@promptctl/cc-candybar 1.34.0 → 1.35.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptctl/cc-candybar",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "Statusline renderer for Claude Code — a JSON5-configurable DSL with daemon-cached data sources, byte-clean palette-aware composition, and OSC8 click verbs.",
   "type": "module",
   "main": "./dist/index.mjs",
@@ -91,9 +91,9 @@
     "mobx": "^6.15.0"
   },
   "optionalDependencies": {
-    "@promptctl/cc-candybar-darwin-arm64": "1.34.0",
-    "@promptctl/cc-candybar-darwin-x64": "1.34.0",
-    "@promptctl/cc-candybar-linux-x64": "1.34.0",
-    "@promptctl/cc-candybar-linux-arm64": "1.34.0"
+    "@promptctl/cc-candybar-darwin-arm64": "1.35.0",
+    "@promptctl/cc-candybar-darwin-x64": "1.35.0",
+    "@promptctl/cc-candybar-linux-x64": "1.35.0",
+    "@promptctl/cc-candybar-linux-arm64": "1.35.0"
   }
 }

package/src/check.ts

@@ -119,6 +119,11 @@ export function checkPayload(
     weekly: { percentage: 21, resetsAt: nowSec + 5 * 86400 },
     cache: { expiresAt: nowSec + 15 * 60 },
     tmux: { session: "work" },
+    // `ssh: true` for the same reason `tmux.session` is populated: this
+    // fixture deliberately satisfies every gate so a when-gated segment
+    // RENDERS and its template gets checked. A local-looking fixture would
+    // gate the host segment off and let a typo inside it ship.
+    host: { name: "tester-box", user: "tester", ssh: true },
     theme: { effective: effective.theme },
     look: { effective: effective.look },
     // [LAW:one-source-of-truth] Was missing here even though EffectiveGlobals

package/src/config/default-dsl-config.ts

@@ -465,6 +465,31 @@ export const RAW_DEFAULT_DSL_CONFIG = {
     // gates the input variant so unused segments cost nothing.
     "tmux.session": { kind: "input", path: "tmux.session", default: "" },
 
+    // Host identity — which machine this session is on, and whether the user
+    // arrived over SSH. All three come through the augmented payload rather
+    // than `kind: "env"` / `kind: "shell"`, and that is not a style choice:
+    //
+    //   • `host.ssh` CANNOT be an env var here. Variables are evaluated in the
+    //     DAEMON, which is detached and serves every session for this user at
+    //     once — its `SSH_*` env describes whichever shell happened to spawn
+    //     it. The fact is captured by the live client and carried as a wire
+    //     hint (the `termCols` pattern); the payload is the only honest source.
+    //   • `host.name`/`host.user` are machine facts the daemon reads directly,
+    //     so they cost two syscalls instead of a per-render subprocess.
+    //
+    // Defaults are the "unknown" values, and for `ssh` that is `false`: an
+    // absent field (a client too old to send the hint) renders as local, which
+    // is the pre-feature behavior, while the input-fallback chain records a
+    // `last_error` so `cc-candybar debug vars` can still tell the two apart.
+    "host.name": { kind: "input", path: "host.name", default: "" },
+    "host.user": { kind: "input", path: "host.user", default: "" },
+    "host.ssh": {
+      kind: "input",
+      path: "host.ssh",
+      type: "boolean",
+      default: false,
+    },
+
     // Git — every field flows from the daemon's projected GitInfo payload.
     // The DSL's native `kind: "git"` source covers a 6-field subset
     // (branch/sha/dirty/ahead/behind/stash); using `input` here gives the
@@ -803,6 +828,34 @@ export const RAW_DEFAULT_DSL_CONFIG = {
       fg: "foreground",
       when: '{{ ne .tmux.session "" }}',
     },
+    // "You are not on your own machine." Modelled on the git-taculous zsh
+    // theme, which prepends `(%n@%m)` to the prompt under SSH and shows
+    // nothing locally — you already know your own hostname.
+    //
+    // [LAW:dataflow-not-control-flow] Presence IS the signal. There is no SSH
+    // "mode" and no force-on flag (git-taculous's GITTACULOUS_ENABLE_SSH_THEME
+    // would be a flag with no deletion date, [LAW:no-mode-explosion]); the cell
+    // exists exactly when the value says so, like tmux/block/weekly. A user who
+    // wants it always-on overrides this one segment's `when` to `"true"`.
+    //
+    // `bg: "warning"` is load-bearing, not decoration: warning is one of the
+    // hue-ANCHORED palette roots, so it survives every theme, look, and
+    // per-segment hue transposition still reading as an alert. Any other slot
+    // would drift with the hue stepper and could land camouflaged against its
+    // neighbours — exactly what a "wrong machine" warning must never do.
+    // `contrastOn (bgOf)` then derives a readable foreground from whatever that
+    // resolves to, rather than betting a fixed `foreground` stays legible.
+    //
+    // Each half falls back to "?" so a failed hostname/username read renders
+    // `⇄ ?@?` — still unmistakably "remote", and legibly missing its identity
+    // rather than a blank that reads as a rendering bug ([LAW:no-silent-failure]).
+    host: {
+      template:
+        '⇄ {{ .host.user | default "?" }}@{{ .host.name | default "?" }}',
+      bg: "warning",
+      fg: "{{ contrastOn (bgOf) }}",
+      when: "{{ .host.ssh }}",
+    },
     git: {
       template: GIT_TEMPLATE,
       bg: "surface-active",
@@ -1268,6 +1321,12 @@ export const RAW_DEFAULT_DSL_CONFIG = {
         kind: "container",
         direction: "horizontal",
         children: [
+          // Leads the identity row: the first thing to read is WHICH MACHINE,
+          // because it reframes every path and branch to its right. Same
+          // placement git-taculous gives `(%n@%m)` — ahead of the directory.
+          // Gated off entirely on a local session, so the row still opens with
+          // `directory` where it always has.
+          { kind: "segment", name: "host" },
           { kind: "segment", name: "directory" },
           { kind: "segment", name: "gitaculous" },
           { kind: "segment", name: "toolbar" },

