@ucsandman/legcli 0.9.0 → 0.10.0

package/docs/runtime-tap.md

@@ -0,0 +1,156 @@
+# Runtime tap: turn boundaries, usage and a safe place to hand off
+
+`src/taps/mod.mjs` is Leg's seam for an agent runtime that publishes structured
+events about itself while it runs. It is optional, it is off until one line
+wires it in, and nothing in Leg depends on it existing.
+
+## The gap it closes
+
+Leg's per-agent taps read whatever each CLI leaves behind: an OAuth usage
+endpoint every 60 s, a rollout file, a transcript tail. None of those says when
+a turn ends. So when a limit lands, `killTree()` fires at an arbitrary instant:
+mid-tool, mid-answer, with a subagent still running. The handoff bundle then
+describes a moment nobody chose.
+
+A runtime that publishes events closes that gap. The tap folds the stream into
+one small record of signals, and the one Leg never had is `cleanBoundary`: the
+turn is closed, no tool call is in flight, no subagent is still running.
+
+| Field | What Leg gains |
+| --- | --- |
+| `turnOpen`, `lastTurnCompletedAt` | where a turn starts and ends, to the millisecond |
+| `inFlightTools` | tool calls requested with no completion yet |
+| `subagentsLive` | subagents still running under this session |
+| `cleanBoundary` | all three at rest: a handoff here loses no work and no answer |
+| `usage.contextPercent`, `contextTokens`, `contextWindow` | how full the window is, which degrades an agent long before a rate limit stops it |
+| `usage.fiveHourPercent`, `sevenDayPercent` (+ their reset times) | the same two windows Leg already stores, without the 60 s poll |
+| `usage.costUsd` | what the session has spent |
+| `model`, `lastError` | which model is answering, and the last tool failure or denial |
+
+## Why the runtime side stays optional
+
+The events come from a plugin installed in the agent's own harness, not from
+anything Leg installs or launches. Leg's launcher needs no new flag, no
+`--plugin-dir`, and no change to any adapter's argv: the plugin is already
+installed, or it is not.
+
+`findEventsFile()` returns `null` when the session has no events file, and that
+is the ordinary case, never an error:
+
+- the runtime has no such plugin installed
+- the plugin is installed but this session has not flushed yet
+- the agent is not the one that writes these events at all (codex, agy, grok)
+
+In every one of those cases the tap does nothing, calls back never, and Leg
+behaves exactly as it does today. That is the acceptance condition for this
+seam: with the events file absent, no Leg behaviour changes.
+
+## Where the events come from
+
+One file per runtime session, JSON per line, appended and flushed on a timer
+and at the end of every main-loop turn:
+
+```
+<config dir>/mods/state/events/<sessionId>.jsonl
+```
+
+`<sessionId>` is the runtime's own session id, which Leg stores as
+`agent_session_id` once its transcript names it (not Leg's `sid`).
+`<config dir>` is the config directory that session ran under, which for Leg is
+`spec.env.CLAUDE_CONFIG_DIR` (each account gets its own). `eventsDirFor()`
+builds that path; `LEG_RUNTIME_EVENTS_DIR` overrides it outright, which is what
+the tests use.
+
+The runtime's own event names live in exactly one place in Leg: the `KIND`
+table at the top of `src/taps/mod.mjs`. `deriveSignals()` and `toLegEvents()`
+read that table, and every shape the tap exports is Leg's own, so a second
+runtime with a different vocabulary is a second table and nothing else.
+
+## Wiring it in (one line)
+
+Two lines total, both in `src/attach.mjs`, neither of which changes any
+existing behaviour.
+
+The import, with the other tap imports (after the `./taps/claude-usage.mjs`
+line):
+
+```js
+import { pollRuntimeTap, eventsDirFor } from './taps/mod.mjs'
+```
+
+The wiring itself, inside `if (agent === 'claude') {`, on the line straight
+after `usageTimer.unref?.()`:
+
+```js
+const runtimeStop = pollRuntimeTap({ sessionId: () => readSession(sid)?.agent_session_id, dir: eventsDirFor(spec.env.CLAUDE_CONFIG_DIR || LAYOUT.claude.home()), onSignals: (signals, { legEvents, advice }) => { for (const ev of legEvents) appendEvent(sid, ev); updateSession(sid, { runtime: { ...signals, advice } }) } })
+```
+
+`readSession`, `updateSession`, `appendEvent` and `LAYOUT` are already imported
+there. `sessionId` is a getter on purpose: neither the id nor the file exists
