a previous run was watching.
    *
@@ -7934,7 +8047,7 @@ var ExternalSessions = class {
         transcriptPath: row.transcriptPath,
         status: "running",
         startedAt: row.startedAt,
-        title: row.title,
+        title: this.eventLog.aliasFor(row.sessionId) ?? row.title,
         pid: row.pid,
         named: true,
         permissionMode: null,
@@ -7943,7 +8056,8 @@ var ExternalSessions = class {
         offset: existsSync(row.transcriptPath) ? statSync(row.transcriptPath).size : 0,
         remainder: "",
         timer: null,
-        suspended: false
+        suspended: false,
+        observedOnly: false
       };
       this.sessions.set(row.agentSessionId, session);
       this.claimWorkspace(session);
@@ -7951,7 +8065,13 @@ var ExternalSessions = class {
       session.timer.unref?.();
       this.emit(session.sessionId, {
         type: "session.status",
-        payload: { status: "running", live: true }
+        payload: {
+          status: "running",
+          live: true,
+          controller: "external",
+          control: "full",
+          surface: session.surface
+        }
       });
     }
   }
@@ -7964,6 +8084,39 @@ var ExternalSessions = class {
     }
     this.claimWorkspace(session);
   }
+  /** Adopt a Codex transcript observed after startup, including sessions older than the hooks. */
+  observeCodexSession(info) {
+    const session = this.ensure(info.sessionId, info.cwd, info.transcriptPath, "codex", info.surface, true);
+    const alias = this.eventLog.aliasFor(session.sessionId);
+    const nextTitle = alias ?? info.title;
+    if (nextTitle !== void 0 && nextTitle !== session.title) {
+      session.named = true;
+      session.title = nextTitle;
+      this.persist(info.sessionId, session);
+    }
+    if (session.observedOnly && session.observedFingerprint === void 0) {
+      session.observedFingerprint = JSON.stringify(info.snapshot);
+      this.emit(session.sessionId, {
+        type: "session.transcript.reset",
+        payload: { reason: "provider-snapshot", blocks: info.snapshot }
+      });
+    }
+    this.emit(session.sessionId, {
+      type: "session.status",
+      payload: {
+        status: session.status,
+        live: true,
+        controller: "external",
+        control: session.observedOnly ? "observe" : "full",
+        ...nextTitle === void 0 ? {} : { title: nextTitle }
+      }
+    });
+    if (session.observedOnly) {
+      if (session.workspaceConflict !== void 0) delete session.workspaceConflict;
+    } else {
+      this.claimWorkspace(session);
+    }
+  }
   /**
    * Stop a terminal session from the phone — for real. The recorded pid is only
    * trusted after re-verifying it still belongs to a claude process, because PIDs
@@ -7973,6 +8126,7 @@ var ExternalSessions = class {
     const entry = [...this.sessions.entries()].find(([, s]) => s.sessionId === externalSessionId);
     if (!entry) return false;
     const [claudeSessionId, session] = entry;
+    if (session.observedOnly) return false;
     if (session.pid === null || !this.isClaudeProcess(session.pid)) {
       this.emit(session.sessionId, {
         type: "stream.delta",
@@ -8055,7 +8209,7 @@ var ExternalSessions = class {
     const deadline = Date.now() + timeoutMs;
     while (Date.now() < deadline) {
       if (!this.isClaudeProcess(pid)) return true;
-      await new Promise((resolve6) => setTimeout(resolve6, 50));
+      await new Promise((resolve7) => setTimeout(resolve7, 50));
     }
     return !this.isClaudeProcess(pid);
   }
@@ -8063,7 +8217,7 @@ var ExternalSessions = class {
    * A tool wants to run in the terminal. Returns what the hook should tell
    * Claude Code — and "ask" always means "behave as if we were never here".
    */
-  preToolUse(claudeSessionId, cwd, transcriptPath, toolName, toolInput, permissionMode, opts = {}) {
+  preToolUse(claudeSessionId, cwd, transcriptPath, toolName, toolInput, permissionMode2, opts = {}) {
     const { dedupeKey, agent = "claude", surface = "terminal", abandoned, enforceWorkspace } = opts;
     const session = this.ensure(claudeSessionId, cwd, transcriptPath, agent, surface);
     if (enforceWorkspace === true && session.workspaceConflict !== void 0) {
@@ -8080,11 +8234,11 @@ var ExternalSessions = class {
     if (session.gate === "auto") {
       return Promise.resolve({ decision: "allow", reason: "Auto-approved: you muted this session." });
     }
-    if (permissionMode !== void 0 && permissionMode !== session.permissionMode) {
-      session.permissionMode = permissionMode;
+    if (permissionMode2 !== void 0 && permissionMode2 !== session.permissionMode) {
+      session.permissionMode = permissionMode2;
       this.emit(session.sessionId, {
         type: "session.status",
-        payload: { status: session.status, live: true, permissionMode }
+        payload: { status: session.status, live: true, permissionMode: permissionMode2 }
       });
     }
     const who = this.audience();
@@ -8119,7 +8273,7 @@ var ExternalSessions = class {
         ...questions === null ? {} : { questions }
       }
     });
-    const pending = new Promise((resolve6) => {
+    const pending = new Promise((resolve7) => {
       const timer = setTimeout(() => {
         this.waiting.delete(approvalId);
         this.approvals.decide(
@@ -8137,11 +8291,11 @@ var ExternalSessions = class {
             reply: "Answered in the terminal instead."
