@winding-labs/glow 0.1.1 → 0.1.11

package/lib/core.mjs

@@ -1,4 +1,5 @@
-// Shared by the installer (bin/glow.mjs) and the hook (~/.glow/hook.mjs). Plain Node 18+, no dependencies.
+// Shared by the CLI (bin/glow.mjs), the hook (lib/hook.mjs) and the runner (lib/runner.mjs), all copied to ~/.glow.
+// Plain Node 18+, no dependencies.
 //
 // Safety (docs/security/review-2026-11-02-agent-reports.md):
 //  - The only host this ever talks to is Glow's API: https://app.meetglow.ai (or staging.meetglow.ai), read from
@@ -6,16 +7,17 @@
 //    variable (the hook runs with an empty environment but HOME and PATH). A local API (http://localhost) only when
 //    installed with --dev. Redirects are refused, so the key never follows one.
 //  - The key (glowc_…) can only report sessions, read the linked repo names, and fetch messages for this computer.
-//  - Nothing is sent from a repo that isn't linked to a product in Glow; the reply is masked for keys before it leaves.
+//  - Nothing is sent from a repo that isn't linked to a product in Glow, or that's ignored on this computer (`glow
+//    ignore`: checked before any request); the reply is masked for keys before it leaves.
 //  - git runs without a shell, with hooks, fsmonitor and signature checks off and none of the caller's GIT_* variables,
 //    so a repo (or its .git/config) can't make it run anything.
 import { execFileSync } from 'node:child_process';
-import { createHash, randomBytes } from 'node:crypto';
+import { createHash, createPublicKey, randomBytes, verify } from 'node:crypto';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-export const VERSION = '0.1.1';
+export const VERSION = '0.1.11';
 export const DEFAULT_API = 'https://app.meetglow.ai';
 export const dir = () => path.join(os.homedir(), '.glow');
 export const configPath = () => path.join(dir(), 'config.json');
@@ -54,6 +56,9 @@ export function readConfig() {
 }
 
 /** Atomic, owner-only. */
+/** The repos ignored on this computer (`glow ignore`): nothing is sent from them, linked or not. */
+export const ignoredOf = (c) => (Array.isArray(c?.ignored) ? c.ignored.filter((r) => typeof r === 'string' && REPO_RE.test(r)) : []);
+
 export function writeConfig(c) {
   fs.mkdirSync(dir(), { recursive: true, mode: 0o700 });
   fs.chmodSync(dir(), 0o700);
@@ -99,10 +104,12 @@ export async function api(c, method, p, body, timeoutMs = 10_000) {
 
 // ---------- git ----------
 
+/** Every git run here: no hooks, fsmonitor, signature checks or pager, so nothing of the repo's own runs. */
+export const GIT_SAFE = ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-c', 'log.showSignature=false', '-c', 'core.pager=cat'];
+
 function git(cwd, args) {
   try {
-    const opts = ['-c', 'core.fsmonitor=false', '-c', 'core.hooksPath=/dev/null', '-c', 'log.showSignature=false', '-c', 'core.pager=cat'];
-    return execFileSync('git', ['-C', cwd, ...opts, ...args], {
+    return execFileSync('git', ['-C', cwd, ...GIT_SAFE, ...args], {
       encoding: 'utf8',
       timeout: 3000,
       stdio: ['ignore', 'pipe', 'ignore'],
@@ -185,6 +192,67 @@ export function mask(text) {
   return s.replace(LABELLED, '$1[masked]').replace(BEARER, '$1[masked]').replace(URL_CREDS, '$1[masked]@');
 }
 