+when a leg starts, so the tap keeps looking until both do and the caller needs
+no lazy bookkeeping in the poll loop.
+
+Teardown is optional. The interval is `unref`'d, so it never holds the process
+open, and a finished session's file simply stops growing (one `stat` every
+2 s until the leg exits). To stop it exactly, declare `let runtimeStop = null`
+beside `let usageTimer = null`, drop the `const` above, and add
+`runtimeStop?.()` next to `if (usageTimer) clearInterval(usageTimer)`.
+
+What the line buys, immediately: turn-level board events (`turn_done`, the
+prompt, subagents, tool failures) instead of a poll-shaped guess, and a
+`session.runtime` record the board can render.
+
+Two follow-ups this seam makes possible, both deliberately not wired here:
+
+- feed the percentages to the chooser through the door every other tap uses:
+  `recordUsage('claude', account, toLegUsage(signals), 'runtime events')`
+  (`recordUsage` is already imported in `attach.mjs`)
+- hand off at a boundary Leg chose, by acting on `advice.shouldHandoff` in the
+  same place the limit handoff already fires
+
+## Handing off on purpose
+
+`handoffAdvice(signals, thresholds)` answers with `{ shouldHandoff, reason }`.
+Defaults:
+
+| Threshold | Default | Why |
+| --- | --- | --- |
+| `contextPercent` | 80 | a full window degrades an agent long before a limit stops it |
+| `fiveHourPercent` | 90 | just under the wall Leg already hands off at |
+| `sevenDayPercent` | 95 | a last resort; the 7-day window rarely moves first |
+
+Being over a threshold is not enough. Over a threshold but mid-turn returns
+`shouldHandoff: false` with a reason that says what it is waiting for
+("context at 84% of the window, waiting for a clean boundary (a turn is
+open)"), so the board can show the wait rather than a silent stall. A
+percentage the runtime has not published yet never triggers a handoff.
+
+## The API
+
+| Function | Answers |
+| --- | --- |
+| `findEventsFile(sessionId, { dir })` | the path, or `null` when this session publishes nothing |
+| `readRuntimeEvents(path, cursor)` | `{ events, cursor }` from a byte offset; a half-written last line is left for the next read, a truncated file restarts at 0, a corrupt line is skipped |
+| `deriveSignals(events, prev)` | the signals record above; pure, and folding in batches equals folding at once |
+| `toLegEvents(events)` | `{ type, summary }` board events, as `appendEvent(sid, ev)` takes them |
+| `toLegUsage(signals)` | `{ five_hour: { pct, resets_at }, seven_day: ... }`, the window shape `recordUsage()` already stores |
+| `handoffAdvice(signals, thresholds)` | `{ shouldHandoff, reason }` |
+| `pollRuntimeTap({ sessionId, dir, intervalMs, thresholds, onSignals })` | the whole tap on a timer; returns `stop()` |
+
+`emptySignals()` is the zero state, and it is what `deriveSignals([])` returns:
+nothing seen, nothing in flight, every percentage `null`.
+
+## Tests
+
+`test/taps-mod.test.mjs`, 11 tests, run by `node --test`. The fixture
+`fixtures/runtime-events.jsonl` is one real captured session (29 events, one
+turn, four tool calls, the usage frame last) with the local user name scrubbed
+out of the paths and nothing else changed. Subagent, denial and error cases are
+built in the test, because that capture has none.
+
+Covered: incremental reads across a torn line, truncation and a corrupt line;
+`cleanBoundary` shut by an open turn and by a tool with no completion, and
+released by the turn that closes; a live subagent, a denied one, and a tool
+call inside a subagent's own loop; usage extraction and its mapping to Leg's
+window shape; advice at 80% context only at a clean boundary; and the no-file
+fallback, where every entry point answers and nothing throws.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ucsandman/legcli",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Usage-limit monitor and automatic handoff for Claude Code, Codex, agy and Grok. Type leg claude|codex|agy|grok and get the same interactive agent with a board alongside, auto-approve on by default, usage tracking per agent and account, a live context handoff bundle, and at the limit the next agent continuing in the same terminal. $79 once, 30-day money-back guarantee.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/scripts/build-docs-site.mjs

