@prestyj/cli 5.10.0 → 5.12.0

package/assets/skills/compliance-guard/references/us.md

@@ -0,0 +1,164 @@
+# United States
+
+Snapshot **11 Aug 2026**. Markers: **[V]** verified against a primary/first-tier source · **[S]** snapshot, re-verify · **[U]** contested or fast-moving.
+
+**PRA** = private right of action. This is the field that matters most for a small company: regulator-only laws are a compliance project, PRA laws are a lawsuit.
+
+---
+
+## 0. Scoping reality for a tiny startup
+
+Most **comprehensive state privacy laws will not apply** to a pre-scale product — they need tens of thousands of residents' data or large revenue. But four categories apply **at any size**:
+
+1. FTC Act §5 and state unfair-and-deceptive-practices analogues (most state UDAPs *do* have a PRA).
+2. Breach-notification statutes in every state.
+3. Sector laws: COPPA, HIPAA, GLBA, TCPA, BIPA, consumer-health-data laws.
+4. No-threshold plaintiff statutes: CIPA, BIPA, MHMDA, TCPA, VPPA.
+
+Also note **Texas and Nebraska have no revenue or volume threshold** — they apply to anyone doing business in-state who is not an SBA "small business", and even exempt small businesses may not sell sensitive personal data without consent **[V]**.
+
+**Practical answer:** a US indie app under ~25k users in any single state usually falls outside the comprehensive laws — and is still fully exposed to everything in categories 1–4.
+
+---
+
+## 1. State comprehensive privacy laws
+
+**In force in 2026: 20 states** (CA, VA, CO, CT, UT, TX, OR, MT, IA, DE, NE, NH, NJ, TN, MN, MD, IN, KY, RI, and Florida's narrower law which applies only above $1B revenue) **[V]**. Enforcement is AG-only; penalties commonly $7,500–$10,000 per violation **[V]**. Cure periods are expiring across states **[S]**.
+
+Thresholds range from 25,000 consumers (Montana) to 175,000 (Tennessee); 10,000 consumers where a share of revenue comes from selling data (RI, DE, NH, MD); Maryland pairs a 35,000-consumer threshold with the strictest data-minimisation and sensitive-data rules, and bans the sale of sensitive data outright **[V]**.
+
+**Universal opt-out / Global Privacy Control — the cheapest high-value engineering task.** As of 1 Jan 2026, twelve states require honouring it (CA, CO, CT, DE, MD, MN, MT, NE, NH, NJ, OR, TX); Virginia-template states do not **[V]**.
+
+```
+Read the Sec-GPC: 1 request header and navigator.globalPrivacyControl.
+Treat as an opt-out of sale/share + targeted advertising.
+Apply BEFORE firing any ad pixel. Persist server-side against the user/device.
+Disclose signal handling in the privacy notice.
+```
+Honouring GPC for **every** visitor is the safe default: it satisfies the strictest state and violates none **[V]**.
+
+**Why an ordinary ad pixel triggers everything.** "Sale" requires no money — any disclosure for other valuable consideration counts — and "sharing" expressly covers cross-context behavioural advertising **[V]**. Meta Pixel, GA4 with ad features, TikTok, Reddit and LinkedIn tags are a sale/share/targeted ad in nearly every state. Build: a tag inventory, consent-gated loading, and an opt-out that actually severs the pixel rather than filing a form.
+
+**Sensitive data requires opt-in** in Virginia-model states (precise geolocation, race, religion, health, sex life/orientation, immigration status, biometrics, genetic data, children's data) **[V]**. California instead grants a right to limit use.
+
+**Minors:** opt-in for targeted ads, sale, and profiling for known 13–16 year-olds; Maryland extends to under-18 on a "should have known" standard **[V]**.
+
+**Rights and timing:** access, delete, correct, portability, opt-out, non-discrimination. **45 days, extendable by 45** **[V]**. Virginia-model states require an **appeal** mechanism. California requires two intake methods. Never identity-verify an opt-out — verification is for access/deletion.
+
+**Notice content:** categories collected/sources/purposes/recipients, sensitive-data uses, **retention periods per category** (California), rights and how to exercise them, opt-out-signal handling, appeal process, contact, and a last-updated date with an annual refresh **[V]**.
+
+**Assessments:** written data-protection assessments required in most Virginia-model states for targeted advertising, sale, sensitive data, and risky profiling; retained and producible to the AG **[V]**.
+
+---
+
+## 2. California specifics
+
+**Applicability:** for-profit doing business in CA meeting any one of — annual gross revenue over ~$26.6M (CPI-adjusted), buying/selling/sharing PI of 100,000+ CA consumers or households a year, or 50%+ of revenue from selling/sharing PI **[V]**. Penalties per violation with a higher tier for intentional violations or those involving minors. **Consumers may sue only over certain breaches** ($107–$799 per consumer per incident) — there is no general PRA for policy or opt-out-link failures **[V]**.
+
+**2026 regulations package (effective 1 Jan 2026)** **[V]**:
+- *Risk assessments* — begin 1 Jan 2026, complete for ongoing activities by 31 Dec 2027, first certified reports 1 Apr 2028. Triggered by sensitive PI, targeted ads to minors, ADMT for significant decisions, or training ADMT.
+- *ADMT* — pre-use notice, access, and opt-out for automated decision-making about significant decisions (including employees, contractors, applicants). **Compliance deadline 1 Jan 2027.**
+- *Cyber audits* — only above revenue plus scale thresholds; first certifications from 2028. A pre-revenue startup is out of scope.