           }
         });
-        resolve6({ decision: "ask", reason: "No answer from the phone; deciding in the terminal." });
+        resolve7({ decision: "ask", reason: "No answer from the phone; deciding in the terminal." });
       }, holdMs);
       timer.unref?.();
       this.waiting.set(approvalId, {
-        resolve: resolve6,
+        resolve: resolve7,
         timer,
         sessionId: session.sessionId,
         ...questions === null ? {} : { questions }
@@ -8258,7 +8412,7 @@ var ExternalSessions = class {
   /** Mute or unmute a session from the phone. Returns false for a session it does not know. */
   setGate(externalSessionId, gate) {
     const session = [...this.sessions.values()].find((s) => s.sessionId === externalSessionId);
-    if (!session) return false;
+    if (!session || session.observedOnly) return false;
     session.gate = gate;
     this.emit(session.sessionId, {
       type: "session.status",
@@ -8311,11 +8465,13 @@ var ExternalSessions = class {
       resumeId: claudeSessionId,
       gate: session.gate,
       controller: "external",
+      control: session.observedOnly ? "observe" : "full",
       ...session.workspaceConflict === void 0 ? {} : { workspaceConflict: session.workspaceConflict }
     }));
   }
   /** Write this session down so a restart can take it back. */
   persist(agentSessionId, session) {
+    if (session.observedOnly) return;
     this.registry?.remember({
       agentSessionId,
       sessionId: session.sessionId,
@@ -8367,12 +8523,34 @@ var ExternalSessions = class {
     this.sessions.clear();
   }
   /* ------------------------------------------------------------------ internals */
-  ensure(claudeSessionId, cwd, transcriptPath, agent = "claude", surface = "terminal") {
+  ensure(claudeSessionId, cwd, transcriptPath, agent = "claude", surface = "terminal", tailOnly = false) {
     const existing = this.sessions.get(claudeSessionId);
-    if (existing) return existing;
-    const sessionId = `ext_${claudeSessionId}`;
+    if (existing) {
+      if (!tailOnly && existing.observedOnly) {
+        existing.observedOnly = false;
+        this.persist(claudeSessionId, existing);
+        this.emit(existing.sessionId, {
+          type: "session.status",
+          payload: {
+            status: existing.status,
+            live: true,
+            controller: "external",
+            control: "full",
+            surface: existing.surface
+          }
+        });
+        if (existing.timer === null) {
+          existing.timer = setInterval(() => this.drain(existing), this.pollMs);
+          existing.timer.unref?.();
+          this.drain(existing);
+        }
+      }
+      return existing;
+    }
+    const sessionId = this.resolveSessionId?.(claudeSessionId) ?? `ext_${claudeSessionId}`;
     const replay = this.eventLog.replay(sessionId, 0);
     const hasHistory = replay.gap === false ? replay.events.length > 0 : true;
+    const alias = this.eventLog.aliasFor(sessionId);
     const session = {
       sessionId,
       agent,
@@ -8381,15 +8559,16 @@ var ExternalSessions = class {
       transcriptPath,
       status: "running",
       startedAt: this.now(),
-      title: `${basename3(cwd)} \u2014 ${surface === "vscode" ? "VS Code" : AGENT_LABEL[agent]}`,
+      title: alias ?? `${basename3(cwd)} \u2014 ${surface === "vscode" ? "VS Code" : AGENT_LABEL[agent]}`,
       pid: null,
-      named: false,
+      named: alias !== void 0,
       permissionMode: null,
       gate: "ask",
-      offset: hasHistory && existsSync(transcriptPath) ? statSync(transcriptPath).size : 0,
+      offset: (tailOnly || hasHistory) && existsSync(transcriptPath) ? statSync(transcriptPath).size : 0,
       remainder: "",
       timer: null,
-      suspended: false
+      suspended: false,
+      observedOnly: tailOnly
     };
     this.sessions.set(claudeSessionId, session);
     this.persist(claudeSessionId, session);
@@ -8402,13 +8581,21 @@ var ExternalSessions = class {
           title: session.title,
           origin: surface,
           controller: "external",
+          control: tailOnly ? "observe" : "full",
+          surface,
           resumeId: claudeSessionId
         }
       });
     }
     this.emit(sessionId, {
       type: "session.status",
-      payload: { status: "running", live: true, controller: "external" }
+      payload: {
+        status: "running",
+        live: true,
+        controller: "external",
+        control: tailOnly ? "observe" : "full",
+        surface
+      }
     });
     session.timer = setInterval(() => this.drain(session), this.pollMs);
     session.timer.unref?.();
@@ -8417,7 +8604,9 @@ var ExternalSessions = class {
   }
   /** Retry claims after startup reconciliation released dead managed-session ownership. */
   reconcileWorkspace() {
-    for (const session of this.sessions.values()) this.claimWorkspace(session);
+    for (const session of this.sessions.values()) {
+      if (!session.observedOnly) this.claimWorkspace(session);
+    }
   }
   claimWorkspace(session) {
     if (this.workspace === void 0 || session.cwd.trim() === "") return;
@@ -8636,6 +8825,9 @@ var RelayLink = class {
   reconnectTimer = null;
   keepaliveTimer = null;
   keepaliveMs;
+  /** WebCrypto promises may resolve out of order; preserve the server's event order explicitly. */
+  outbound = Promise.resolve();
+  inbound = Promise.resolve();
   constructor(opts) {
     this.opts = opts;
     this.log = opts.log ?? (() => {
@@ -8672,10 +8864,12 @@ var RelayLink = class {
     const socket = this.socket;
     const identity = this.identity;
     if (this.currentStatus !== "connected" || !socket || !identity) return;
-    void seal(identity, plaintext).then((payload) => {
-      if (socket.readyState === WebSocket.OPEN) {
+    this.outbound = this.outbound.then(async () => {
+      const payload = await seal(identity, plaintext);
+      if (this.socket === socket && socket.readyState === WebSocket.OPEN) {
         socket.send(JSON.stringify({ v: 1, type: "frame", payload }));
       }
+    }).catch(() => {
     });
   }
   async connect() {
@@ -8714,9 +8908,12 @@ var RelayLink = class {
         return;
       }
       if (message.type === "frame" && typeof message.payload === "string") {
-        void open(identity, message.payload).then((plaintext) => {
+        const payload = message.payload;
+        this.inbound = this.inbound.then(async () => {
+          const plaintext = await open(identity, payload);
           if (plaintext !== null) this.opts.onMessage(plaintext);
           else this.log("dropped a relay frame that failed to open");
+        }).catch(() => {
         });
         return;
       }
@@ -9958,6 +10155,7 @@ var LongLeashServer = class {
   external = null;
   delegations = null;
   hookSecret = null;
+  localPairing = null;
   staticRoot;
   /** Captured at process start so updating files on disk cannot impersonate a daemon restart. */
   expectedBuild;
@@ -10085,6 +10283,15 @@ var LongLeashServer = class {
       this.log(`device ${deviceId} revoked \u2014 its sessions are closed and its relay room is shut`);
       return { revoked: true, deviceId };
     });
+    this.app.post("/local/pairing", async (request, reply) => {
+      if (!localOnly(request)) return reply.code(401).send({ reason: "unauthorized" });
+      if (this.localPairing === null) return reply.code(503).send({ reason: "pairing-unavailable" });
+      try {
+        return { url: this.localPairing() };
+      } catch {
+        return reply.code(503).send({ reason: "pairing-failed" });
+      }
+    });
     this.app.get("/pair", async (_request, reply) => reply.code(405).send({ reason: "use-post" }));
     this.app.post("/pair", async (request, reply) => {
       const query2 = request.query;
@@ -10190,15 +10397,15 @@ var LongLeashServer = class {
    */
   async rebind(host) {
     const wanted = this.boundPort;
-    await new Promise((resolve6) => this.app.server.close(() => resolve6()));
-    const tryListen = (port) => new Promise((resolve6, reject) => {
+    await new Promise((resolve7) => this.app.server.close(() => resolve7()));
+    const tryListen = (port) => new Promise((resolve7, reject) => {
       const onError = (err) => {
         this.app.server.removeListener("listening", onListening);
         reject(err);
       };
       const onListening = () => {
         this.app.server.removeListener("error", onError);
-        resolve6();
+        resolve7();
       };
       this.app.server.once("error", onError);
       this.app.server.once("listening", onListening);
@@ -10223,6 +10430,10 @@ var LongLeashServer = class {
     this.external = external;
     this.hookSecret = hookSecret;
   }
+  /** A laptop-local CLI may request a transient QR without persisting its secret in service logs. */
+  attachLocalPairing(create) {
+    this.localPairing = create;
+  }
   /** Persist an event, then fan it out to every subscriber of that session. */
   publish(sessionId, input) {
     const event2 = this.eventLog.append(sessionId, input);
@@ -10333,6 +10544,9 @@ var LongLeashServer = class {
   }
   /** Tell the client what it may do, so it never has to guess a project path. */
   sendHello(connection) {
+    const bySession = new Map(
+      [...this.sessions?.listSessions() ?? [], ...this.external?.listSessions() ?? []].map((session) => [session.sessionId, session])
+    );
     this.sendTo(connection, {
       v: PROTOCOL_VERSION,
       type: "hello",
@@ -10340,7 +10554,11 @@ var LongLeashServer = class {
       roots: this.sessions?.listAllowedRoots() ?? [],
       // Everything the daemon knows about, so a reloaded phone rebuilds instead of showing
       // nothing — including sessions the human started in a terminal.
