@saadnvd1/agent-os 0.3.462 → 0.3.464

package/README.md

@@ -947,7 +947,7 @@ it may do on its own, and the lines that always come back to you as asks.
 - **Decision log:** `note` and the brakes and escalations write to
   `orchestrator_notes`, and each line shows in its chat.
 - **Standing rules:** what it must keep knowing ("never merge #111", "briefs
-  must not name competitors") it keeps with `rule_add` and drops with
+  must not name third-party products") it keeps with `rule_add` and drops with
   `rule_remove`, in `orchestrator_rules`. You see, add, edit and remove them in
   Settings → Workspaces, each change with your passkey (any process on the
   machine reaches the route, and a rule of yours is your word to it). A rule restricts or informs; it never approves an
@@ -1241,6 +1241,10 @@ scripts/redeploy     # pull, install, build; restarts via $AGENTOS_RESTART only
 scripts/redeploy --rollback  # put the previous build back and restart
 ```
 
+One Node process serves every terminal, chat stream and request, so a route
+handler in `app/api/` may not call a `*Sync` child_process or fs function:
+ESLint refuses it. Use the async form with a timeout.
+
 `scripts/redeploy` (and `scripts/autodeploy`, which calls it) builds into
 `.next-build` while the live server keeps serving `.next`. The build is swapped
 in by rename only once it finished with a `BUILD_ID`, right before the restart.
@@ -1269,7 +1273,12 @@ added lines for token-shaped secrets with the merge gate's own rule
 (`scripts/hooks/staged-secrets.ts` reads `secretsIn` from
 `lib/orchestrator/diff.ts`), naming the file and line. Build a test's fake
 token at runtime (`"gh" + "p_" + "a".repeat(36)`) rather than writing it
-whole. It runs in the worktrees AgentOS makes too, which have no `.husky/_`
+whole. It also refuses words that must not land in this public repo
+(`scripts/hooks/banned-terms.ts`): a short built-in list, plus, when it
+exists, a private list of regexes kept outside the repo in
+`~/.config/agent-os/banned-names` (`AGENTOS_BANNED_NAMES` overrides the
+path), checked against added lines and file names; `scripts/check` runs the
+same check over every tracked file. It runs in the worktrees AgentOS makes too, which have no `.husky/_`
 until `npm install` runs in them. Typecheck, lint and tests are left to CI.
 In an emergency, `git commit --no-verify` skips it. CI runs `scripts/check --build` on every pull request and push to main,
 which also holds the app's first-load JavaScript to a budget

package/app/api/code-search/available/route.ts

@@ -3,7 +3,7 @@ import { isRipgrepAvailable } from "@/lib/code-search";
 
 export async function GET() {
   try {
-    const available = isRipgrepAvailable();
+    const available = await isRipgrepAvailable();
     return NextResponse.json({ available });
   } catch (error) {
     console.error("Error checking ripgrep availability:", error);

package/app/api/code-search/route.ts

@@ -25,9 +25,11 @@ export async function GET(request: NextRequest) {
 
     const expandedPath = path.replace(/^~/, process.env.HOME || "");
 
-    const rawMatches = searchCode(expandedPath, query, {
-      maxResults,
-      contextLines,
+    // A search the client gave up on (a newer keystroke) stops rg.
+    const rawMatches = await searchCode(expandedPath, query, {
+      maxResults: Number.isFinite(maxResults) ? maxResults : 100,
+      contextLines: Number.isFinite(contextLines) ? contextLines : 2,
+      signal: request.signal,
     });
 
     const results = formatSearchResults(rawMatches);

package/app/api/files/upload-temp/route.ts

@@ -1,5 +1,5 @@
 import { NextResponse } from "next/server";
-import fs from "fs";
+import { mkdir, writeFile } from "fs/promises";
 import path from "path";
 import os from "os";
 
@@ -13,9 +13,7 @@ export async function POST(request: Request) {
 
     // Create temp directory for screenshots if it doesn't exist
     const tempDir = path.join(os.tmpdir(), "agent-os-screenshots");
-    if (!fs.existsSync(tempDir)) {
-      fs.mkdirSync(tempDir, { recursive: true });
-    }
+    await mkdir(tempDir, { recursive: true });
 
     // Generate unique filename
     const ext = mimeType?.split("/")[1] || "png";
@@ -28,7 +26,7 @@ export async function POST(request: Request) {
 
     // Decode base64 and write file
     const buffer = Buffer.from(base64, "base64");
-    fs.writeFileSync(filePath, buffer);
+    await writeFile(filePath, buffer);
 
     return NextResponse.json({ path: filePath });
   } catch (error) {

package/app/api/git/file-content/route.ts

@@ -1,7 +1,10 @@
 import { NextRequest, NextResponse } from "next/server";
-import { execFileSync } from "child_process";
+import { execFile } from "child_process";
+import { promisify } from "util";
 import { expandPath } from "@/lib/git-status";
 
+const execFileAsync = promisify(execFile);
+
 /**
  * GET /api/git/file-content?path=...&file=...