+
+**Delete Act / DROP** — if you sell PI of consumers you have no direct relationship with, you are a data broker. **No revenue threshold.** Registration plus, **from 1 Aug 2026**, processing consumer deletion requests through the state mechanism every 45 days with downstream deletion directives; per-day penalties apply whether or not you registered **[V]**. Enforcement has already hit companies of exactly this size. Ask at design review: *do we sell PI of people who never used us?*
+
+**Breach notice (SB 446)** — since 1 Jan 2026, notify affected California residents within **30 calendar days** of discovery, and report to the AG within **15 calendar days** of notifying individuals **[V]**.
+
+**AI transparency (SB 942 as amended by AB 853)** — covered providers are generative-AI systems with **over 1M monthly users**; duties operative 2 Aug 2026, with hosting-platform duties from 1 Jan 2027 **[V]**. Most small devs are out of scope, but the hosting-platform duty catches anyone distributing GenAI systems.
+
+**AB 2013 training-data transparency** — **no size threshold**. Developers of generative AI systems made available to Californians must publish training-data documentation; compliance required from 1 Jan 2026 and on substantial modification **[V]**. Catches small fine-tuners, not mere API consumers.
+
+**SB 243 companion chatbots — the highest-risk new law for small AI apps.** Effective 1 Jan 2026. Applies to chatbots sustaining a relationship or human-like emotional engagement (excludes customer-service bots, limited game NPCs, voice assistants). Requires non-human disclosure, mental-health crisis protocols, and minor protections including blocking sexual content and enforcing breaks. **PRA: YES** — minimum $1,000 damages plus fees, and UCL pairing can reach individuals personally **[V]**.
+
+**Employment ADS regulations** under state anti-discrimination law add notice and recordkeeping duties for automated decision systems **[S]**.
+
+---
+
+## 3. Children and teens
+
+**COPPA amended Rule — full compliance date 22 Apr 2026** **[V]**. Trigger: a child-directed service, or actual knowledge of collecting personal information from under-13s. Mixed-audience services may age-screen. Concrete changes:
+
+- **Separate** verifiable parental consent for disclosing children's data to third parties (including for targeted advertising).
+- New **data-retention limits** and a **published written retention policy** — indefinite retention is prohibited.
+- Broader definition of personal information now expressly including **biometric identifiers** (face templates, fingerprints, voiceprints), government identifiers, phone numbers, audio recordings, and certain geolocation.
+- A written children's information security programme with vendor due diligence.
+- Parent review/deletion flows must cover biometric data.
+
+**App Store Accountability Acts (TX, UT, LA, AL, CA)** — these impose duties on **app developers**, not just the stores **[V]**. Texas SB 2420 is in effect after appellate and Supreme Court refusals to freeze it (which is not a ruling on constitutionality) **[V]**; Utah developer requirements from 6 May 2026; Louisiana 1 July 2026; California 1 Jan 2027 **[V]**. Build: consume the store's age-signal API, branch features on age category, store only a category flag, re-request consent on significant app changes. Some states allow private suits.
+
+**NY SAFE for Kids** — final rules July 2026, effective **25 Jan 2027**, targeting platforms with addictive feeds **[V]**.
+
+**Adult content age verification** — 26 states with live laws following the 2025 Supreme Court decision upholding Texas's law **[V]**. Typical trigger is ≥1/3 sexual material harmful to minors, a few with no threshold. Use a third-party verifier returning a boolean; retain nothing reconstructable; geo-route per state. Several states allow private suits.
+
+**TAKE IT DOWN Act §3 (NCII) — enforced from 19 May 2026, and it reaches tiny platforms** **[V]**. Any site, app or service that hosts user content must publish a plain-language notice-and-removal process usable by **users and non-users**, and remove reported non-consensual intimate imagery — including AI-generated — plus known identical copies **within 48 hours**. Non-compliance is trivially detectable: a regulator just checks whether the notice exists. Build `/report/ncii`, an acknowledgement + 48h SLA timer, hash-based re-upload suppression, and a footer link.
+
+**CSAM reporting** — providers must report apparent child sexual abuse material to the national tipline as soon as reasonably possible after obtaining actual knowledge, with a **one-year preservation** duty; there is no general proactive monitoring mandate **[V]**. Register a point of contact, define an escalation path, and never re-transmit the material except to the tipline or law enforcement.
+
+---
+
+## 4. Health, biometric, genetic, location
+
+**HIPAA usually does *not* cover a direct-to-consumer wellness app** — it reaches covered entities and their business associates. You become a business associate the moment you handle PHI *on behalf of* a covered entity, which requires a BAA, Security Rule compliance, and 60-day breach notice **[V]**. If you are not HIPAA, you are in the consumer-health-data regime below.
+
+**Washington My Health My Data Act — the top small-company landmine.** **No revenue or volume threshold**, in effect since 2024 **[V]**. "Consumer health data" is defined broadly enough to include precise location that could indicate seeking health services. Requires a **standalone** consumer-health-data privacy policy at its own link, **separate consent for collection**, **separate consent for sharing**, and a **distinct signed authorisation to sell**, plus a geofencing prohibition and processor contracts. **PRA: YES**, via the state consumer-protection act, up to $7,500 per violation **[V]**. The first class action targeted an ordinary ad SDK collecting location. Any period tracker, fitness, mental-health, or symptom app — or anything collecting precise location — is squarely in scope. Nevada has a similar regime without a PRA **[V]**.