+// ---------- the request a reply answers ----------
+
+const PROMPT_MAX = 4_000;
+const TAIL_BYTES = 2 * 1024 * 1024;
+
+/**
+ * The person's latest request in the agent's own transcript, masked, ≤ 4,000 characters; '' when there is none. Only a
+ * .jsonl under ~/.claude/projects (Claude Code) or ~/.codex/sessions (Codex) is read, and only its last 2 MB.
+ */
+export function promptIn(file, home = os.homedir()) {
+  if (typeof file !== 'string' || !path.isAbsolute(file) || !file.endsWith('.jsonl')) return '';
+  const real = (p) => {
+    try {
+      return fs.realpathSync(p);
+    } catch {
+      return '';
+    }
+  };
+  const at = real(file);
+  const roots = [path.join(home, '.claude', 'projects'), path.join(home, '.codex', 'sessions')].map(real).filter(Boolean);
+  if (!at || !roots.some((r) => at.startsWith(r + path.sep))) return '';
+  let text = '';
+  try {
+    const fd = fs.openSync(at, 'r');
+    try {
+      const size = fs.fstatSync(fd).size;
+      const n = Math.min(size, TAIL_BYTES);
+      const buf = Buffer.alloc(n);
+      fs.readSync(fd, buf, 0, n, size - n);
+      text = buf.toString('utf8');
+    } finally {
+      fs.closeSync(fd);
+    }
+  } catch {
+    return '';
+  }
+  const lines = text.split('\n');
+  for (let k = lines.length - 1; k >= 0; k--) {
+    if (!lines[k].includes('"user')) continue;
+    let e;
+    try {
+      e = JSON.parse(lines[k]);
+    } catch {
+      continue;
+    }
+    const p = userText(e);
+    if (p) return mask(p).slice(0, PROMPT_MAX);
+  }
+  return '';
+}
+
+/** A typed request: Codex's user_message event, or a Claude Code user turn that isn't a tool result, meta or a command. */
+function userText(e) {
+  if (e?.type === 'event_msg' && e.payload?.type === 'user_message') return typeof e.payload.message === 'string' ? e.payload.message.trim() : '';
+  if (e?.type !== 'user' || e.isMeta || e.isSidechain || e.message?.role !== 'user') return '';
+  const c = e.message.content;
+  const t = typeof c === 'string' ? c : Array.isArray(c) && !c.some((x) => x?.type === 'tool_result') ? c.filter((x) => x?.type === 'text').map((x) => x.text).join('\n') : '';
+  const s = String(t ?? '').trim();
+  return /^<(command-|local-command|system-reminder|task-notification|bash-)/.test(s) ? '' : s;
+}
+
 // ---------- this computer ----------
 
 /** "Ilya’s MacBook Pro": the computer's own name (macOS), else the host name. Letters, digits, spaces, ’'._- only. */
@@ -202,3 +270,218 @@ export function computerName() {
 }
 