package/src/daemon/client.ts

@@ -12,7 +12,7 @@
 import type { ClaudeHookData } from "../utils/claude";
 import { requestOutcome } from "./client-transport";
 import type { RoundTripBudgets, RoundTripOutcome } from "./client-transport";
-import type { Response } from "./protocol";
+import type { ClientHints, Response } from "./protocol";
 
 const CONNECT_TIMEOUT_MS = 50;
 const TOTAL_BUDGET_MS = 150;
@@ -47,14 +47,17 @@ function projectOutput(
 // There is no inline render path; see src/index.ts. The caller is responsible
 // for branching on outcome.kind and deciding whether to kick, display an
 // error glyph, or print the rendered output.
+// [LAW:one-source-of-truth] `hints` carries every fact the daemon cannot
+// observe for itself; it is spread onto the request verbatim so this relay
+// never becomes a second place that decides what the client saw.
 export function tryRenderViaDaemon(
   hookData: ClaudeHookData,
   args: string[],
   cwd: string,
-  termCols?: number,
+  hints: ClientHints,
 ): Promise<ClientOutcome> {
   return requestOutcome(
-    { kind: "render", hookData, args, cwd, termCols },
+    { kind: "render", hookData, args, cwd, ...hints },
     RENDER_BUDGETS,
     projectOutput,
   );