+
+**Illinois BIPA** — see `lawsuit-vectors.md` §3. Required **before first capture**: written notice of collection and specific purpose, notice of the retention schedule and destruction guidelines, a **written release**, a publicly available retention/destruction policy, no profiting from biometrics, and reasonable-care storage **[V]**. Texas and Washington have AG-enforced analogues.
+
+**Genetic data** — roughly 14 states require separate express consent per purpose and per disclosure; some allow private suits **[S]**. Treat raw DNA as opt-in-per-purpose and get counsel.
+
+**Precise geolocation** — sensitive/opt-in in every Virginia-model state, and health-linked location is consumer health data **[V]**. Request coarse location by default; never ship precise location to ad SDKs.
+
+**FTC Health Breach Notification Rule** — applies to non-HIPAA health apps that can draw data from multiple sources (e.g. platform health data plus user input). Critically, a "breach" includes an **unauthorised disclosure** — firing a health event to an ad pixel is itself reportable **[V]**. 500+ affected means notifying the regulator within 60 days.
+
+---
+
+## 5. AI laws
+
+- **Colorado** — the original AI Act was delayed and then repealed/replaced with a narrower automated-decision framework; assume a scaled-back regime effective **1 Jan 2027** and verify the enrolled text before building **[U]**.
+- **Texas TRAIGA** — effective 1 Jan 2026, reaching out-of-state developers whose AI is accessible to Texas users. Intent-based liability for AI that promotes self-harm, facilitates crime, discriminates, or produces prohibited deepfakes. AG-only with a 60-day cure; **safe harbour for documented NIST AI RMF-aligned compliance** **[V]**. Practical step for a small dev: a one-page RMF-aligned policy plus retained prompt/eval logs.
+- **Illinois HB 3773** — from 1 Jan 2026, using AI with a discriminatory *effect* in employment violates the state human-rights act; intent is no defence **[V]**.
+- **NYC Local Law 144** — annual independent bias audit plus published summary and candidate notice for automated employment decision tools used for NYC roles **[V]**.
+- **Mental-health AI** — Illinois bans AI delivering mental-health treatment or clinical decisions outright; Nevada, Utah and Tennessee restrict or require disclosure; treat "AI therapist" as a **hard gate** **[V]**.
+- **Companion chatbots** — California (PRA), New York (AG-only), Oregon (PRA, from 2027), Washington (from 2027) **[V]**. **Baseline build for any consumer LLM chat:** persistent non-human disclosure, self-harm detection with a crisis interstitial, minor-mode content restrictions and break reminders, retained incident logs.
+- **Frontier-model laws** target training compute far beyond any small developer **[V]**.
+- **Federal posture** — a December 2025 executive order seeks to weaken state AI regulation via litigation and funding conditions, with a DOJ task force operating from January 2026 **[V]**. Do **not** advise a user to ignore state AI law on this basis; the laws remain in force unless and until enjoined.
+
+---
+
+## 6. Cross-cutting federal
+
+- **FTC Act §5** — any statement in your privacy policy, marketing page, app-store listing or in-app copy that is not literally true of your code is deception. Dark patterns in consent and cancellation flows are deception/unfairness; failure to maintain reasonable security is unfairness **[V]**. No federal PRA, but most state UDAP analogues have one.
+- **Consumer Reviews and Testimonials Rule** — prohibits fake, incentivised-by-sentiment, and undisclosed insider reviews, with civil penalties in the tens of thousands per violation; enforcement is active **[V]**.
+- **Negative option / click-to-cancel** — the federal rule was vacated in 2025 and a new rulemaking is under way **[V]**. Do not tell a user they are safe: ROSCA and ~25 state auto-renewal laws still govern, and California's amended law broadened liability **[V]**.
+- **TCPA** — see `lawsuit-vectors.md` §4. Consent records, revocation handling on any channel, quiet hours in the recipient's timezone, DNC scrubbing, carrier campaign registration **[V]**. Exact effective dates of the universal-revocation mandate are reported inconsistently **[U]**.
+- **CAN-SPAM** — accurate headers and subject, advertising identification, **valid physical postal address**, working opt-out honoured within **10 business days** and functional for 30 days after send; you are liable for your sending platform and affiliates **[V]**.
+- **State breach notification** — all states; deadlines and AG-notice thresholds vary; several sector rules add shorter clocks **[V]**.
+- **ADA accessibility** — Title II has fixed rule deadlines for public entities; Title III private-business exposure is driven by private litigation rather than a technical rule **[V]**. WCAG 2.1 AA is the practical benchmark.
+- **GLBA Safeguards Rule** — "financial institution" is far broader than banks and catches many fintech, lending, tax-prep and advisory products: written InfoSec programme, a named qualified individual, MFA, encryption, vendor oversight, and 30-day regulator notice for larger incidents **[V]**.
+- **FCRA** — if you assemble or use consumer reports for employment, tenant, credit or insurance decisions: permissible purpose, **standalone** disclosure plus authorisation, pre-adverse-action packet with a waiting period, adverse-action notice. **PRA: YES**, with heavy class-action volume over standalone-disclosure defects **[V]**.