  * Get file content from git HEAD (original version before changes)
@@ -30,12 +33,17 @@ export async function GET(request: NextRequest) {
 
     try {
       // Get file content from HEAD
-      const content = execFileSync("git", ["show", `HEAD:${file}`], {
-        cwd: expandedPath,
-        encoding: "utf-8",
-        stdio: ["ignore", "pipe", "pipe"],
-        maxBuffer: 10 * 1024 * 1024, // 10MB
-      });
+      const { stdout: content } = await execFileAsync(
+        "git",
+        ["show", `HEAD:${file}`],
+        {
+          cwd: expandedPath,
+          encoding: "utf-8",
+          maxBuffer: 10 * 1024 * 1024, // 10MB
+          timeout: 30_000,
+          killSignal: "SIGKILL",
+        }
+      );
 
       return NextResponse.json({ content });
     } catch (gitError: unknown) {

package/app/api/git/pr/route.ts

@@ -11,6 +11,20 @@ import {
   getBaseBranch,
 } from "@/lib/pr";
 import { generatePRContent } from "@/lib/pr-generation";
+import { GhBackoffError } from "@/lib/tasks/gh-limit";
+
+// gh's login, or why it can't be asked now: GitHub's rate limit backs every
+// gh call off, and that isn't a missing login.
+async function ghUnavailable(message: string): Promise<NextResponse | null> {
+  try {
+    if (await checkGhCli()) return null;
+  } catch (error) {
+    if (error instanceof GhBackoffError)
+      return NextResponse.json({ error: error.message }, { status: 503 });
+    throw error;
+  }
+  return NextResponse.json({ error: message }, { status: 400 });
+}
 
 // GET /api/git/pr - Get PR status (fast - no AI generation)
 // Use ?generate=true to also generate suggested title/body (slow - uses Claude CLI)
@@ -30,19 +44,16 @@ export async function GET(request: NextRequest) {
     );
   }
 
-  if (!checkGhCli()) {
-    return NextResponse.json(
-      {
-        error:
-          "GitHub CLI not installed or not authenticated. Run 'gh auth login' first.",
-      },
-      { status: 400 }
-    );
-  }
+  const noGh = await ghUnavailable(
+    "GitHub CLI not installed or not authenticated. Run 'gh auth login' first."
+  );
+  if (noGh) return noGh;
 
   try {
-    const branch = getCurrentBranch(path);
-    const baseBranch = getBaseBranch(path);
+    const [branch, baseBranch] = await Promise.all([
+      getCurrentBranch(path),
+      getBaseBranch(path),
+    ]);
 
     // Check if on main/master (can't create PR from there)
     if (branch === "main" || branch === "master") {
@@ -52,11 +63,11 @@ export async function GET(request: NextRequest) {
       );
     }
 
-    // Check if PR already exists
-    const existingPR = getPRForBranch(path, branch);
-
-    // Get commits for listing
-    const commits = getCommitsSinceBase(path, baseBranch);
+    // The existing PR (network) and the commits since base, side by side.