-      sessions: [...this.sessions?.listSessions() ?? [], ...this.external?.listSessions() ?? []],
+      sessions: [...bySession.values()].map((session) => ({
+        ...session,
+        title: this.eventLog.aliasFor(session.sessionId) ?? session.title,
+        lastActivityAt: this.eventLog.latestTimestamp(session.sessionId) || session.startedAt
+      })).sort((left, right) => left.startedAt - right.startedAt || left.sessionId.localeCompare(right.sessionId)),
       capabilities: {
         startSession: this.sessions !== null,
         stopSession: this.sessions !== null,
@@ -10418,6 +10636,15 @@ var LongLeashServer = class {
         return;
       }
       for (const event2 of replay.events) this.sendTo(connection, event2);
+      if (message.syncId !== void 0) {
+        this.sendTo(connection, {
+          v: PROTOCOL_VERSION,
+          type: "sync.complete",
+          sessionId: message.sessionId,
+          syncId: message.syncId,
+          cursor: this.eventLog.latestSeq(message.sessionId)
+        });
+      }
       return;
     }
     if (message.type === "pushSubscribe") {
@@ -10703,8 +10930,60 @@ var LongLeashServer = class {
       });
       return;
     }
+    if (message.type === "renameSession") {
+      const title = message.title.replace(/[\u0000-\u001f\u007f]/g, " ").replace(/\s+/g, " ").trim();
+      const externalRenamed = this.external?.renameSession(message.sessionId, title) === true;
+      const managedRenamed = this.sessions.renameSession(message.sessionId, title, !externalRenamed);
+      const renamed = externalRenamed || managedRenamed;
+      this.log(`rename ${message.sessionId} -> ${renamed ? "renamed" : "unknown"}`);
+      this.sendTo(connection, {
+        v: PROTOCOL_VERSION,
+        type: "ack",
+        of: "renameSession",
+        sessionId: message.sessionId,
+        outcome: renamed ? "renamed" : "unknown-session"
+      });
+      if (!renamed) {
+        this.sendTo(connection, {
+          v: PROTOCOL_VERSION,
+          type: "error",
+          code: "unknown-session",
+          message: "This conversation is no longer known to the laptop, so its name was not changed."
+        });
+      }
+      return;
+    }
+    if (message.type === "reclaimSession") {
+      const sessionManager = this.sessions;
+      void (async () => {
+        const outcome = await this.external?.reclaimToPhone(message.sessionId, connection.deviceId) ?? "not-found";
+        let reopened = false;
+        if (outcome === "reclaimed") {
+          reopened = await sessionManager.resumeSession(message.sessionId, connection.deviceId);
+        }
+        const success = outcome === "reclaimed" && reopened;
+        this.log(`reclaim ${message.sessionId} -> ${success ? "phone-ready" : outcome}`);
+        this.sendTo(connection, {
+          v: PROTOCOL_VERSION,
+          type: "ack",
+          of: "reclaimSession",
+          sessionId: message.sessionId,
+          outcome: success ? "phone-ready" : outcome
+        });
+        if (!success) {
+          const detail = outcome === "observe-only" ? "This VS Code conversation is visible, but its lifecycle hook has not provided a verified process handle. Stop it in VS Code; LongLeash will make the same conversation reopenable when SessionEnd arrives." : outcome === "unverified" ? "LongLeash could not verify that the Terminal or VS Code writer exited, so it kept control there. Nothing was started on the phone." : outcome === "reclaimed" ? "The native writer ended, but this provider did not expose a recoverable conversation point. Nothing new was started." : "This native session is no longer connected to the laptop daemon.";
+          this.sendTo(connection, {
+            v: PROTOCOL_VERSION,
+            type: "error",
+            code: "cannot-reclaim",
+            message: detail
+          });
+        }
+      })();
+      return;
+    }
     if (message.type === "setGate") {
-      const applied = this.external !== null && message.sessionId.startsWith("ext_") ? this.external.setGate(message.sessionId, message.gate) : false;
+      const applied = this.external !== null && this.external.hasLiveSession(message.sessionId) ? this.external.setGate(message.sessionId, message.gate) : false;
       this.log(`gate ${message.sessionId} -> ${message.gate}${applied ? "" : " (unknown session)"}`);
       this.sendTo(connection, {
         v: PROTOCOL_VERSION,
@@ -10721,6 +11000,12 @@ var LongLeashServer = class {
         try {
           const liveExternal = this.external?.hasLiveSession(message.sessionId) === true;
           const externalSession = liveExternal ? this.external?.listSessions().find((item) => item.sessionId === message.sessionId) : void 0;
+          if (externalSession?.control === "observe") {
+            throw new SessionError(
+              "session-busy",
+              "This Codex conversation is visible through its active VS Code transcript, but its process has not exposed a control hook yet. Continue or stop it in VS Code; LongLeash changed nothing."