+- **ECOA/Reg B and FHA** — adverse-action notices with **specific principal reasons** within 30 days. A black-box model that cannot articulate reasons is itself the violation **[V]**. **PRA: YES.**
+
+---
+
+## 7. PRA ranking — what actually produces suits against small companies
+
+1. California CIPA (trackers, pixels, chat widgets, session replay) — $5,000 per violation, no threshold **[V]**
+2. ADA Title III accessibility (plus state statutory damages) **[V]**
+3. TCPA/SMS — $500–$1,500 per message, uncapped **[V]**
+4. Illinois BIPA — per-person statutory damages, a single in-state user suffices **[V]**
+5. Washington MHMDA — up to $7,500 per violation, extremely broad health-data definition **[V]**
+6. Auto-renewal claims via state consumer statutes **[V]**
+7. CCPA breach claims — $107–$799 per consumer, filed reflexively after AG breach reports **[V]**
+8. California SB 243 companion chatbots — new, untested, minimum $1,000 plus fees **[V]**
+9. VPPA — video plus ad pixel, $2,500 per person, circuit split **[U]**
+10. FCRA — standalone-disclosure defects **[V]**
+11. State wiretap analogues beyond California **[U]** on the exact state list
+12. AI employment discrimination — low volume today, rising **[S]**
+
+**Regulator-only (no PRA):** every state comprehensive privacy law except California's breach claim, COPPA, TAKE IT DOWN, TRAIGA, frontier-model laws, SB 942, NYC LL144, Nevada health law, the Delete Act, GLBA, CAN-SPAM, and FTC rules.
+
+---
+
+## 8. Verify before relying
+
+Colorado's replacement AI law text and date · Vermont and Nebraska children's-code dates · the TCPA universal-revocation effective date · VPPA scope · state mini-TCPA and mini-wiretap lists · genetic-privacy specifics per state · SaaS sales-tax nexus.

package/dist/app-sidecar-auth-broadcast.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=app-sidecar-auth-broadcast.test.d.ts.map

package/dist/app-sidecar-auth-broadcast.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-sidecar-auth-broadcast.test.d.ts","sourceRoot":"","sources":["../src/app-sidecar-auth-broadcast.test.ts"],"names":[],"mappings":""}

package/dist/app-sidecar-auth-broadcast.test.js

@@ -0,0 +1,348 @@
+import fs from "node:fs/promises";
+import http from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+/**
+ * Boots the REAL app sidecar daemon and drives it over HTTP, because the bug
+ * being covered is cross-session: connecting a provider in one window has to
+ * refresh the model picker in every window. A per-session unit test cannot see
+ * that — the whole failure lives in which SSE streams receive the frame.
+ */
+const SIDECAR = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "dist", "app-sidecar.js");
+let tmpHome;
+let tmpProject;
+let daemon;
+let port = 0;
+const openStreams = [];
+/** Start the daemon on an ephemeral port and wait for its listening handshake. */
+async function startDaemon() {
+    daemon = spawn(process.execPath, [SIDECAR], {
+        cwd: tmpProject,
+        env: {
+            ...process.env,
+            HOME: tmpHome,
+            USERPROFILE: tmpHome,
+            GG_APP_CWD: tmpProject,
+            GG_APP_PORT: "0",
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    port = await new Promise((resolve, reject) => {
+        let out = "";
+        const timer = setTimeout(() => reject(new Error(`daemon never listened: ${out}`)), 60_000);
+        daemon.stdout.on("data", (chunk) => {
+            out += chunk;
+            const match = /GG_APP_LISTENING (\d+)/.exec(out);
+            if (match) {
+                clearTimeout(timer);
+                resolve(Number(match[1]));
+            }
+        });
+        daemon.on("error", reject);
+        daemon.on("exit", (code) => reject(new Error(`daemon exited (${code}): ${out}`)));
+    });
+}
+function request(method, urlPath, opts = {}) {
+    return new Promise((resolve, reject) => {
+        const payload = opts.body === undefined ? undefined : JSON.stringify(opts.body);
+        const req = http.request({
+            host: "127.0.0.1",
+            port,
+            path: urlPath,
+            method,
+            headers: {
+                ...(payload ? { "content-type": "application/json" } : {}),
+                ...(opts.session ? { "x-ez-session": opts.session } : {}),
+            },
+        }, (res) => {
+            let raw = "";
+            res.on("data", (c) => {
+                raw += c;
+            });
+            res.on("end", () => {
+                try {
+                    resolve({ status: res.statusCode ?? 0, json: raw ? JSON.parse(raw) : {} });
+                }
+                catch {
+                    resolve({ status: res.statusCode ?? 0, json: {} });
+                }
+            });
+        });
+        req.on("error", reject);
+        if (payload)
+            req.write(payload);
+        req.end();
+    });
+}
+/** Open a window's SSE stream and collect the event types it receives. */
+function openEventStream(session) {
+    return new Promise((resolve, reject) => {
+        const types = [];
+        const req = http.request({ host: "127.0.0.1", port, path: `/events?session=${session}`, method: "GET" }, (res) => {
+            openStreams.push(res);
+            let buf = "";
+            res.on("data", (chunk) => {
+                buf += chunk;
+                let split = buf.indexOf("\n\n");
+                while (split !== -1) {
+                    const frame = buf.slice(0, split);
+                    buf = buf.slice(split + 2);
+                    for (const line of frame.split("\n")) {
+                        if (!line.startsWith("data: "))
+                            continue;
+                        try {
+                            types.push(JSON.parse(line.slice(6)).type);
+                        }
+                        catch {
+                            // Non-JSON keepalives are not events.