@@ -65,6 +65,13 @@ const PAGES = [
     title: 'The portable harness: carry rules, hooks, skills and MCP servers between agents',
     description: 'How Leg carries the source agent\'s working environment to the agent a handoff lands on, what moves and what does not, the policies, ownership and backups, and how secrets are handled.',
   },
+  {
+    slug: 'history',
+    nav: 'History',
+    source: 'docs/history.md',
+    title: 'Every conversation on this machine: leg history and leg worktrees',
+    description: 'One read-only index over the conversations Claude Code, Codex, Grok, Antigravity and Copilot CLI keep in their own stores, plus the sessions Leg started itself, and every checkout: the support matrix, what is read, what is written, and how to continue one.',
+  },
   {
     slug: 'cli-contracts',
     nav: 'What it reads',

package/src/accounts.mjs

@@ -43,12 +43,15 @@ export const LAYOUT = {
 export function accountsFile() { return join(home(), 'accounts.json') }
 export function accountDir(agent, name) { return join(home(), 'accounts', agent, name) }
 
+const NAME_RE = /^[a-z0-9][a-z0-9_-]{0,29}$/i
+
 export function readAccounts() {
   const base = { claude: ['default'], codex: ['default'], agy: ['default'], grok: ['default'] }
   if (!existsSync(accountsFile())) return base
   try {
     const j = JSON.parse(readFileSync(accountsFile(), 'utf8'))
-    for (const k of Object.keys(base)) if (Array.isArray(j[k])) base[k] = ['default', ...j[k].filter((n) => n !== 'default')]
+    // the same shape addAccount accepts: a name is a directory segment, never a path
+    for (const k of Object.keys(base)) if (Array.isArray(j[k])) base[k] = ['default', ...j[k].filter((n) => typeof n === 'string' && n !== 'default' && NAME_RE.test(n))]
   } catch {}
   return base
 }
@@ -74,7 +77,7 @@ function junction(target, link) {
 
 // Create the account dir, junction the shared harness in, copy the settings.
 export function addAccount(agent, name) {
-  if (!/^[a-z0-9][a-z0-9_-]{0,29}$/i.test(name) || name === 'default') throw new Error(`invalid account name "${name}" (letters, digits, - and _; not "default")`)
+  if (!NAME_RE.test(name) || name === 'default') throw new Error(`invalid account name "${name}" (letters, digits, - and _; not "default")`)
   const l = LAYOUT[agent]
   if (!l) throw new Error(`unknown agent "${agent}" (claude|codex|agy|grok)`)
   if (!l.env) throw new Error(`${agent} has no config-dir override in the installed version; extra accounts are not possible`)

package/src/attach.mjs

@@ -8,6 +8,7 @@
 // same terminal from that bundle. Subscription logins only: API keys are
 // stripped from the child environment (src/env.mjs).
 import http from 'node:http'
+import net from 'node:net'
 import { spawn, spawnSync } from 'node:child_process'
 import { existsSync, mkdirSync, writeFileSync, rmSync } from 'node:fs'
 import { join, dirname, resolve, relative } from 'node:path'
@@ -36,6 +37,7 @@ import { captureLive } from './live-capture.mjs'
 import { waitForReset, fmtCountdown } from './wait.mjs'
 import { readPreferences, normalizeHandoffOrder, resolveAutoApprove } from './preferences.mjs'
 import { prepareHarnessForHandoff, harnessLine } from './harness/index.mjs'
+import { insideKnownStore } from './history/index.mjs'
 
 const SRC = dirname(fileURLToPath(import.meta.url))
 function resolveServer() {
@@ -80,6 +82,19 @@ function health(port, host = '127.0.0.1') {
   })
 }
 