package/src/daemon/protocol.ts

@@ -34,12 +34,61 @@ export interface RenderRequest {
   hookData: ClaudeHookData;
   args: string[];
   cwd: string;
-  // [LAW:single-enforcer] Terminal width is captured at the trust boundary
-  // (the client's env, where COLUMNS/ioctl are meaningful) and trusted by the
-  // daemon. Absence means the client couldn't determine it. The wire field is
-  // typed `number` but the wire is untrusted JSON — callers MUST run it
-  // through sanitizeTermCols at the receive boundary before using it.
+  // ─── Client hints ────────────────────────────────────────────────────────
+  // [LAW:single-enforcer] Facts only the LIVE CLIENT can observe, captured at
+  // the trust boundary and trusted by the daemon. The daemon is detached and
+  // one-per-user, so its own env answers for whichever shell spawned it —
+  // possibly a different session, possibly hours ago. Every field below is
+  // typed here but arrives as untrusted JSON: callers MUST route the request
+  // through parseClientHints at the receive boundary, never read these
+  // directly. See the ClientHints doc block for the absence semantics.
   termCols?: number;
+  ssh?: boolean;
+}
+
+// [LAW:locality-or-seam] The seam for "a fact the daemon cannot observe about
+// the session it is rendering for". `termCols` established the pattern; `ssh`
+// is the second member, and the documented-but-unbuilt client-aware
+// `colorCompatibility: "auto"` is the next. Naming the set as ONE type is what
+// keeps that third addition a field rather than another sanitizer, another
+// wire read, and another parameter threaded through the render path.
+//
+// [LAW:parse-dont-validate] This is the stamped type. `RenderRequest`'s
+// same-named fields are raw JSON of unknown provenance; a `ClientHints` has
+// crossed the checkpoint, so nothing downstream re-checks them.
+//
+// [LAW:types-are-the-program] Both fields are optional, but they mean
+// DIFFERENT things by absence, and each is the strongest true theorem for its
+// own fact:
+//   • `termCols` absent — the client tried and could not determine a width
+//     (no COLUMNS, no TTY on stderr). A genuine "unknown", reachable from any
+//     client version.
+//   • `ssh` absent — the client did not REPORT. A current client always knows
+//     (its own env is total on this question) and so always sends `true` or
+//     `false`; absence therefore means one thing only: a client too old to
+//     carry the field — a real case, because `cc-candybar install` stages a
+//     native binary that does not turn over with the npm package. Collapsing
+//     that to `false` here would fuse "we know it's local" with "we don't
+//     know" ([LAW:no-silent-failure]); instead it travels onward as an absent
+//     payload field, where the DSL input-fallback chain emits the declared
+//     default AND records a `last_error` that `cc-candybar debug vars`
+//     surfaces.
+export interface ClientHints {
+  readonly termCols?: number;
+  readonly ssh?: boolean;
+}
+
+// [LAW:single-enforcer] The ONE checkpoint where wire-supplied client hints
+// become trusted values. Per-field sanitizers stay separate (each fact has its
+// own validity rule) but nothing outside this function calls them, so a new
+// hint cannot reach the render path un-sanitized.
+export function parseClientHints(req: RenderRequest): ClientHints {
+  const termCols = sanitizeTermCols(req.termCols);
+  const ssh = sanitizeSsh(req.ssh);
+  return {
+    ...(termCols !== undefined && { termCols }),
+    ...(ssh !== undefined && { ssh }),
+  };
 }
 
 // [LAW:no-defensive-null-guards] exception: trust boundary. The wire is
@@ -58,6 +107,14 @@ export function sanitizeTermCols(v: unknown): number | undefined {
   return n > MAX_TERM_COLS ? MAX_TERM_COLS : n;
 }
 
+// [LAW:no-defensive-null-guards] exception: trust boundary, same shape as
+// sanitizeTermCols. A non-boolean (absent, or a malformed/hostile frame) is
+// NOT coerced to `false` — the three wire states stay three
+// ([LAW:no-silent-failure]): true, false, and "no answer from this client".
+export function sanitizeSsh(v: unknown): boolean | undefined {
+  return typeof v === "boolean" ? v : undefined;
+}
+
 export interface ShutdownRequest {
   v: number;
   kind: "shutdown";

package/src/daemon/render-payload.ts

@@ -17,7 +17,9 @@
 // resolve falls back to the variable's declared default).
 
 import path from "node:path";
+import os from "node:os";
 import type { ClaudeHookData } from "../utils/claude.js";
+import type { ClientHints } from "./protocol.js";
 import type { DslConfig, VariableDecl } from "../config/dsl-types.js";
 import { walkNodes } from "../config/dsl-types.js";
 import { extractTemplateRefs } from "../config/dsl-loader.js";
@@ -96,6 +98,11 @@ export interface RenderPayload extends ClaudeHookData {
 
   readonly git?: GitPayload;
   readonly tmux?: { readonly session: string };
+  // [LAW:types-are-the-program] REQUIRED for the same reason theme/look are:
+  // the daemon assembles it every render from sources that cannot be "not
+  // requested" (two syscalls and one already-parsed wire hint). The fields
+  // INSIDE it carry the real optionality — see HostPayload.
+  readonly host: HostPayload;
   // [LAW:one-source-of-truth] The daemon-resolved effective theme name —
   // effectiveThemeName(sessionState.theme, globals.palette). The SAME value the
   // rendered basePalette is built from, surfaced so a trigger label can display
@@ -200,6 +207,41 @@ export interface GitPayload {
   readonly prError?: string;
 }
 