+                        }
+                    }
+                    split = buf.indexOf("\n\n");
+                }
+            });
+            resolve({ types });
+        });
+        req.on("error", reject);
+        req.end();
+    });
+}
+async function createSession() {
+    const res = await request("POST", "/session", {
+        body: { mode: "code", cwd: tmpProject },
+    });
+    expect(res.status).toBe(200);
+    return res.json.sessionId;
+}
+async function waitFor(predicate, timeoutMs = 15_000) {
+    const deadline = Date.now() + timeoutMs;
+    while (!predicate()) {
+        if (Date.now() > deadline)
+            throw new Error("timed out waiting for condition");
+        await new Promise((r) => setTimeout(r, 25));
+    }
+}
+beforeEach(async () => {
+    tmpHome = await fs.mkdtemp(path.join(os.tmpdir(), "ez-models-home-"));
+    tmpProject = await fs.mkdtemp(path.join(os.tmpdir(), "ez-models-project-"));
+    await fs.mkdir(path.join(tmpHome, ".ezcoder"), { recursive: true });
+    // No auth.json: the daemon is boot-tolerant when logged out, which is exactly
+    // the state a user is in right before they connect their first provider.
+    await fs.writeFile(path.join(tmpHome, ".ezcoder", "settings.json"), JSON.stringify({ autoCompact: false }));
+    await startDaemon();
+});
+afterEach(async () => {
+    for (const stream of openStreams.splice(0))
+        stream.destroy();
+    const runningDaemon = daemon;
+    daemon = undefined;
+    if (runningDaemon && runningDaemon.exitCode === null && runningDaemon.signalCode === null) {
+        await new Promise((resolve) => {
+            const timer = setTimeout(resolve, 10_000);
+            runningDaemon.once("close", () => {
+                clearTimeout(timer);
+                resolve();
+            });
+            runningDaemon.kill("SIGKILL");
+        });
+    }
+    const removeOptions = { recursive: true, force: true, maxRetries: 10, retryDelay: 100 };
+    await fs.rm(tmpHome, removeOptions);
+    await fs.rm(tmpProject, removeOptions);
+});
+describe("connecting a provider", () => {
+    it("refreshes models in every window, not just the one that connected", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        const streamA = await openEventStream(windowA);
+        const streamB = await openEventStream(windowB);
+        // Logged out: no provider's models are offered yet.
+        const before = await request("GET", "/models", { session: windowA });
+        expect(before.json.models).toEqual([]);
+        // Connect a provider from window A only.
+        const connect = await request("POST", "/auth/apikey", {
+            session: windowA,
+            body: { provider: "xai", key: "sk-test-key" },
+        });
+        expect(connect.status).toBe(200);
+        // Both windows must be told, because ~/.ezcoder/auth.json is shared. Without the
+        // fan-out, window B's picker stayed stale until the session was reopened.
+        await waitFor(() => streamA.types.includes("models_change"));
+        await waitFor(() => streamB.types.includes("models_change"));
+        // And the refetch each window now performs actually returns the new models.
+        const after = await request("GET", "/models", { session: windowB });
+        const models = after.json.models;
+        expect(models.length).toBeGreaterThan(0);
+        expect(models.every((m) => m.provider === "xai")).toBe(true);
+    }, 90_000);
+    it("closes the login modal in every window via auth_done", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        const streamA = await openEventStream(windowA);
+        const streamB = await openEventStream(windowB);
+        await request("POST", "/auth/apikey", {
+            session: windowA,
+            body: { provider: "xai", key: "sk-test-key" },
+        });
+        // auth_done closes the modal; auth_change refreshes the connection dots.
+        // A second window sitting on the login screen needs both.
+        await waitFor(() => streamA.types.includes("auth_done"));
+        await waitFor(() => streamB.types.includes("auth_done"));
+        await waitFor(() => streamA.types.includes("auth_change"));
+        await waitFor(() => streamB.types.includes("auth_change"));
+    }, 90_000);
+});
+describe("OAuth login across windows", () => {
+    /** Park an Anthropic OAuth flow at its "paste the code" step in one window. */
+    async function startParkedLogin(session) {
+        const stream = await openEventStream(session);
+        const started = await request("POST", "/auth/oauth/start", {
+            session,
+            body: { provider: "anthropic" },
+        });
+        expect(started.status).toBe(202);
+        // The flow opens a browser URL, then blocks on the pasted code.
+        await waitFor(() => stream.types.includes("auth_need_code"));
+        return stream;
+    }
+    it("keeps login progress in the window that started it", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        const streamB = await openEventStream(windowB);
+        const streamA = await startParkedLogin(windowA);
+        expect(streamA.types).toContain("auth_url");
+        expect(streamA.types).toContain("auth_need_code");
+        // Window B never pressed Connect — opening its browser or prompting it for
+        // a code it does not have would be nonsense. Progress stays scoped.
+        expect(streamB.types).not.toContain("auth_url");
+        expect(streamB.types).not.toContain("auth_need_code");
+    }, 90_000);
+    it("refuses a second window's login for the same provider", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        await startParkedLogin(windowA);
+        // Two flows for one provider means two browser tabs and two token
+        // exchanges racing to write the same auth.json entry. The per-session
+        // guard cannot see across windows; the daemon-wide one must.