+// Does anything own this port? A completed TCP connect is the question, so a
+// board too busy to answer /api/health still counts as one. Nothing is sent.
+function portTaken(port, host = '127.0.0.1') {
+  return new Promise((res) => {
+    const sock = net.connect({ host: host === '0.0.0.0' ? '127.0.0.1' : host, port })
+    const done = (v) => { sock.destroy(); res(v) }
+    sock.setTimeout(2000)
+    sock.on('connect', () => done(true))
+    sock.on('error', () => done(false))
+    sock.on('timeout', () => done(false))
+  })
+}
+
 export async function ensureBoard({ open = true } = {}) {
   // with share on the board lives on the shared address, not loopback
   const share = readShare()
@@ -88,7 +103,20 @@ export async function ensureBoard({ open = true } = {}) {
   const host = shared ? share.bind : '127.0.0.1'
   const url = `http://${host}:${port}`
   if ((process.env.LEG_NO_BOARD || process.env.BATON_NO_BOARD) === '1') return { url: null, started: false, skipped: true }
-  if (await health(port, host)) return { url, started: false }
+  // the board is opened whether or not this terminal is the one that started
+  // it: `leg claude` in a second terminal still means "show me the board"
+  if (await health(port, host)) { if (open) openBoard(url); return { url, started: false } }
+  // A board that is merely busy misses the health deadline while still owning
+  // the port. Treating that as "no board" spawned a second server that could
+  // only die of EADDRINUSE, and the poll below then waited the full fifteen
+  // seconds for a child already gone — the whole delay before the agent
+  // starts, and the reason no browser ever opened. A listener on the port is
+  // a board: attach to it and open it.
+  if (await portTaken(port, host)) {
+    say(`the board on ${url} is busy; attaching to it`)
+    if (open) openBoard(url)
+    return { url, started: false, busy: true }
+  }
   mkdirSync(home(), { recursive: true })
   const logFd = (await import('node:fs')).openSync(join(home(), 'board.log'), 'a')
   const child = spawn(process.execPath, [SERVER], { detached: true, windowsHide: true, stdio: ['ignore', logFd, logFd], env: { ...process.env, LEG_PORT: String(port), LEG_BIND: host, LEG_QUIET: '0', BATON_PORT: String(port), BATON_BIND: host, BATON_QUIET: '0' } })
@@ -269,6 +297,13 @@ async function runLeg({ agent, account, args, session, prompt, boardUrl, autoApp
 
   // taps
   let rollout = null; let tail = null
+  // a continued codex thread appends to its old rollout, which findRollout
+  // (newest file since this leg started) would never pick: bind it up front
+  // and read only what the thread writes from here on
+  if (agent === 'codex' && !prompt && session.transcript_path && session.agent_session_id && existsSync(session.transcript_path)) {
+    rollout = { path: session.transcript_path, meta: { id: session.agent_session_id } }
+    tail = createTail(rollout.path, { from: logSize(rollout.path) })
+  }
   let polls = 0; let warned = false
   let stop = null
   const done = new Promise((res) => { stop = res })
@@ -536,14 +571,18 @@ function prepareLegHarness({ sid, from, to }) {
 }
 
 // ---- the command ----
-export async function attach(agent, args = [], { open = true } = {}) {
+// `cwd` and `continued` are how `leg history continue` starts a leg on a
+// conversation the agent's own store holds (src/history/cli.mjs): the leg runs
+// in that conversation's folder, shares the checkout (its files are already
+// there), and the session record carries the agent's id from the start.
+export async function attach(agent, args = [], { open = true, cwd: cwdOpt = null, continued = null } = {}) {
   if (!SUPERVISED_AGENTS.includes(agent)) throw new Error(`unknown agent "${agent}" (claude|codex|agy|grok)`)
   // the paid gate: a valid key, or no session (exit 4). The bare agent is never
   // affected; only what Leg adds is licensed.
   const ent = entitlement()
   if (!allows(ent, 'run')) { say(describeLicense(ent)); return 4 }
   // --no-worktree is Leg's flag, not the agent's: it never passes through
-  const shareCheckout = args.includes('--no-worktree')
+  const shareCheckout = args.includes('--no-worktree') || Boolean(continued)
   args = args.filter((a) => a !== '--no-worktree')
   let autoApproveCli = null
   if (args.includes('--no-auto-approve')) {
@@ -554,7 +593,7 @@ export async function attach(agent, args = [], { open = true } = {}) {
     args = args.filter((a) => a !== '--auto-approve')
   }
   const autoApprove = resolveAutoApprove({ cliFlag: autoApproveCli })
-  const cwd = process.cwd()
+  const cwd = cwdOpt ? realPath(cwdOpt) : process.cwd()
   const board = await ensureBoard({ open })
   let accounts = readAccounts()
   const installed = await installedAgents()
@@ -587,6 +626,13 @@ export async function attach(agent, args = [], { open = true } = {}) {
   // `git worktree add` still leaves a card (with a Remove button), never a
   // silent orphan under .baton-worktrees with no record and no button
   createSession({ id: sid, agent, account, cwd, repo: g.repo, branch: g.branch, argv: args, chain, worktree: null, owner: whoami(), handoffOrder, installed, runtimeCapabilities: [HANDOFF_ORDER_CAPABILITY] })
+  if (continued) {
+    // the agent's own id and transcript are known before the first turn, so
+    // history dedups this leg against the conversation it continues at once
+    const safeTranscript = (continued.transcript_path && insideKnownStore(continued.transcript_path)) ? continued.transcript_path : null
+    updateSession(sid, { agent_session_id: continued.native_id ?? null, transcript_path: safeTranscript, task: continued.title ?? null, continued_from: { id: continued.id, provider: continued.provider, native_id: continued.native_id ?? null } },
+      { event: { type: 'continued', summary: `continuing ${continued.id}${continued.title ? `: ${String(continued.title).slice(0, 120)}` : ''}` } })
+  }
   let iso = null
   if (g.repo && !shareCheckout) {
     try { iso = isolate({ g, cwd, sid }) } catch (err) { say(`could not make a worktree (${String(err.message).split('\n')[0].slice(0, 200)}); sharing the checkout`); try { removeWorktree(g.repo, sid) } catch {} }