+    const [existingPR, commits] = await Promise.all([
+      getPRForBranch(path, branch),
+      getCommitsSinceBase(path, baseBranch),
+    ]);
 
     // Only generate suggested content if explicitly requested (for PR creation flow)
     let suggestedTitle: string | undefined;
@@ -87,7 +98,7 @@ export async function GET(request: NextRequest) {
       {
         error: error instanceof Error ? error.message : "Failed to get PR info",
       },
-      { status: 500 }
+      { status: error instanceof GhBackoffError ? 503 : 500 }
     );
   }
 }
@@ -123,15 +134,13 @@ export async function POST(request: NextRequest) {
       );
     }
 
-    if (!checkGhCli()) {
-      return NextResponse.json(
-        { error: "GitHub CLI not installed or not authenticated" },
-        { status: 400 }
-      );
-    }
+    const noGh = await ghUnavailable(
+      "GitHub CLI not installed or not authenticated"
+    );
+    if (noGh) return noGh;
 
-    const branch = getCurrentBranch(path);
-    const baseBranch = customBase || getBaseBranch(path);
+    const branch = await getCurrentBranch(path);
+    const baseBranch = customBase || (await getBaseBranch(path));
 
     // Check if on main/master
     if (branch === "main" || branch === "master") {
@@ -142,7 +151,7 @@ export async function POST(request: NextRequest) {
     }
 
     // Check if PR already exists
-    const existingPR = getPRForBranch(path, branch);
+    const existingPR = await getPRForBranch(path, branch);
     if (existingPR) {
       return NextResponse.json(
         { error: "PR already exists for this branch", pr: existingPR },
@@ -151,14 +160,20 @@ export async function POST(request: NextRequest) {
     }
 
     // Create the PR
-    const pr = createPR(path, branch, baseBranch, title, description || "");
+    const pr = await createPR(
+      path,
+      branch,
+      baseBranch,
+      title,
+      description || ""
+    );
 
     return NextResponse.json({ pr }, { status: 201 });
   } catch (error) {
     const message = error instanceof Error ? error.message : "Unknown error";
     return NextResponse.json(
       { error: `Failed to create PR: ${message}` },
-      { status: 500 }
+      { status: error instanceof GhBackoffError ? 503 : 500 }
     );
   }
 }

package/app/api/sessions/[id]/send-keys/route.ts

@@ -2,7 +2,7 @@ import { NextRequest, NextResponse } from "next/server";
 import { getDb, queries, type Session } from "@/lib/db";
 import { hostExec, isRemoteHost } from "@/lib/hosts";
 import { shellQuote } from "@/lib/hosts/ssh";
-import { appendFileSync } from "fs";
+import { appendFile } from "fs/promises";
 import { pasteText, tmux } from "@/lib/tmux/exec";
 
 // Log to file for debugging
@@ -11,9 +11,7 @@ function log(msg: string) {
   const timestamp = new Date().toISOString();
   const line = `[${timestamp}] ${msg}\n`;
   console.log(`[send-keys] ${msg}`);
-  try {
-    appendFileSync(LOG_FILE, line);
-  } catch {}
+  appendFile(LOG_FILE, line).catch(() => {});
 }
 
 // POST /api/sessions/[id]/send-keys - Send text to a tmux session

package/app/api/sessions/[id]/summarize/route.ts

@@ -3,7 +3,7 @@ import { isRemoteHost } from "@/lib/hosts";
 import { spawn } from "child_process";
 import { getDb, queries, type Session } from "@/lib/db";
 import { randomUUID } from "crypto";
-import { readFileSync, existsSync } from "fs";
+import { readFile } from "fs/promises";
 import { homedir } from "os";
 import { pasteText, tmux } from "@/lib/tmux/exec";
 
@@ -36,20 +36,26 @@ function encodeProjectPath(cwd: string): string {
 }
 
 // Read and parse Claude session JSONL file
-function readClaudeSessionHistory(
+async function readClaudeSessionHistory(
   cwd: string,
   claudeSessionId: string
-): string | null {
+): Promise<string | null> {
   const projectPath = encodeProjectPath(cwd);
   const jsonlPath = `${homedir()}/.claude/projects/${projectPath}/${claudeSessionId}.jsonl`;
 
-  if (!existsSync(jsonlPath)) {
-    console.log(`[summarize] JSONL not found: ${jsonlPath}`);
+  let content: string;
+  try {
+    content = await readFile(jsonlPath, "utf-8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      console.log(`[summarize] JSONL not found: ${jsonlPath}`);
+      return null;
+    }
+    console.error(`[summarize] Error reading JSONL:`, error);