+// Which machine this session is on, and whether the user got here over the
+// network. The two halves have DIFFERENT provenance and that is the whole
+// design ([LAW:one-source-of-truth]):
+//
+//   • `name`/`user` are MACHINE facts. Client and daemon are the same machine
+//     by construction — the socket path is UID-derived and the pid mutex is
+//     per-user — so the daemon reading them directly cannot drift from what
+//     the client would have reported. Sending them over the wire would buy
+//     nothing and add a second source.
+//   • `ssh` is a SESSION fact and is the exact opposite: one daemon serves a
+//     local session and an SSH session simultaneously, so the daemon's own env
+//     answers for whichever shell spawned it. It can ONLY arrive as a client
+//     hint. This is the same reasoning that makes `globals.colorCompatibility:
+//     "auto"` deliberately unrepresentable.
+//
+// [LAW:no-silent-failure] Every field is optional because each can genuinely
+// be unknown, and absence is preserved rather than defaulted here: `user` when
+// the uid has no passwd entry, `ssh` when the client predates the hint. Both
+// travel as missing keys to the DSL input-fallback chain, which emits the
+// declared default AND records a `last_error` that `cc-candybar debug vars`
+// surfaces — so "we don't know" stays distinguishable from "we know it's
+// local", which a `?? false` here would have destroyed.
+export interface HostPayload {
+  // The SHORT hostname — `os.hostname()` up to the first dot, the same
+  // projection zsh's `%m` makes. A statusbar cell identifies a machine to a
+  // human; the FQDN is a network address, a different fact, and a separate
+  // field the day something needs it.
+  readonly name?: string;
+  // The EFFECTIVE username from the passwd database, not `$USER`. The env var
+  // is a map that drifts (su/sudo leave it stale); the passwd entry for the
+  // running uid is the territory. Matches zsh's `%n`.
+  readonly user?: string;
+  readonly ssh?: boolean;
+}
+
 export interface SessionPayload {
   readonly cost?: number;
   readonly tokens?: number;
@@ -463,6 +505,72 @@ function projectSpeedHistory(obs: SpeedObservation): string | undefined {
   return rates.join(",");
 }
 
+// ─── Host identity ───────────────────────────────────────────────────────────
+
+/**
+ * The short hostname: everything before the first dot, or the whole string when
+ * there is no dot. `os.hostname()` yields an FQDN on some hosts (macOS's
+ * `mymachine.local`, a DNS-configured server's `web1.prod.example.com`) and a
+ * bare name on others; this makes the rendered cell identify the machine the
+ * same way on both, which is zsh's `%m` and the projection git-taculous shows.
+ *
+ * [LAW:effects-at-boundaries] Pure and total — the syscall stays in readHost.
+ */
+export function shortHostname(hostname: string): string {
+  const dot = hostname.indexOf(".");
+  return dot < 0 ? hostname : hostname.slice(0, dot);
+}
+
+/**
+ * Assemble the host identity for one render.
+ *
+ * [LAW:effects-at-boundaries] Named `read*`, not `project*`, because it is not
+ * pure: two syscalls happen here. That is in bounds — this module IS the
+ * daemon's data-assembly edge, the same edge that reads `process.env.HOME`
+ * below — and the point of the seam is that nothing downstream reads them
+ * again.
+ *
+ * [LAW:no-silent-failure] A throwing syscall (a uid with no passwd entry is the
+ * realistic case, in a stripped container) yields an ABSENT field plus a
+ * description for the caller to log, exactly like a failed git lane — never a
+ * fabricated name, and never an exception: the whole bar must not blank over a
+ * cosmetic cell.
+ */
+function readHost(hints: ClientHints): {
+  readonly host: HostPayload;
+  readonly failures: readonly string[];
+} {
+  const failures: string[] = [];
+  const attempt = (field: string, read: () => string): string | undefined => {
+    try {
+      const value = read();
+      // "" is not a usable identity; treat it as absence so the DSL default
+      // applies rather than rendering an empty `@host` fragment.
+      return value === "" ? undefined : value;
+    } catch (e) {
+      failures.push(`host.${field}: ${String(e)}`);
+      return undefined;
+    }
+  };
+
+  const name = attempt("name", () => shortHostname(os.hostname()));
+  const user = attempt("user", () => os.userInfo().username);
+  return {
+    host: {
+      ...(name !== undefined && { name }),
+      ...(user !== undefined && { user }),
+      // [LAW:one-source-of-truth] Passed straight through from the parsed
+      // hint. The daemon deliberately does NOT consult its own SSH_* env as a
+      // fallback: that env belongs to whichever shell spawned it, so a
+      // "helpful" fallback would confidently mislabel every session that
+      // daemon serves. Absent hint → absent field → declared default + a
+      // recorded last_error, which is the honest report of "not answered".
+      ...(hints.ssh !== undefined && { ssh: hints.ssh }),
+    },
+    failures,
+  };
+}
+
 // ─── Builder ─────────────────────────────────────────────────────────────────
 