package/src/board/board.css

@@ -130,6 +130,7 @@
   --id-codex: #69DBBA;   /* oklch(0.815 0.115 172) cool green */
   --id-agy: #CC97F3;     /* oklch(0.760 0.140 310) violet, 46 degrees clear of the accent */
   --id-grok: #70B8FF;    /* oklch(0.750 0.130 240) azure blue */
+  --id-copilot: #F0A3B8; /* oklch(0.790 0.110 5) rose; lists and reads, never runs */
   --id-fake: #A0A6AE;    /* oklch(0.720 0.010 258) the scripted adapter, neutral in hue */
 
   /* type scale. Fixed rem, range 13 to 52. The old board ran 13 to 21, which
@@ -222,6 +223,7 @@ code { font-family: var(--mono); font-size: 0.94em; }
 .dot.id-codex { background: var(--id-codex); }
 .dot.id-agy { background: var(--id-agy); }
 .dot.id-grok { background: var(--id-grok); }
+.dot.id-copilot { background: var(--id-copilot); }
 
 /* ---- logins ------------------------------------------------------------- */
 .logins { display: grid; gap: 20px; }
@@ -323,6 +325,7 @@ code { font-family: var(--mono); font-size: 0.94em; }
 .chip-id-codex { color: var(--id-codex); }
 .chip-id-agy { color: var(--id-agy); }
 .chip-id-grok { color: var(--id-grok); }
+.chip-id-copilot { color: var(--id-copilot); }
 .chip-id-fake { color: var(--id-fake); }
 .chip-state-ok { color: var(--ok-text); }
 .chip-state-warn { color: var(--warn-text); }
@@ -370,7 +373,7 @@ code { font-family: var(--mono); font-size: 0.94em; }
 .drawer-msg-when { font-size: var(--t--1); color: var(--text-3); font-family: var(--mono); }
 