+            );
+          }
           if (externalSession?.agent === "codex" && message.settings.thinking !== void 0) {
             throw new SessionError(
               "unsupported-setting",
@@ -10836,7 +11121,7 @@ var LongLeashServer = class {
       return;
     }
     if (message.type === "stopSession") {
-      if (message.sessionId.startsWith("ext_") && this.external !== null) {
+      if (this.external?.hasLiveSession(message.sessionId) === true) {
         const sessions = this.sessions;
         void this.external.stop(message.sessionId, connection.deviceId).then((stopped) => {
           if (stopped) {
@@ -11044,6 +11329,11 @@ function normalizeRelayUrl(raw) {
 
 // ../daemon/src/adapters/claude.ts
 import { query } from "@anthropic-ai/claude-agent-sdk";
+function permissionMode(mode) {
+  if (mode === "auto") return "auto";
+  if (mode === "plan") return "plan";
+  return "default";
+}
 function summarizeToolInput(input) {
   if (input && typeof input === "object") {
     const record = input;
@@ -11077,8 +11367,8 @@ function createClaudeAgentFactory(options = {}) {
           };
         }
         if (closed) return;
-        await new Promise((resolve6) => {
-          wake = resolve6;
+        await new Promise((resolve7) => {
+          wake = resolve7;
         });
       }
     }
@@ -11101,6 +11391,7 @@ function createClaudeAgentFactory(options = {}) {
         ...request.settings?.model === void 0 && options.model === void 0 ? {} : { model: request.settings?.model ?? options.model },
         ...request.settings?.effort === void 0 ? {} : { effort: request.settings.effort },
         ...request.settings?.thinking === void 0 ? {} : request.settings.thinking.mode === "fixed" ? { thinking: { type: "enabled", budgetTokens: request.settings.thinking.budgetTokens } } : request.settings.thinking.mode === "adaptive" ? { thinking: { type: "adaptive" } } : { thinking: { type: "disabled" } },
+        permissionMode: permissionMode(request.settings?.mode),
         ...options.allowedTools === void 0 ? {} : { allowedTools: options.allowedTools },
         ...options.isolateFromUserSettings ? { settingSources: [] } : {},
         // Reopening a closed conversation: Claude replays its own transcript, so the agent
@@ -11143,6 +11434,7 @@ function createClaudeAgentFactory(options = {}) {
     });
     let activeSettings = { ...request.settings ?? {} };
     const applySettings = async (settings) => {
+      await run.setPermissionMode(permissionMode(settings.mode));
       await run.setModel(settings.model);
       await run.applyFlagSettings({ effortLevel: settings.effort ?? null });
       if (settings.thinking === void 0) {
@@ -11301,6 +11593,32 @@ var CodexRun = class {
   log;
   /** Per-turn overrides; updating this affects the next turn without replacing the thread. */
   settings;
+  approvalPolicy() {
+    if (this.settings.mode === "auto") return "on-request";
+    if (this.settings.mode === "manual" || this.settings.mode === "plan") return "untrusted";
+    return this.opts.approvalPolicy ?? "untrusted";
+  }
+  sandbox() {
+    if (this.settings.mode === "plan") return "read-only";
+    if (this.settings.mode === "manual" || this.settings.mode === "auto") return "workspace-write";
+    return this.opts.sandbox ?? "workspace-write";
+  }
+  sandboxPolicy() {
+    const sandbox = this.sandbox();
+    if (sandbox === "read-only") return { type: "readOnly", networkAccess: false };
+    if (sandbox === "danger-full-access") return { type: "dangerFullAccess" };
+    return { type: "workspaceWrite", networkAccess: false, writableRoots: [this.request.cwd] };
+  }
+  providerText(text) {
+    if (this.settings.mode !== "plan") return text;
+    return [
+      "<longleash-plan-mode>",
+      "Plan only. Investigate and explain a concrete implementation approach, but do not modify files or run commands that change the workspace. Ask for clarification when a decision is required.",
+      "</longleash-plan-mode>",
+      "",
+      text
+    ].join("\n");
+  }
   handle() {
     return {
       events: this.iterate(),
@@ -11309,7 +11627,7 @@ var CodexRun = class {
         if (this.threadId !== null && this.turnId !== null) {
           void this.call("turn/interrupt", { threadId: this.threadId, turnId: this.turnId }).catch(() => {
           });
-          await new Promise((resolve6) => setTimeout(resolve6, INTERRUPT_GRACE_MS));
+          await new Promise((resolve7) => setTimeout(resolve7, INTERRUPT_GRACE_MS));
         }
         this.child.kill("SIGTERM");
         this.finish();
@@ -11335,15 +11653,15 @@ var CodexRun = class {
         this.request.resume === void 0 ? {
           cwd: this.request.cwd,
           ...this.settings.model === void 0 ? {} : { model: this.settings.model },
-          approvalPolicy: this.opts.approvalPolicy ?? "untrusted",
-          sandbox: this.opts.sandbox ?? "workspace-write",
+          approvalPolicy: this.approvalPolicy(),
+          sandbox: this.sandbox(),
           config: MANAGED_THREAD_CONFIG
         } : {
           threadId: this.request.resume,
           cwd: this.request.cwd,
           ...this.settings.model === void 0 ? {} : { model: this.settings.model },
-          approvalPolicy: this.opts.approvalPolicy ?? "untrusted",
-          sandbox: this.opts.sandbox ?? "workspace-write",
+          approvalPolicy: this.approvalPolicy(),
+          sandbox: this.sandbox(),
           config: MANAGED_THREAD_CONFIG
         }
       );
@@ -11365,9 +11683,11 @@ var CodexRun = class {
     try {
       await this.call("turn/start", {
         threadId: this.threadId,
-        input: [{ type: "text", text }],
+        input: [{ type: "text", text: this.providerText(text) }],
         ...this.settings.model === void 0 ? {} : { model: this.settings.model },
-        ...this.settings.effort === void 0 ? {} : { effort: this.settings.effort }