     return null;
   }
 
   try {
-    const content = readFileSync(jsonlPath, "utf-8");
     const lines = content.trim().split("\n");
     const messages: string[] = [];
 
@@ -240,7 +246,10 @@ export async function POST(
       const claudeSessionId = await getClaudeSessionId(tmuxSessionName);
       if (claudeSessionId && cwdExpanded) {
         console.log(`[summarize] Found Claude session ID: ${claudeSessionId}`);
-        conversation = readClaudeSessionHistory(cwdExpanded, claudeSessionId);
+        conversation = await readClaudeSessionHistory(
+          cwdExpanded,
+          claudeSessionId
+        );
         if (conversation) {
           console.log(
             `[summarize] Read ${conversation.length} chars from JSONL`

package/app/api/sessions/init-script/route.ts

@@ -73,7 +73,7 @@ export async function POST(request: NextRequest) {
     const scriptContent = generateInitScript(agentCommand);
     const scriptPath = path.join(os.tmpdir(), `agent-os-init-${Date.now()}.sh`);
 
-    fs.writeFileSync(scriptPath, scriptContent, { mode: 0o755 });
+    await fs.promises.writeFile(scriptPath, scriptContent, { mode: 0o755 });
 
     return NextResponse.json({ scriptPath, command: `bash ${scriptPath}` });
   } catch (error) {

package/data/code-search/queries.ts

@@ -22,7 +22,8 @@ async function fetchRipgrepAvailability(): Promise<boolean> {
 
 async function fetchCodeSearch(
   path: string,
-  query: string
+  query: string,
+  signal?: AbortSignal
 ): Promise<SearchResponse> {
   const params = new URLSearchParams({
     path,
@@ -31,7 +32,7 @@ async function fetchCodeSearch(
     contextLines: "2",
   });
 
-  const res = await fetch(`/api/code-search?${params}`);
+  const res = await fetch(`/api/code-search?${params}`, { signal });
   const data = await res.json();
 
   if (!res.ok) {
@@ -53,7 +54,8 @@ export function useRipgrepAvailable() {
 export function useCodeSearch(path: string, query: string, enabled = false) {
   return useQuery({
     queryKey: codeSearchKeys.search(path, query),
-    queryFn: () => fetchCodeSearch(path, query),
+    // A newer query cancels this one, and the server stops its rg.
+    queryFn: ({ signal }) => fetchCodeSearch(path, query, signal),
     enabled: enabled && query.length > 2,
     staleTime: 30000,
     gcTime: 60000,

package/lib/code-search.ts

@@ -1,15 +1,20 @@
-import { execSync, spawnSync } from "child_process";
+import { execFile, spawn } from "child_process";
+import { createInterface } from "readline";
+
+// rg runs off the event loop: a search over a big tree never stalls the
+// server's other requests. It stops at the result cap, the output cap or the
+// timeout, whichever comes first, and when the caller aborts.
+export const SEARCH_TIMEOUT_MS = 10_000;
+export const MAX_RESULTS_CAP = 500;
+const MAX_OUTPUT_BYTES = 5 * 1024 * 1024;
 
 /**
  * Check if ripgrep is available on the system
  */
-export function isRipgrepAvailable(): boolean {
-  try {
-    execSync("which rg", { encoding: "utf-8", stdio: "pipe" });
-    return true;
-  } catch {
-    return false;
-  }
+export function isRipgrepAvailable(): Promise<boolean> {
+  return new Promise((resolve) => {
+    execFile("which", ["rg"], { timeout: 5000 }, (error) => resolve(!error));
+  });
 }
 
 export interface SearchOptions {
@@ -17,6 +22,9 @@ export interface SearchOptions {
   contextLines?: number;
   filePattern?: string;
   caseSensitive?: boolean;
+  /** Stops rg (the request went away). */
+  signal?: AbortSignal;
+  timeoutMs?: number;
 }
 
 export interface SearchMatch {
@@ -38,71 +46,89 @@ export interface FormattedMatch {
   lineText: string;
 }
 
-export function searchCode(
+export async function searchCode(
   workingDir: string,
   query: string,
   options: SearchOptions = {}
-): SearchMatch[] {
-  const { maxResults = 100, contextLines = 2 } = options;
+): Promise<SearchMatch[]> {
+  const { contextLines = 2, signal, timeoutMs = SEARCH_TIMEOUT_MS } = options;
+  const maxResults = Math.min(options.maxResults ?? 100, MAX_RESULTS_CAP);
 
-  try {
-    const args = [
-      "--json",
-      `--max-count=${Math.ceil(maxResults / 10)}`,
-      `--context=${contextLines}`,
-      "--ignore-case",
-      // -e: a query starting with "-" is a pattern, never an option (--pre).