+        const second = await request("POST", "/auth/oauth/start", {
+            session: windowB,
+            body: { provider: "anthropic" },
+        });
+        expect(second.status).toBe(409);
+        expect(String(second.json.error)).toContain("another window");
+    }, 90_000);
+    it("allows a different provider to log in concurrently", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        await startParkedLogin(windowA);
+        // The guard is per provider, not a global lock: connecting Anthropic in
+        // one window must not block connecting OpenAI in another.
+        const other = await request("POST", "/auth/oauth/start", {
+            session: windowB,
+            body: { provider: "openai" },
+        });
+        expect(other.status).toBe(202);
+    }, 90_000);
+    it("reports a failed login only to the window that attempted it", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        const streamB = await openEventStream(windowB);
+        const streamA = await startParkedLogin(windowA);
+        // A malformed code fails the state check locally — no network needed.
+        const sent = await request("POST", "/auth/oauth/code", {
+            session: windowA,
+            body: { code: "bogus#mismatch" },
+        });
+        expect(sent.status).toBe(200);
+        await waitFor(() => streamA.types.includes("auth_error"));
+        // Window B attempted nothing, so it has no failure to report. Its modal
+        // correctly still offers to connect.
+        expect(streamB.types).not.toContain("auth_error");
+    }, 90_000);
+    it("frees the provider again after a failed login", async () => {
+        const windowA = await createSession();
+        const windowB = await createSession();
+        const streamA = await startParkedLogin(windowA);
+        await request("POST", "/auth/oauth/code", {
+            session: windowA,
+            body: { code: "bogus#mismatch" },
+        });
+        await waitFor(() => streamA.types.includes("auth_error"));
+        // A failed attempt must release the daemon-wide guard, or the provider
+        // would be permanently unloggable until the app restarts.
+        const retry = await request("POST", "/auth/oauth/start", {
+            session: windowB,
+            body: { provider: "anthropic" },
+        });
+        expect(retry.status).toBe(202);
+    }, 90_000);
+});
+/**
+ * Providers that accept subscription OAuth AND an API key (Kimi, Grok) hold two
+ * independent credentials. The app renders a per-method comparison and per-method
+ * disconnect from this payload, so a single "connected" bit is not enough.
+ */
+describe("dual-auth providers (OAuth + API key)", () => {
+    async function providerStatus(session, value) {
+        const res = await request("GET", "/auth/status", { session });
+        expect(res.status).toBe(200);
+        const providers = res.json.providers;
+        const found = providers.find((p) => p.value === value);
+        expect(found).toBeDefined();
+        return found;
+    }
+    it("offers Grok both methods, with guidance and the priority rule", async () => {
+        const session = await createSession();
+        const xai = await providerStatus(session, "xai");
+        expect(xai.methods).toEqual(["oauth", "apikey"]);
+        expect(xai.connected).toBe(false);
+        expect(xai.connectedMethods).toEqual([]);
+        // The UI cannot invent this copy — the choice changes what the user is billed.
+        const guidance = xai.methodGuidance;
+        expect(guidance.map((g) => g.method)).toEqual(["oauth", "apikey"]);
+        expect(String(xai.priorityNote)).toMatch(/used first/i);
+    }, 90_000);
+    it("reports which method is connected and which one requests will use", async () => {
+        const session = await createSession();
+        await request("POST", "/auth/apikey", {
+            session,
+            body: { provider: "xai", key: "xai-test-key" },
+        });
+        const xai = await providerStatus(session, "xai");
+        expect(xai.connected).toBe(true);
+        // Key only: it is both connected and active, and OAuth is still on offer.
+        expect(xai.connectedMethods).toEqual(["apikey"]);
+        expect(xai.activeMethod).toBe("apikey");
+        expect(xai.oauthExhaustedUntil).toBeUndefined();
+    }, 90_000);
+    it("disconnects one method without dropping the other", async () => {
+        const session = await createSession();
+        // Write both credentials directly: an OAuth login needs a real browser, and
+        // what matters here is the two-credential state the app has to manage.
+        await fs.writeFile(path.join(tmpHome, ".ezcoder", "auth.json"), JSON.stringify({
+            xai: { accessToken: "key", refreshToken: "", expiresAt: Date.now() + 1_000_000 },
+            "xai-oauth": {
+                accessToken: "oauth",
+                refreshToken: "r",
+                expiresAt: Date.now() + 1_000_000,
+                baseUrl: "https://cli-chat-proxy.grok.com/v1",
+            },
+        }));
+        const both = await providerStatus(session, "xai");
+        expect(both.connectedMethods).toEqual(["oauth", "apikey"]);
+        // Both on file → the subscription is what actually gets used.
+        expect(both.activeMethod).toBe("oauth");
+        // Dropping a spent API key must not sign the user out of the subscription.