+        ...this.settings.effort === void 0 ? {} : { effort: this.settings.effort },
+        approvalPolicy: this.approvalPolicy(),
+        sandboxPolicy: this.sandboxPolicy()
       });
     } catch (error) {
       if (fatal) throw error;
@@ -11527,8 +11847,8 @@ var CodexRun = class {
   // -------------------------------------------------------------------- plumbing
   call(method, params) {
     const id2 = this.nextId++;
-    const promise = new Promise((resolve6, reject) => {
-      this.pending.set(id2, { resolve: resolve6, reject });
+    const promise = new Promise((resolve7, reject) => {
+      this.pending.set(id2, { resolve: resolve7, reject });
     });
     this.write({ jsonrpc: "2.0", id: id2, method, params });
     return promise;
@@ -11580,8 +11900,8 @@ var CodexRun = class {
         if (this.failure !== null) throw this.failure;
         return;
       }
-      await new Promise((resolve6) => {
-        this.waiter = resolve6;
+      await new Promise((resolve7) => {
+        this.waiter = resolve7;
       });
     }
   }
@@ -11763,8 +12083,8 @@ var FolderIndex = class {
     for (const root of this.roots) {
       if (path === root) return basename4(root);
       if (path.startsWith(root + sep4)) {
-        const relative2 = path.slice(root.length + 1);
-        return `${basename4(root)}/${relative2}`;
+        const relative3 = path.slice(root.length + 1);
+        return `${basename4(root)}/${relative3}`;
       }
     }
     return path;
@@ -12170,13 +12490,210 @@ function roleName2(role) {
   return role.slice(0, 1).toUpperCase() + role.slice(1);
 }
 
+// ../daemon/src/codex-session-watch.ts
+import { closeSync as closeSync2, openSync as openSync2, readSync as readSync2, readdirSync as readdirSync3, statSync as statSync2 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import { isAbsolute as isAbsolute2, join as join6, relative as relative2, resolve as resolve4 } from "node:path";
+var MAX_HEAD = 256 * 1024;
+var MAX_TAIL = 1024 * 1024;
+var MAX_INITIAL_TAIL = 64 * 1024 * 1024;
+function readSlice(path, offset, length) {
+  const fd = openSync2(path, "r");
+  try {
+    const buffer = Buffer.alloc(length);
+    const read = readSync2(fd, buffer, 0, length, offset);
+    return buffer.subarray(0, read).toString("utf8");
+  } finally {
+    closeSync2(fd);
+  }
+}
+function inside(root, candidate) {
+  const rel = relative2(resolve4(root), resolve4(candidate));
+  return rel === "" || !rel.startsWith("..") && !isAbsolute2(rel);
+}
+function inspectCodexTranscript(path, roots2, maxTailBytes = MAX_INITIAL_TAIL) {
+  let size;
+  let activityAt;
+  try {
+    const stats = statSync2(path);
+    size = stats.size;
+    activityAt = stats.mtimeMs;
+  } catch {
+    return null;
+  }
+  try {
+    const firstLine = readSlice(path, 0, Math.min(size, MAX_HEAD)).split("\n")[0];
+    if (!firstLine) return null;
+    const meta = JSON.parse(firstLine);
+    if (meta.type !== "session_meta" || !meta.payload) return null;
+    const sessionId = typeof meta.payload.session_id === "string" ? meta.payload.session_id : typeof meta.payload.id === "string" ? meta.payload.id : null;
+    const cwd = typeof meta.payload.cwd === "string" ? meta.payload.cwd : null;
+    if (sessionId === null || cwd === null || !roots2.some((root) => inside(root, cwd))) return null;
+    if (meta.payload.source !== "vscode" && meta.payload.originator !== "codex_vscode") return null;
+    const surface = "vscode";
+    const tailOffset = Math.max(0, size - maxTailBytes);
+    const tailText = readSlice(path, tailOffset, size - tailOffset);
+    const lines = tailText.split("\n");
+    if (tailOffset > 0) lines.shift();
+    let title;
+    const snapshot = [];
+    for (let index = lines.length - 1; index >= 0; index -= 1) {
+      const line = lines[index];
+      if (!line?.includes('"role":"user"')) continue;
+      try {
+        const record = JSON.parse(line);
+        if (record.type !== "response_item" || record.payload?.type !== "message" || record.payload.role !== "user") continue;
+        const content = record.payload.content;
+        if (!Array.isArray(content)) continue;
+        const text = content.filter((item) => !!item && typeof item === "object" && item.type === "input_text" && typeof item.text === "string").map((item) => item.text).join("\n");
+        title = titleFrom(text) ?? void 0;
+        if (title !== void 0) break;
+      } catch {
+      }
+    }
+    for (const line of lines) {
+      if (line.length === 0 || line.length > 1e6) continue;
+      try {
+        for (const delta of transcriptDeltas(JSON.parse(line))) {
+          if (delta.type !== "stream.delta" || delta.payload.text.trim() === "") continue;
+          snapshot.push({ kind: delta.payload.kind, text: delta.payload.text });
+        }
+      } catch {
+      }
+    }
+    let retained = snapshot.slice(-80);
+    let characters = retained.reduce((sum, block) => sum + block.text.length, 0);
+    while (retained.length > 1 && characters > 12e4) {
+      characters -= retained.shift()?.text.length ?? 0;
+    }
+    if (title === void 0) title = titleFrom(latestUserText(tailText) ?? "") ?? void 0;
+    return {
+      sessionId,
+      cwd,
+      transcriptPath: path,
+      surface,
+      activityAt,
+      snapshot: retained,
+      ...title === void 0 ? {} : { title }
+    };
+  } catch {
+    return null;
+  }
+}
+var CodexSessionWatcher = class {
+  options;
+  mtimes = /* @__PURE__ */ new Map();
+  known = /* @__PURE__ */ new Map();
+  timer = null;
+  constructor(options) {
+    this.options = { pollMs: 3e3, initialRecentMs: 5 * 6e4, ...options };
+  }
+  start() {
+    this.scan(true);
+    this.timer = setInterval(() => this.scan(false), this.options.pollMs);
+    this.timer.unref?.();
+    return () => this.stop();
+  }
+  stop() {
+    if (this.timer !== null) clearInterval(this.timer);
+    this.timer = null;
+  }
+  scan(initial = false) {