 /* ---- ledger: on the ground, unpanelled --------------------------------- */
-.ledger { margin-top: 56px; display: grid; grid-template-columns: repeat(3, minmax(0, 1fr)); gap: 40px; padding-top: 32px; border-top: 1px solid var(--edge); }
+.ledger { margin-top: 56px; display: grid; grid-template-columns: repeat(4, minmax(0, 1fr)); gap: 40px; padding-top: 32px; border-top: 1px solid var(--edge); }
 .ledger-cell h3 { font-size: var(--t-2); font-weight: var(--w-head); letter-spacing: -.012em; }
 .ledger-cell .region-meta { margin-top: 6px; font-size: var(--t-0); color: var(--text-3); }
 .ledger-actions { margin-top: 18px; display: flex; gap: 10px; flex-wrap: wrap; }
@@ -384,6 +387,23 @@ code { font-family: var(--mono); font-size: 0.94em; }
 .line-main { color: var(--text); }
 .line-meta { color: var(--text-2); }
 .line-when { color: var(--text-3); text-align: right; }
+/* history: the conversations every agent keeps, one row each, opening in place */
+.history-filters { display: grid; grid-template-columns: auto minmax(0, 1fr); gap: 10px 14px; align-items: center; margin: 4px 0 18px; max-width: 64ch; }
+.history-filters label { font-size: var(--t-0); font-weight: var(--w-head); color: var(--text-2); }
+.history-filters label:has(input[type="checkbox"]) { grid-column: 1 / -1; display: flex; align-items: center; gap: 8px; font-weight: var(--w-text); }
+.history-list { display: block; }
+.history-row { display: grid; grid-template-columns: minmax(0, 1fr) auto; gap: 6px 20px; align-items: baseline; padding: 12px 0; font-size: var(--t-0); }
+.history-row + .history-row, .history-row + .history-detail, .history-detail + .history-row { border-top: 1px solid var(--line); }
+.history-title { display: block; width: 100%; text-align: left; background: none; border: 0; padding: 0; font: inherit; color: var(--text); cursor: pointer; line-height: 1.4; }
+.history-title:hover { color: var(--accent-hi); }
+.history-title:focus-visible { outline: 2px solid var(--focus); outline-offset: 3px; border-radius: var(--r-control); }
+.history-register { display: flex; align-items: baseline; gap: 14px; flex-wrap: wrap; font-size: var(--t--1); color: var(--text-3); }
+.history-when { color: var(--text-3); white-space: nowrap; font-size: var(--t--1); }
+.history-detail { padding: 14px 0 20px; }
+.history-detail .kv { margin-bottom: 14px; }
+.history-command { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; margin-top: 12px; font-size: var(--t-0); }
+.history-empty { font-size: var(--t-0); color: var(--text-3); padding: 12px 0; }
+
 .group-head { display: flex; align-items: baseline; gap: 10px; margin-top: 24px; margin-bottom: 4px; font-size: var(--t-0); font-weight: var(--w-head); color: var(--text-2); }
 .group-head:first-child { margin-top: 0; }
 .group-head span { font-weight: var(--w-text); color: var(--text-3); }
@@ -556,6 +576,8 @@ dialog::backdrop { background: rgba(0,0,0,.6); }
   .kv { grid-template-columns: 1fr; gap: 4px 0; }
   .kv-val + .kv-key { margin-top: 12px; }
   .ledger { grid-template-columns: 1fr; gap: 32px; margin-top: 40px; }
+  .history-row { grid-template-columns: 1fr; }
+  .history-filters { grid-template-columns: 1fr; }
   .line { grid-template-columns: 1fr auto; gap: 6px 14px; }
   .line-main { grid-column: 1 / -1; }
   .line-meta { grid-column: 1; }

package/src/board/board.js

@@ -292,6 +292,15 @@
       : `${s === 'reconnecting' ? 'Reconnecting' : 'Connecting'} to Leg on ${state.bind}.`
   }
 
+  // sessions.js owns the terminals region and listens for `leg:sessions`.
+  // `baton:sessions` is the old name, still emitted for anything outside this
+  // page that listens for it; nothing in the board may listen for both, because
+  // each listener rebuilds the whole grid.
+  function publishSessions(detail) {
+    window.dispatchEvent(new CustomEvent('leg:sessions', { detail }))
+    window.dispatchEvent(new CustomEvent('baton:sessions', { detail }))
+  }
+
   function connectSse() {
     if (state.es) { try { state.es.close() } catch { /* ignore */ } }
     const request = ++state.sseRequest
@@ -312,9 +321,12 @@
       // nothing between the drop and this hello was replayed: an open detail
       // region is as old as the gap
       scheduleDrawerRefresh()
-      if (data.sessions) window.dispatchEvent(new CustomEvent('leg:sessions', { detail: data.sessions })); window.dispatchEvent(new CustomEvent('baton:sessions', { detail: data.sessions }));
+      if (data.sessions) publishSessions(data.sessions)
     })
-    es.addEventListener('sessions', (e) => { if (state.es === es && request === state.sseRequest) window.dispatchEvent(new CustomEvent('leg:sessions', { detail: JSON.parse(e.data) })); window.dispatchEvent(new CustomEvent('baton:sessions', { detail: JSON.parse(e.data) })); })
+    // one parse, one publish, and both inside the staleness guard: the missing
+    // braces meant a superseded EventSource still drove a full rebuild, and the
+    // payload (a quarter of a megabyte) was parsed twice to do it
+    es.addEventListener('sessions', (e) => { if (state.es === es && request === state.sseRequest) publishSessions(JSON.parse(e.data)) })
     es.addEventListener('card', (e) => { if (state.es === es && request === state.sseRequest) upsertCard(JSON.parse(e.data)) })
     es.addEventListener('removed', (e) => { if (state.es === es && request === state.sseRequest) dropCard(JSON.parse(e.data).card_id) })
     es.addEventListener('event', (e) => { if (state.es === es && request === state.sseRequest) onLedgerEvent(JSON.parse(e.data)) })