+        const out = await request("POST", "/auth/logout", {
+            session,
+            body: { provider: "xai", method: "apikey" },
+        });
+        expect(out.status).toBe(200);
+        const after = await providerStatus(session, "xai");
+        expect(after.connectedMethods).toEqual(["oauth"]);
+        expect(after.connected).toBe(true);
+    }, 90_000);
+});
+//# sourceMappingURL=app-sidecar-auth-broadcast.test.js.map

package/dist/app-sidecar-auth-broadcast.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-sidecar-auth-broadcast.test.js","sourceRoot":"","sources":["../src/app-sidecar-auth-broadcast.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAA4B,MAAM,oBAAoB,CAAC;AAErE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE;;;;;GAKG;AACH,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,IAAI,EACJ,MAAM,EACN,gBAAgB,CACjB,CAAC;AAEF,IAAI,OAAe,CAAC;AACpB,IAAI,UAAkB,CAAC;AAEvB,IAAI,MAA0B,CAAC;AAC/B,IAAI,IAAI,GAAG,CAAC,CAAC;AACb,MAAM,WAAW,GAA2B,EAAE,CAAC;AAE/C,kFAAkF;AAClF,KAAK,UAAU,WAAW;IACxB,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE;QAC1C,GAAG,EAAE,UAAU;QACf,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,OAAO;YACpB,UAAU,EAAE,UAAU;YACtB,WAAW,EAAE,GAAG;SACjB;QACD,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IAEH,IAAI,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAC3F,MAAO,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YAClC,GAAG,IAAI,KAAK,CAAC;YACb,MAAM,KAAK,GAAG,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjD,IAAI,KAAK,EAAE,CAAC;gBACV,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,MAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,OAAO,CACd,MAAc,EACd,OAAe,EACf,OAA6C,EAAE;IAE/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB;YACE,IAAI,EAAE,WAAW;YACjB,IAAI;YACJ,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE;gBACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1D,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1D;SACF,EACD,CAAC,GAAG,EAAE,EAAE;YACN,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;gBACnB,GAAG,IAAI,CAAC,CAAC;YACX,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC7E,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO;YAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CACtB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,mBAAmB,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAC9E,CAAC,GAAG,EAAE,EAAE;YACN,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACtB,IAAI,GAAG,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;gBACvB,GAAG,IAAI,KAAK,CAAC;gBACb,IAAI,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAChC,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;oBACpB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;oBAClC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;oBAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;wBACrC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;4BAAE,SAAS;wBACzC,IAAI,CAAC;4BACH,KAAK,CAAC,IAAI,CAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC,IAAI,CAAC,CAAC;wBACnE,CAAC;wBAAC,MAAM,CAAC;4BACP,sCAAsC;wBACxC,CAAC;oBACH,CAAC;oBACD,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QACrB,CAAC,CACF,CAAC;QACF,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE;QAC5C,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE;KACxC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,IAAI,CAAC,SAAmB,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,SAAwB,EAAE,SAAS,GAAG,MAAM;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC9E,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACtE,UAAU,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAC5E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,CAAC,EAC/C,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CACvC,CAAC;IACF,MAAM,WAAW,EAAE,CAAC;AACtB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,KAAK,MAAM,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,MAAM,CAAC;IAC7B,MAAM,GAAG,SAAS,CAAC;IACnB,IAAI,aAAa,IAAI,aAAa,CAAC,QAAQ,KAAK,IAAI,IAAI,aAAa,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC1C,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;gBAC/B,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC;IACD,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACxF,MAAM,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACpC,MAAM,EAAE,CAAC,EAAE,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AACzC,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,oDAAoD;QACpD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEvC,yCAAyC;QACzC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,iFAAiF;QACjF,0EAA0E;QAC1E,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC7D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAE7D,4EAA4E;QAC5E,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,MAAgC,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/D,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE;SAC9C,CAAC,CAAC;QAEH,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;QACzD,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;QAC3D,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC;IAC7D,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,+EAA+E;IAC/E,KAAK,UAAU,gBAAgB,CAAC,OAAe;QAC7C,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACzD,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,gEAAgE;QAChE,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAClD,2EAA2E;QAC3E,oEAAoE;QACpE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACxD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhC,kEAAkE;QAClE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACxD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAChE,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhC,wEAAwE;QACxE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE;SAC7B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,sEAAsE;QACtE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YACrD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1D,wEAAwE;QACxE,qCAAqC;QACrC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACpD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAEhD,MAAM,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE;YACxC,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QAE1D,uEAAuE;QACvE,0DAA0D;QAC1D,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,mBAAmB,EAAE;YACvD,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE;SAChC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,QAAQ,CAAC,uCAAuC,EAAE,GAAG,EAAE;IACrD,KAAK,UAAU,cAAc,CAAC,OAAe,EAAE,KAAa;QAC1D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,CAAC,SAAsC,CAAC;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5B,OAAO,KAAM,CAAC;IAChB,CAAC;IAED,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEjD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACzC,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,GAAG,CAAC,cAAuD,CAAC;QAC7E,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE;SAC/C,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,0EAA0E;QAC1E,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,aAAa,EAAE,CAAC;IAClD,CAAC,EAAE,MAAM,CAAC,CAAC;IAEX,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,EAAE,CAAC,SAAS,CAChB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,WAAW,CAAC,EAC3C,IAAI,CAAC,SAAS,CAAC;YACb,GAAG,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE;YAChF,WAAW,EAAE;gBACX,WAAW,EAAE,OAAO;gBACpB,YAAY,EAAE,GAAG;gBACjB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;gBACjC,OAAO,EAAE,oCAAoC;aAC9C;SACF,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC3D,8DAA8D;QAC9D,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExC,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE;YAChD,OAAO;YACP,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE;SAC5C,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE7B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAClD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC,EAAE,MAAM,CAAC,CAAC;AACb,CAAC,CAAC,CAAC"}

package/dist/app-sidecar-sessions.d.ts

@@ -3,6 +3,9 @@ import { type RecentSession } from "./core/project-discovery.js";
 export type SidecarSession = RecentSession & {
     chatAgent?: ChatAgentId;
 };
-/** List coding or chat sessions using the caps exposed by the ezcoder-app sidecar. */
-export declare function listSidecarSessions(cwd: string, requestedAgent: string | null, coderSessionsDir: string): Promise<SidecarSession[]>;
+/**
+ * List coding or chat sessions using the caps exposed by the ezcoder-app sidecar.