+    const root = this.options.sessionsRoot ?? join6(homedir3(), ".codex", "sessions");
+    const now = this.options.now?.() ?? Date.now();
+    let observed = 0;
+    for (const path of jsonlFiles(root)) {
+      let modified;
+      try {
+        modified = statSync2(path).mtimeMs;
+      } catch {
+        continue;
+      }
+      const previous = this.mtimes.get(path);
+      this.mtimes.set(path, modified);
+      const changed = previous !== void 0 && modified > previous;
+      const recentlyActive = initial && now - modified <= this.options.initialRecentMs;
+      if (!changed && !recentlyActive) continue;
+      const previousSession = this.known.get(path);
+      const inspected = inspectCodexTranscript(
+        path,
+        this.options.roots,
+        previousSession === void 0 ? MAX_INITIAL_TAIL : MAX_TAIL
+      );
+      const session = inspected === null ? null : inspected.title === void 0 && previousSession?.title !== void 0 ? { ...inspected, title: previousSession.title } : inspected;
+      if (session === null) continue;
+      this.known.set(path, session);
+      this.options.onSession(session);
+      observed += 1;
+    }
+    return observed;
+  }
+};
+function jsonStringAt(source, quoteAt) {
+  if (source[quoteAt] !== '"') return null;
+  let escaped = false;
+  for (let index = quoteAt + 1; index < source.length; index += 1) {
+    const char = source[index];
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (char === '"') {
+      try {
+        return JSON.parse(source.slice(quoteAt, index + 1));
+      } catch {
+        return null;
+      }
+    }
+  }
+  return null;
+}
+function latestUserText(source) {
+  let before = source.length;
+  while (before > 0) {
+    const roleAt = source.lastIndexOf('"role":"user"', before);
+    if (roleAt < 0) return null;
+    const textKey = source.indexOf('"text":', roleAt);
+    const nextRole = source.indexOf('"role":', roleAt + 1);
+    if (textKey >= 0 && (nextRole < 0 || textKey < nextRole)) {
+      const quoteAt = source.indexOf('"', textKey + 7);
+      const text = quoteAt < 0 ? null : jsonStringAt(source, quoteAt);
+      if (text !== null && titleFrom(text) !== null) return text;
+    }
+    before = roleAt;
+  }
+  return null;
+}
+function jsonlFiles(root) {
+  const out = [];
+  const visit = (directory) => {
+    let entries;
+    try {
+      entries = readdirSync3(directory, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      const path = join6(directory, entry.name);
+      if (entry.isDirectory()) visit(path);
+      else if (entry.isFile() && entry.name.endsWith(".jsonl")) out.push(path);
+    }
+  };
+  visit(root);
+  return out;
+}
+
 // ../daemon/src/daemon.ts
 var DEFAULT_READ_ONLY_TOOLS = ["Read", "Glob", "Grep"];
 function executableOnPath(command) {
   for (const directory of (process.env.PATH ?? "").split(delimiter)) {
     if (directory === "") continue;
     try {
-      accessSync(join6(directory, command), constants.X_OK);
+      accessSync(join7(directory, command), constants.X_OK);
       return true;
     } catch {
     }
@@ -12184,20 +12701,20 @@ function executableOnPath(command) {
   return false;
 }
 async function startDaemon(options) {
-  const dataDir2 = options.dataDir ?? join6(homedir3(), ".longleash");
+  const dataDir2 = options.dataDir ?? join7(homedir4(), ".longleash");
   mkdirSync3(dataDir2, { recursive: true });
-  const roots2 = options.allowedRoots.map((root) => resolve4(root));
+  const roots2 = options.allowedRoots.map((root) => resolve5(root));
   for (const root of roots2) {
     if (!existsSync6(root)) throw new Error(`Allowed root does not exist: ${root}`);
   }
-  const eventLog = new EventLog(join6(dataDir2, "events.db"));
-  const registry = new DeviceRegistry(join6(dataDir2, "devices.db"));
-  const approvals = new ApprovalStore(join6(dataDir2, "approvals.db"));
+  const eventLog = new EventLog(join7(dataDir2, "events.db"));
+  const registry = new DeviceRegistry(join7(dataDir2, "devices.db"));
+  const approvals = new ApprovalStore(join7(dataDir2, "approvals.db"));
   const workspace = new WorkspaceLeaseManager(approvals.rawDb);
-  const worktrees = new WorktreeManager(join6(dataDir2, "worktrees"));
+  const worktrees = new WorktreeManager(join7(dataDir2, "worktrees"));
   const push = new PushNotifier({
-    dbPath: join6(dataDir2, "push.db"),
-    keysPath: join6(dataDir2, "vapid.json"),
+    dbPath: join7(dataDir2, "push.db"),
+    keysPath: join7(dataDir2, "vapid.json"),
     // Who a push service may contact about this sender: the relay origin when
     // one exists, else a placeholder mailto (LAN-only installs never push far).
     subject: process.env.LONGLEASH_PUSH_SUBJECT ?? (options.relayUrl !== void 0 ? options.relayUrl.replace(/^ws(s?):\/\//, "http$1://").replace(/\/ws\/?$/, "") : "mailto:longleash@localhost.invalid"),
@@ -12283,14 +12800,15 @@ async function startDaemon(options) {
   server.attachSessions(sessions);
   server.attachFolders(new FolderIndex(roots2));
   server.attachPush(push);
-  const externalApprovals = new ApprovalStore(join6(dataDir2, "approvals-external.db"));
-  const sessionRegistry = new SessionRegistry(join6(dataDir2, "live-sessions.db"));
+  const externalApprovals = new ApprovalStore(join7(dataDir2, "approvals-external.db"));
+  const sessionRegistry = new SessionRegistry(join7(dataDir2, "live-sessions.db"));
   const external = new ExternalSessions({
     eventLog,
     approvals: externalApprovals,
     registry: sessionRegistry,
     onEvent: mirror,
     workspace,
+    resolveSessionId: (agentSessionId) => sessions.sessionIdForAgentSession(agentSessionId),
     // A live socket means the app is open and can answer in seconds. A push REGISTRATION is
     // permanent and proves nothing about whether anyone is looking — treating it as presence
     // is what froze the keyboard for two minutes with the phone in a drawer.