-      "-e",
-      query,
-      "--",
-      ".", // CRITICAL: Tell ripgrep to search current directory explicitly
-    ];
+  const args = [
+    "--json",
+    `--max-count=${Math.ceil(maxResults / 10)}`,
+    `--context=${contextLines}`,
+    "--ignore-case",
+    // -e: a query starting with "-" is a pattern, never an option (--pre).
+    "-e",
+    query,
+    "--",
+    ".", // CRITICAL: Tell ripgrep to search current directory explicitly
+  ];
 
-    const result = spawnSync("rg", args, {
+  return new Promise<SearchMatch[]>((resolve, reject) => {
+    const matches: SearchMatch[] = [];
+    // Ignore stdin so ripgrep doesn't wait for it.
+    const rg = spawn("rg", args, {
       cwd: workingDir,
-      encoding: "utf-8",
-      timeout: 10000,
-      maxBuffer: 1024 * 1024 * 5,
-      stdio: ["ignore", "pipe", "pipe"], // Ignore stdin so ripgrep doesn't wait for it
+      stdio: ["ignore", "pipe", "ignore"],
     });
+    let bytes = 0;
+    let stopped = false;
+    const stop = () => {
+      if (stopped) return;
+      stopped = true;
+      rg.kill("SIGKILL");
+    };
+    const timer = setTimeout(stop, timeoutMs);
+    signal?.addEventListener("abort", stop, { once: true });
+    if (signal?.aborted) stop();
+    const done = () => {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", stop);
+    };
 
-    if (result.error) {
-      throw result.error;
-    }
-
-    // Status 1 = no matches (not an error for ripgrep)
-    if (result.status !== 0 && result.status !== 1) {
-      return [];
-    }
-
-    const output = result.stdout || "";
-    const matches: SearchMatch[] = [];
-    const lines = output.trim().split("\n").filter(Boolean);
-
-    for (const line of lines) {
+    rg.stdout.on("data", (chunk: Buffer) => {
+      bytes += chunk.length;
+      if (bytes > MAX_OUTPUT_BYTES) stop();
+    });
+    const lines = createInterface({ input: rg.stdout, crlfDelay: Infinity });
+    lines.on("line", (line) => {
+      // What rg printed before a stop still counts, up to the cap.
+      if (!line || matches.length >= maxResults) return;
       try {
         const parsed = JSON.parse(line);
-        if (parsed.type === "match") {
-          matches.push(parsed);
-          if (matches.length >= maxResults) break;
-        }
+        if (parsed.type !== "match") return;
+        matches.push(parsed);
+        if (matches.length >= maxResults) stop();
       } catch {
-        continue;
+        // A line cut off at the output cap.
       }
-    }
+    });
 
-    return matches;
-  } catch (error) {
-    console.error("Error in searchCode:", error);
-    // ENOENT = command not found
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
-      throw new Error(
-        "ripgrep (rg) not found. Install with: brew install ripgrep"
-      );
-    }
-    // Other errors - return empty
-    return [];
-  }
+    rg.on("error", (error: NodeJS.ErrnoException) => {
+      done();
+      // ENOENT = command not found
+      if (error.code === "ENOENT") {
+        reject(
+          new Error(
+            "ripgrep (rg) not found. Install with: brew install ripgrep"
+          )
+        );
+        return;
+      }
+      console.error("Error in searchCode:", error);
+      resolve([]);
+    });
+    // "close": stdout is drained, so every line has been read.
+    rg.on("close", (code) => {
+      done();
+      // What it found before a cap, the timeout or an abort stopped it.
+      if (stopped) return resolve(matches);
+      // Status 1 = no matches (not an error for ripgrep)
+      resolve(code === 0 || code === 1 ? matches : []);
+    });
+  });
 }
 
 export function formatSearchResults(matches: SearchMatch[]): FormattedMatch[] {

package/lib/db/queries.ts

@@ -28,6 +28,13 @@ export const queries = {
   getAllSessions: (db: Database.Database) =>
     getStmt(db, `SELECT * FROM sessions ORDER BY updated_at DESC`),
 
+  // The tmux names AgentOS owns, for telling discovered sessions apart.