+ * `homeDir` lets tests point Claude Code / Codex lookup at a fixture home.
+ */
+export declare function listSidecarSessions(cwd: string, requestedAgent: string | null, coderSessionsDir: string, homeDir?: string): Promise<SidecarSession[]>;
 //# sourceMappingURL=app-sidecar-sessions.d.ts.map

package/dist/app-sidecar-sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-sidecar-sessions.d.ts","sourceRoot":"","sources":["../src/app-sidecar-sessions.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAKrF,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG;IAAE,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAEzE,sFAAsF;AACtF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,gBAAgB,EAAE,MAAM,GACvB,OAAO,CAAC,cAAc,EAAE,CAAC,CAgC3B"}
+{"version":3,"file":"app-sidecar-sessions.d.ts","sourceRoot":"","sources":["../src/app-sidecar-sessions.ts"],"names":[],"mappings":"AAEA,OAAO,EAIL,KAAK,WAAW,EACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAGL,KAAK,aAAa,EACnB,MAAM,6BAA6B,CAAC;AAOrC,MAAM,MAAM,cAAc,GAAG,aAAa,GAAG;IAAE,SAAS,CAAC,EAAE,WAAW,CAAA;CAAE,CAAC;AAEzE;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,MAAM,EACX,cAAc,EAAE,MAAM,GAAG,IAAI,EAC7B,gBAAgB,EAAE,MAAM,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,cAAc,EAAE,CAAC,CAqC3B"}

package/dist/app-sidecar-sessions.js

@@ -1,16 +1,22 @@
 import fs from "node:fs/promises";
 import { CHAT_AGENT_IDS, chatAgentSessionsDir, sessionsDirForChatAgent, } from "./chat-agents/index.js";
-import { listRecentSessions } from "./core/project-discovery.js";
+import { listForeignSessions, listRecentSessions, } from "./core/project-discovery.js";
 const CODING_SESSION_LIMIT = 5;
 const CHAT_SESSION_LIMIT = 30;
-/** List coding or chat sessions using the caps exposed by the ezcoder-app sidecar. */
-export async function listSidecarSessions(cwd, requestedAgent, coderSessionsDir) {
+/** Foreign rows are additive, so keep them a short tail under the native list. */
+const FOREIGN_SESSION_LIMIT = 5;
+/**
+ * List coding or chat sessions using the caps exposed by the ezcoder-app sidecar.
+ * `homeDir` lets tests point Claude Code / Codex lookup at a fixture home.
+ */
+export async function listSidecarSessions(cwd, requestedAgent, coderSessionsDir, homeDir) {
     if (requestedAgent !== "all") {
-        const sessionsDir = requestedAgent
-            ? sessionsDirForChatAgent(coderSessionsDir, requestedAgent)
-            : coderSessionsDir;
-        const sessionLimit = requestedAgent ? CHAT_SESSION_LIMIT : CODING_SESSION_LIMIT;
-        return listRecentSessions(cwd, sessionLimit, sessionsDir);
+        // Chat agents have their own private stores; only the coding list (no
+        // requested agent) shares a cwd with Claude Code and Codex.
+        if (requestedAgent) {
+            return listRecentSessions(cwd, CHAT_SESSION_LIMIT, sessionsDirForChatAgent(coderSessionsDir, requestedAgent));
+        }
+        return listCodingSessions(cwd, coderSessionsDir, homeDir);
     }
     const groups = await Promise.all(CHAT_AGENT_IDS.map(async (agentId) => {
         const sessions = await listRecentSessions(cwd, CHAT_SESSION_LIMIT, chatAgentSessionsDir(coderSessionsDir, agentId));
@@ -28,4 +34,24 @@ export async function listSidecarSessions(cwd, requestedAgent, coderSessionsDir)
         .slice(0, CHAT_SESSION_LIMIT)
         .map(({ session }) => session);
 }
+/**
+ * EZ Coder's own sessions for this project plus any Claude Code / Codex
+ * transcripts recorded against the same cwd.
+ *
+ * The project picker already surfaces those stores, so a project can appear
+ * *because* it has Claude Code history and then show an empty session list.
+ * Foreign rows close that gap; the app imports one on click and opens it.
+ *
+ * A foreign store being slow or unreadable must never empty the native list,
+ * so its failure degrades to "no foreign rows".
+ */
+async function listCodingSessions(cwd, coderSessionsDir, homeDir) {
+    const [native, foreign] = await Promise.all([
+        listRecentSessions(cwd, CODING_SESSION_LIMIT, coderSessionsDir),
+        listForeignSessions(cwd, FOREIGN_SESSION_LIMIT, homeDir).catch(() => []),
+    ]);
+    // Native first: a session already resumable here beats one that needs an
+    // import, even when the foreign transcript is a little newer.
+    return [...native, ...foreign];
+}
 //# sourceMappingURL=app-sidecar-sessions.js.map