@@ -12307,10 +12825,15 @@ async function startDaemon(options) {
       agentSessionId: info.claudeSessionId
     })
   });
+  const codexWatcher = new CodexSessionWatcher({
+    roots: roots2,
+    onSession: (session) => external.observeCodexSession(session)
+  });
+  codexWatcher.start();
   external.startSweeping();
   const delegationStore = new DelegationStore(approvals.rawDb);
   workspace.reconcile({
-    activeSessionIds: external.listSessions().map((session) => session.sessionId),
+    activeSessionIds: external.listSessions().filter((session) => session.control === "full").map((session) => session.sessionId),
     validReservationIds: delegationStore.list().filter((record) => record.status === "starting").map((record) => record.delegationId)
   });
   external.reconcileWorkspace();
@@ -12332,7 +12855,7 @@ async function startDaemon(options) {
   server.attachExternal(external, hookSecret);
   const { port } = await server.listen();
   writeFileSync2(
-    join6(dataDir2, "hook-endpoint.json"),
+    join7(dataDir2, "hook-endpoint.json"),
     JSON.stringify({ url: `http://${options.host}:${port}/hook`, secret: hookSecret }, null, 2) + "\n",
     { mode: 384 }
   );
@@ -12355,6 +12878,7 @@ async function startDaemon(options) {
     posture: readPermissionPosture(),
     stop: async () => {
       stopMaintenance();
+      codexWatcher.stop();
       bridge?.stop();
       await sessions.shutdown();
       awake.release();
@@ -12372,9 +12896,9 @@ async function startDaemon(options) {
 
 // ../daemon/src/config.ts
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "node:fs";
-import { dirname as dirname3, join as join7 } from "node:path";
+import { dirname as dirname3, join as join8 } from "node:path";
 function resolveRelayUrl(given, dataDir2) {
-  const path = join7(dataDir2, "config.json");
+  const path = join8(dataDir2, "config.json");
   if (given !== void 0 && given.trim().toLowerCase() === "off") {
     const config = load(path);
     delete config.relayUrl;
@@ -12636,19 +13160,115 @@ function noAddressReason(interfaces = networkInterfaces()) {
   return `No address a phone could dial (found: ${addresses.join(", ")}).`;
 }
 
+// ../daemon/src/instance-lock.ts
+import { closeSync as closeSync3, lstatSync, mkdirSync as mkdirSync5, openSync as openSync3, readFileSync as readFileSync5, rmSync, writeFileSync as writeFileSync4 } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join as join9 } from "node:path";
+var LOCK_NAME = "daemon.lock";
+var LOCK_KIND = "longleash-daemon";
+function acquireDaemonInstance(dataDir2) {
+  mkdirSync5(dataDir2, { recursive: true, mode: 448 });
+  const path = join9(dataDir2, LOCK_NAME);
+  const token = randomUUID();
+  const create = () => {
+    const fd = openSync3(path, "wx", 384);
+    try {
+      writeFileSync4(fd, `${JSON.stringify({ kind: LOCK_KIND, pid: process.pid, token, startedAt: Date.now() })}
+`);
+    } finally {
+      closeSync3(fd);
+    }
+  };
+  try {
+    create();
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+    if (lstatSync(path).isSymbolicLink()) throw new Error(`Refusing symlinked daemon lock: ${path}`);
+    let owner = {};
+    try {
+      owner = JSON.parse(readFileSync5(path, "utf8"));
+    } catch {
+    }
+    if (owner.kind !== LOCK_KIND || !Number.isSafeInteger(owner.pid) || owner.pid <= 0) {
+      throw new Error(`Unrecognized daemon lock requires manual inspection: ${path}`);
+    }
+    if (processAlive(owner.pid)) {
+      throw new Error(`LongLeash already owns this data directory in process ${owner.pid}. Use \`longleash service status\` before starting another instance.`);
+    }
+    rmSync(path);
+    create();
+  }
+  let held = true;
+  return {
+    path,
+    release() {
+      if (!held) return;
+      held = false;
+      try {
+        const owner = JSON.parse(readFileSync5(path, "utf8"));
+        if (owner.token === token) rmSync(path);
+      } catch {
+      }
+    }
+  };
+}
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+// ../daemon/src/service-log.ts
+function persistentServiceLogLine(line) {
+  if (/codex\s+(?:<-|->)/i.test(line)) return null;
+  const stamp = line.match(/^\[[^\]]+\]\s*/)?.[0] ?? "";
+  const message = line.slice(stamp.length);
+  const started2 = message.match(/^(claude|codex) session ([A-Za-z0-9_-]{1,32}) started in .+ \((terminal|vscode|phone)\)$/i);
+  if (started2) return `${stamp}${started2[1].toLowerCase()} session ${started2[2]} started (${started2[3].toLowerCase()})`;
+  if (/^\? .+ in [A-Za-z0-9_-]+ .* -> /i.test(message)) return `${stamp}tool decision recorded`;
+  if (/^(decision|gate|resume|takeOver|stop|session)\s/i.test(message)) return `${stamp}session lifecycle state changed`;
+  if (/^(delegation|start) refused:/i.test(message)) return `${stamp}session request refused; details are available on the paired device`;
+  if (/^(relay|relay link|relay room|dropped a relay frame)/i.test(message)) return `${stamp}relay connection state changed`;
+  if (/^(device|dropping unresponsive connection)/i.test(message)) return `${stamp}device connection state changed`;
+  if (/^push:/i.test(message) || /^push (subscription|test)/i.test(message)) return `${stamp}push delivery state changed`;
+  if (/^(keeping this Mac awake|all agents idle)/i.test(message)) return `${stamp}${message}`;
+  if (/^rebound to /i.test(message)) return `${stamp}local listener rebound`;
+  return `${stamp}service activity recorded; details omitted`;
+}
+
 // ../daemon/bin/longleashd.ts
 var here = dirname4(fileURLToPath(import.meta.url));
-var APP_DIR = resolve5(here, "../../app/dist");
+var APP_DIR = resolve6(here, "../../app/dist");
+var serviceMode = process.env.LONGLEASH_SERVICE === "1";
+if (serviceMode) {
+  const fatal = () => {
+    console.error("LongLeash service stopped unexpectedly; details omitted. Run `longleash doctor`.");
+    process.exit(1);
+  };
+  process.on("uncaughtException", fatal);
+  process.on("unhandledRejection", fatal);
+}
+function daemonLog(line) {
+  if (!serviceMode) {
+    console.log(line);
+    return;
+  }
+  const safe = persistentServiceLogLine(line);
+  if (safe !== null) console.log(safe);
+}
 var roots = process.argv.slice(2).filter((arg) => !arg.startsWith("-"));
 if (roots.length === 0) {
   console.error("\nUsage: longleashd <project-directory> [more directories\u2026]");
   console.error("Agents may only ever work inside the directories you list.\n");
   process.exit(1);
 }
-var dataDir = process.env.LONGLEASH_DATA ?? join8(homedir4(), ".longleash");
+var dataDir = process.env.LONGLEASH_DATA ?? join10(homedir5(), ".longleash");
 var relay = resolveRelayUrl(process.env.LONGLEASH_RELAY_URL, dataDir);
 if (relay?.source === "remembered") {
-  console.log(`Relay: ${relay.url} (remembered \u2014 LONGLEASH_RELAY_URL=off forgets it)`);
+  console.log(serviceMode ? "Relay configuration loaded." : `Relay: ${relay.url} (remembered \u2014 LONGLEASH_RELAY_URL=off forgets it)`);
 }
 var candidates = findCandidates();
 var best = candidates[0];
@@ -12698,15 +13318,17 @@ async function boot(host, port) {
     allowedRoots: roots,
     host,
     port,
-    ...existsSync7(join8(APP_DIR, "index.html")) ? { staticRoot: APP_DIR } : {},
+    ...existsSync7(join10(APP_DIR, "index.html")) ? { staticRoot: APP_DIR } : {},
     denyOutsideRoot: process.env.LONGLEASH_STRICT !== "0",
     // LONGLEASH_ASK_EVERYTHING=1 pre-approves nothing, so even reading a file comes to your phone.