+  getManagedTmuxNames: (db: Database.Database) =>
+    getStmt(
+      db,
+      `SELECT host_id, tmux_name FROM sessions WHERE tmux_name IS NOT NULL AND tmux_name != ''`
+    ),
+
   updateSessionStatus: (db: Database.Database) =>
     getStmt(
       db,
@@ -196,6 +203,12 @@ export const queries = {
   getProject: (db: Database.Database) =>
     getStmt(db, `SELECT * FROM projects WHERE id = ?`),
 
+  getProjectFolders: (db: Database.Database) =>
+    getStmt(
+      db,
+      `SELECT id, host_id, working_directory, is_uncategorized FROM projects`
+    ),
+
   getAllProjects: (db: Database.Database) =>
     getStmt(
       db,

package/lib/hosts/discover-signature.ts

@@ -1,19 +1,50 @@
-import { getDb, queries, type Project, type Session } from "../db";
+import { getDb, queries } from "../db";
 import { statusDetector } from "../status-detector";
-import { discoverSessions } from "./discover";
+import {
+  discoverSessions,
+  type ManagedTmux,
+  type ProjectFolder,
+} from "./discover";
 
 // What the discovered-sessions list shows, minus activity times: when this
 // changes, browsers refetch /api/tmux/discover (pushed as "discovered").
 // Reads the status detector's last list-sessions, so it runs no tmux.
+//
+// The status hub asks once a second while anyone watches. The answer only
+// moves when the sessions or projects tables are written or tmux is listed
+// anew, so it's recomputed only then, from the columns matching reads.
+let last: { versions: string; listing: object; signature: string } | null =
+  null;
+
+function tableVersions(): string {
+  const rows = getDb()
+    .prepare(
+      `SELECT topic, version FROM change_versions WHERE topic IN ('sessions', 'projects') ORDER BY topic`
+    )
+    .all() as { topic: string; version: number }[];
+  return rows.map((r) => `${r.topic}:${r.version}`).join(",");
+}
+
 export function discoveredSignature(): string {
+  const versions = tableVersions();
+  const listing = statusDetector.listingStamp();
+  if (last && last.versions === versions && last.listing === listing)
+    return last.signature;
   const db = getDb();
   const found = discoverSessions(
     statusDetector.cachedSessions(),
-    queries.getAllProjects(db).all() as Project[],
-    queries.getAllSessions(db).all() as Session[]
+    queries.getProjectFolders(db).all() as ProjectFolder[],
+    queries.getManagedTmuxNames(db).all() as ManagedTmux[]
   );
-  return JSON.stringify([
+  const signature = JSON.stringify([
     found.map((s) => [s.hostId, s.name, s.projectId, s.path]).sort(),
     statusDetector.hostErrors(),
   ]);
+  last = { versions, listing, signature };
+  return signature;
+}
+
+/** Forget the remembered answer (tests). */
+export function resetDiscoveredSignature(): void {
+  last = null;
 }

package/lib/hosts/discover.ts

@@ -27,8 +27,15 @@ const hostKey = (hostId: string | null | undefined, name: string) =>
   `${hostId || "local"}\t${name}`;
 
 /** The project a folder on a machine sits in (the deepest), or null. */
+// Only what matching reads, so a narrow query can feed it.
+export type ProjectFolder = Pick<
+  Project,
+  "id" | "host_id" | "working_directory" | "is_uncategorized"
+>;
+export type ManagedTmux = Pick<Session, "host_id" | "tmux_name">;
+
 export function projectMatcher(
-  projects: Project[]
+  projects: ProjectFolder[]
 ): (hostId: string, path: string) => string | null {
   const dirs = projects
     .filter((p) => !p.is_uncategorized)
@@ -49,8 +56,8 @@ export function projectMatcher(
 
 export function discoverSessions(
   tmuxSessions: TmuxSessionInfo[],
-  projects: Project[],
-  managed: Session[]
+  projects: ProjectFolder[],
+  managed: ManagedTmux[]
 ): DiscoveredSession[] {
   // By machine and name: a session here doesn't hide one elsewhere.
   const managedNames = new Set(