 // ─── Config-driven provider gating ───────────────────────────────────────────
@@ -666,6 +774,13 @@ export async function buildRenderPayload(
   // daemon already computes every one of these for renderDsl's options; this
   // is that same struct, threaded to the sole payload assembler.
   effective: EffectiveGlobals,
+  // [LAW:locality-or-seam] The parsed client hints, NOT the raw request — this
+  // function is downstream of the wire checkpoint and never re-sanitizes.
+  // Separate from `effective` on purpose: that struct is resolved globals (what
+  // the config and the session chose), this is observed session context (what
+  // the client saw). Fusing them would put a config-precedence chain and a
+  // trust boundary behind one name.
+  hints: ClientHints,
 ): Promise<RenderPayload> {
   const wants = (prefix: string): boolean =>
     anyPathStartsWith(neededInputPaths, prefix);
@@ -756,6 +871,10 @@ export async function buildRenderPayload(
 
   const gitProjection = projectGitInfo(gitOutcome);
   failures.push(...gitProjection.failures);
+  // Ungated, like `home` below: two syscalls and a hint already in hand, so a
+  // `wants` gate would add a branch and save nothing.
+  const hostProjection = readHost(hints);
+  failures.push(...hostProjection.failures);
   const usageValue = take(usage);
   const todayValue = take(today);
   const contextValue = take(context);
@@ -867,6 +986,7 @@ export async function buildRenderPayload(
     ...(home !== undefined && { home }),
     ...(gitProjection.git !== undefined && { git: gitProjection.git }),
     ...(tmuxValue !== undefined && { tmux: { session: tmuxValue } }),
+    host: hostProjection.host,
     // [LAW:one-source-of-truth] Always present — the daemon resolves every
     // one of these each render (for BuildLineOptions/basePalette), and these
     // are those exact values. No `wants` gate: each costs nothing (already in

package/src/daemon/server.ts

@@ -38,7 +38,7 @@ import {
   PROTOCOL_VERSION,
   encodeFrame,
   makeFrameReader,
-  sanitizeTermCols,
+  parseClientHints,
 } from "./protocol";
 import type { Request, Response } from "./protocol";
 import { GitDataProvider } from "./cache/git";
@@ -836,17 +836,21 @@ async function handleRequest(req: Request): Promise<HandledRequest> {
         req.cwd,
         sessionConfigFile,
       );
-      // [LAW:single-enforcer] Width capture lives at the wire boundary.
-      // The client (Rust + TTY) is the only process that can see the real
-      // terminal; the daemon is detached. We do NOT consult getTerminalWidth's
-      // env/stderr fallbacks here — they would let the daemon's stale
-      // launch-time COLUMNS env shape rendering for a different terminal,
-      // which is exactly the wrong source.
+      // [LAW:parse-dont-validate] The ONE checkpoint for everything the client
+      // observed and the daemon cannot. Raw `req.*` hint fields are not read
+      // past this line; `hints` is the stamped type the render path consumes.
+      //
+      // [LAW:single-enforcer] Every hint is captured client-side because the
+      // daemon is detached and shared: its env answers for whichever shell
+      // spawned it. We do NOT consult getTerminalWidth's env/stderr fallbacks
+      // for width, and we do NOT consult SSH_* for remoteness — both would
+      // describe a different session than the one being rendered.
       // [LAW:one-source-of-truth] Both branches feed raw cols through
       // applyClaudeCodeReserve, so `width` always means "usable cells
       // post-reserve" with no semantic split between wire-supplied and
       // fallback values.
-      const termCols = sanitizeTermCols(req.termCols);
+      const hints = parseClientHints(req);
+      const termCols = hints.termCols;
       const width = applyClaudeCodeReserve(termCols ?? DEFAULT_TERMINAL_WIDTH);
       const renderOpts: BuildLineOptions = { ...RENDER_OPTS_BASE, width };
       // [LAW:dataflow-not-control-flow] Two outcomes fall out of one rule:
@@ -926,6 +930,7 @@ async function handleRequest(req: Request): Promise<HandledRequest> {
           req.cwd,
           entry.state.neededInputPaths,
           effective,
+          hints,
         );
         // [LAW:one-source-of-truth][LAW:dataflow-not-control-flow] basePalette
         // is derived from the same effective theme resolved above — so a theme