     ...process.env.LONGLEASH_ASK_EVERYTHING === "1" ? { allowedTools: [] } : {},
     dataDir,
-    log: (line) => console.log(line),
+    log: daemonLog,
     ...relay === null ? {} : { relayUrl: relay.url }
   });
 }
+var instanceLock = acquireDaemonInstance(dataDir);
+process.once("exit", () => instanceLock.release());
 var started = await (async () => {
   const firstPort = holder === "other" ? 0 : wantedPort;
   try {
@@ -12738,7 +13360,7 @@ function relayAppOrigin(wsUrl) {
 function freshPairingUrl() {
   const challenge = daemon.registry.createPairingChallenge();
   if (relay !== null) {
-    hostPairing({ registry: daemon.registry, relayUrl: relay.url, challenge, log: (line) => console.log(`[pair] ${line}`) });
+    hostPairing({ registry: daemon.registry, relayUrl: relay.url, challenge, log: (line) => daemonLog(`[pair] ${line}`) });
     return pairingUrl(relayAppOrigin(relay.url), challenge.challengeId, challenge.secret);
   }
   return pairingUrl(
@@ -12747,15 +13369,16 @@ function freshPairingUrl() {
     challenge.secret
   );
 }
-var url = freshPairingUrl();
+daemon.server.attachLocalPairing(freshPairingUrl);
+var url = serviceMode ? null : freshPairingUrl();
 console.log("\n=== LongLeash ===\n");
 var warn = vpnWarning();
 if (warn) console.log(`!!! ${warn}
 `);
-if (!existsSync7(join8(APP_DIR, "index.html"))) {
+if (!existsSync7(join10(APP_DIR, "index.html"))) {
   console.log("The web app is not built yet \u2014 run `pnpm --filter @longleash/app build` first.\n");
 }
-if (daemon.posture.gateWeakened) {
+if (daemon.posture.gateWeakened && !serviceMode) {
   console.log(`Note: your Claude Code settings pre-approve ${daemon.posture.allowRuleCount} pattern(s),`);
   console.log("e.g. " + daemon.posture.examples.join(", "));
   console.log("Those commands run WITHOUT asking your phone. They still appear in the activity");
@@ -12776,23 +13399,29 @@ if (preApproved.length > 0) {
 } else {
   console.log("");
 }
-console.log("Agents may work only in:");
-for (const root of roots) console.log(`  ${resolve5(root)}`);
-console.log(
-  servedOnLan && best ? `
+if (serviceMode) {
+  console.log(`Background service ready with ${roots.length} allowed project root(s).`);
+  console.log(`Connectivity: ${relay !== null ? "encrypted relay enabled" : "LAN only"}.`);
+  console.log("Pairing secrets are never written to service logs. Run `longleash pair` in a terminal.\n");
+} else {
+  console.log("Agents may work only in:");
+  for (const root of roots) console.log(`  ${resolve6(root)}`);
+  console.log(
+    servedOnLan && best ? `
 Listening on ${servedHost}:${daemon.port} (${best.iface}, ${best.label})` : `
 Listening on ${servedHost}:${daemon.port} (no local network \u2014 relay only)`
-);
-console.log(
-  relay !== null ? `Relay: ${relay.url} \u2014 your phone can reach this laptop from anywhere.` : "Relay: not configured (LAN only). Set LONGLEASH_RELAY_URL once to enable remote access \u2014 it is remembered."
-);
-console.log("\nScan this with your phone, then add it to your home screen:\n");
-console.log(terminalQr(url));
-console.log(`
+  );
+  console.log(
+    relay !== null ? `Relay: ${relay.url} \u2014 your phone can reach this laptop from anywhere.` : "Relay: not configured (LAN only). Set LONGLEASH_RELAY_URL once to enable remote access \u2014 it is remembered."
+  );
+  console.log("\nScan this with your phone, then add it to your home screen:\n");
+  console.log(terminalQr(url));
+  console.log(`
   ${url}
 `);
-if (relay !== null && servedOnLan) {
-  console.log(`(LAN fallback for pairing at home: http://${servedHost}:${daemon.port}/#c=\u2026&s=\u2026 \u2014 same code)`);
+  if (relay !== null && servedOnLan) {
+    console.log(`(LAN fallback for pairing at home: http://${servedHost}:${daemon.port}/#c=\u2026&s=\u2026 \u2014 same code)`);
+  }
 }
 var NETWORK_WATCH_MS = 5e3;
 var networkWatch = setInterval(() => {
@@ -12803,23 +13432,23 @@ var networkWatch = setInterval(() => {
   servingHost = nextHost;
   void daemon.server.rebind(nextHost).then((port) => {
     servingPort = port;
-    console.log(`
+    console.log(serviceMode ? "\nNetwork changed; the local listener recovered." : `
 Network changed: ${was} -> ${nextHost}. Now serving ${nextHost}:${port}.`);
     console.log(
       nextBest ? "Press n + Enter for a pairing QR on this network." : "No local network now \u2014 the relay carries everything."
     );
   }).catch((err) => {
-    console.log(`
+    console.log(serviceMode ? "\nNetwork changed but local listener recovery failed; details omitted." : `
 Network changed but rebinding failed (${String(err)}).`);
     console.log(relay !== null ? "The relay is unaffected." : "Restart the daemon to recover.");
   });
 }, NETWORK_WATCH_MS);
 networkWatch.unref?.();
-console.log("Press n + Enter for a fresh pairing QR, r + Enter to revoke every device, q + Enter to quit.\n");
+if (!serviceMode) console.log("Press n + Enter for a fresh pairing QR, r + Enter to revoke every device, q + Enter to quit.\n");
 process.stdin.setEncoding("utf8");
 process.stdin.on("data", (chunk) => {
   const key = chunk.trim().toLowerCase();
-  if (key === "n") {
+  if (key === "n" && !serviceMode) {
     const next = freshPairingUrl();
     console.log("\nScan this with your phone:\n");
     console.log(terminalQr(next));
@@ -12834,12 +13463,18 @@ process.stdin.on("data", (chunk) => {
   }
   if (key === "q") {
     clearInterval(networkWatch);
-    void daemon.stop().then(() => process.exit(0));
+    void daemon.stop().then(() => {
+      instanceLock.release();
+      process.exit(0);
+    });
   }
 });
 var shutdown = () => {
   clearInterval(networkWatch);
-  void daemon.stop().then(() => process.exit(0));
+  void daemon.stop().then(() => {
+    instanceLock.release();
+    process.exit(0);
+  });
 };
 process.on("SIGINT", shutdown);
 process.on("SIGTERM", shutdown);