package/src/demo/statusline.json5

@@ -47,13 +47,15 @@
   },
 
   // ── Segments: how each piece of data is drawn ────────────────────────────
-  // `bg`/`fg` are palette spec strings. `fg: 'auto'` picks a readable foreground
-  // for the segment's background. `when` hides a segment when it evaluates false.
+  // `bg`/`fg` are palette spec strings, and either may also be a template
+  // that computes a color — `fg: '{{ contrastOn (bgOf) }}'` below picks
+  // black or white, whichever is readable against this segment's own
+  // background. `when` hides a segment when it evaluates false.
   segments: {
     user: {
       template: ' {{ .user }} ',
       bg: 'primary',
-      fg: 'auto',
+      fg: '{{ contrastOn (bgOf) }}',
     },
     directory: {
       template: ' {{ .here }} ',
@@ -63,14 +65,14 @@
     branch: {
       template: ' {{ .branch }} ',
       bg: 'accent',
-      fg: 'auto',
+      fg: '{{ contrastOn (bgOf) }}',
       when: '{{ ne .branch "" }}',   // hidden entirely outside a git repo
       palette: 'gruvbox',      // this segment pulls its OWN palette (per-segment switch)
     },
     model: {
       template: ' {{ .model }} ',
       bg: 'secondary',
-      fg: 'auto',
+      fg: '{{ contrastOn (bgOf) }}',
       when: '{{ ne .model "" }}',
     },
     session: {
@@ -81,7 +83,7 @@
     clock: {
       template: ' {{ .clock }} ',
       bg: 'primary',
-      fg: 'auto',
+      fg: '{{ contrastOn (bgOf) }}',
     },
   },
 

package/src/index.ts

@@ -36,6 +36,33 @@ function detectTermCols(): number | undefined {
   return undefined;
 }
 
+// The env vars an SSH login shell inherits from sshd. Any one of them present
+// and non-empty means this session arrived over the network.
+//
+// [LAW:one-source-of-truth] This vocabulary is mirrored by the Rust client
+// (rust-client/src/main.rs) and diffed by scripts/check-protocol.mjs, which
+// anchors on the declaration below — keep it a named const holding string
+// literals, or repoint the CHECKS row in the same commit. Both runtimes must
+// agree on what "SSH" means or the fast path and the fallback path would
+// disagree about the same session.
+//
+// All three are checked, not just SSH_CONNECTION: SSH_CLIENT is what older
+// sshd builds (and the user's git-taculous zsh theme) key on, and SSH_TTY is
+// the one that survives some `sudo` env_keep policies. Extra names can only
+// widen recall of a fact that is otherwise reported as a plain `false`.
+const SSH_ENV_VARS = ["SSH_CONNECTION", "SSH_CLIENT", "SSH_TTY"] as const;
+
+// [LAW:dataflow-not-control-flow] A fold over the vocabulary, not a chain of
+// ifs — adding a name is a data edit.
+//
+// Unlike detectTermCols this is TOTAL: the client reads its own environment, so
+// "no SSH var set" is the affirmative answer "local", never a failure to
+// determine. It therefore always reports, and the daemon reads an ABSENT `ssh`
+// hint as "this client is too old to answer" rather than as "local".
+function detectSsh(): boolean {
+  return SSH_ENV_VARS.some((name) => (process.env[name] ?? "") !== "");
+}
+
 function showHelpText(): void {
   console.log(HELP_TEXT);
 }
@@ -134,15 +161,18 @@ echo '{"session_id":"test-session","workspace":{"project_dir":"/path/to/project"
     // caches). On daemon miss we spawn detached and emit empty output; the
     // next status-line refresh hits the warm daemon and renders for real.
     //
-    // [LAW:single-enforcer] Terminal width is captured here, in the user's
+    // [LAW:single-enforcer] Client hints are captured here, in the user's
     // shell environment, then trusted by the daemon. The daemon's own env
-    // reflects whichever shell launched it minutes/hours ago, so it can't
-    // measure the active terminal — only the live client can.
+    // reflects whichever shell launched it minutes/hours ago, so it can
+    // measure neither the active terminal nor whether THIS session came in
+    // over SSH — only the live client can. One daemon serves a local session
+    // and an SSH session at the same time, so the answer genuinely differs per
+    // request.
     const outcome = await tryRenderViaDaemon(
       hookData,
       process.argv,
       process.cwd(),
-      detectTermCols(),
+      { termCols: detectTermCols(), ssh: detectSsh() },
     );
     // [LAW:types-are-the-program] Three variants, one per outcome kind. The
     // "kick on every failure" pattern was the load-bearing half of the