 export const sha = (s) => createHash('sha256').update(s).digest('hex');
+
+/**
+ * What else this computer can reach, for the green tags beside it in Glow: GitHub (gh signed in), Chrome, Docker, Xcode.
+ * File checks only (no process is started), so the hook can run it on every report. Never a token, an account or a path:
+ * only which of these four are there.
+ */
+export function tools(home = os.homedir(), env = process.env, platform = process.platform) {
+  const dirs = String(env.PATH ?? '').split(path.delimiter).filter(Boolean);
+  const has = (p) => {
+    try {
+      return fs.existsSync(p);
+    } catch {
+      return false;
+    }
+  };
+  const onPath = (bin) => dirs.some((d) => has(path.join(d, bin)));
+  const ghConfig = env.GH_CONFIG_DIR || path.join(env.XDG_CONFIG_HOME || path.join(home, '.config'), 'gh');
+  const out = [];
+  if (onPath('gh') && has(path.join(ghConfig, 'hosts.yml'))) out.push('github');
+  if (platform === 'darwin' ? has('/Applications/Google Chrome.app') || has(path.join(home, 'Applications', 'Google Chrome.app')) : onPath('google-chrome') || onPath('chrome') || onPath('chromium')) out.push('chrome');
+  if (onPath('docker')) out.push('docker');
+  if (platform === 'darwin' && has('/Applications/Xcode.app')) out.push('xcode');
+  return out;
+}
+
+// ---------- sessions Glow starts here (`glow run`) ----------
+
+/** The file that marks a session the runner started (by its Claude Code session id): the runner sends its reply to
+ *  Glow itself, so the Stop hook leaves it alone. In ~/.glow/sessions, tidied after a day like the hook's locks. */
+export const runMarker = (session) => path.join(dir(), 'sessions', `${sha(`run:${session}`).slice(0, 24)}.run`);
+
+const clip = (s, n) => {
+  const t = String(s ?? '').replace(/\s+/g, ' ').trim();
+  return t.length > n ? `${t.slice(0, n - 1)}…` : t;
+};
+
+/**
+ * A command as a session's status shows it: the program and its subcommand only ("$ git status", "$ psql …"), never its
+ * arguments, options or environment, which is where passwords go. Leading `VAR=…`, `export`, `cd` and wrappers like
+ * `sudo` are skipped. (The same as @glow/core commandHead, which Glow applies again.)
+ */
+export function commandHead(command) {
+  const parts = String(command ?? '').split(/&&|\|\||;|\||\n/).map((x) => x.trim().split(/\s+/).filter(Boolean));
+  const SKIP = new Set(['sudo', 'env', 'time', 'nohup', 'command', 'exec', 'nice']);
+  const SETUP = new Set(['export', 'cd', 'set', 'unset', 'source', '.', 'pushd', 'popd']);
+  let fallback = '';
+  for (const words of parts) {
+    let k = 0;
+    while (k < words.length && (/^[A-Za-z_][A-Za-z0-9_]*=/.test(words[k]) || SKIP.has(words[k]) || words[k].startsWith('-'))) k++; // VAR=x, sudo -E, env, …
+    const prog = (words[k] ?? '').split('/').pop().replace(/[^\w.+-]/g, '').slice(0, 40);
+    if (!prog) continue;
+    // A subcommand is a plain lower-case word (`git status`, `npm run`): never what echo or printf print, nor a word
+    // with digits or capitals (a password piped to `sudo -S` looks like one).
+    const sub = words[k + 1] && !['echo', 'printf'].includes(prog) && /^[a-z][a-z_-]{0,30}$/.test(words[k + 1]) ? words[k + 1] : '';
+    const more = words.length > k + (sub ? 2 : 1) || parts.length > 1;
+    const head = `$ ${prog}${sub ? ` ${sub}` : ''}${more ? ' …' : ''}`;
+    if (!SETUP.has(prog)) return head;
+    fallback ||= head;
+  }
+  return fallback || '$ (a command)';
+}
+
+/**
+ * What a session is doing, from the tool it just called, for its row in Glow: "$ bun test …", "Edit src/app.ts",
+ * "Grep useSession". Short, one line, paths inside the repo relative and the home folder as ~, keys masked before
+ * anything is cut. A command by its program only; never what's written or fetched; an MCP tool by its name only.
+ */
+export function activityOf(name, input, cwd = '') {
+  const i = input && typeof input === 'object' ? input : {};
+  const home = os.homedir();
+  const where = (p) => {
+    const s = String(p ?? '');
+    if (cwd && s.startsWith(`${cwd}/`)) return s.slice(cwd.length + 1);
+    return home && s.startsWith(`${home}/`) ? `~/${s.slice(home.length + 1)}` : s;
+  };
+  // Masked whole, then cut: a key cut in half can't be told from text any more.
+  const safe = (v, n) => clip(mask(String(v ?? '').replace(/\s+/g, ' ')), n);
+  const tool = String(name ?? '').replace(/[^\w.:-]/g, '').slice(0, 60) || 'A tool';
+  let line;
+  if (tool === 'Bash') line = commandHead(i.command);
+  else if (['Read', 'Edit', 'Write', 'MultiEdit', 'NotebookEdit'].includes(tool)) line = `${tool} ${safe(where(i.file_path ?? i.notebook_path), 140)}`;
+  else if (tool === 'Glob' || tool === 'Grep') line = `${tool} ${safe(i.pattern, 100)}`;
+  else if (tool === 'WebFetch') {
+    let host = '';
+    try {
+      host = new URL(String(i.url)).host;
+    } catch {
+      host = '';
+    }
+    line = `WebFetch ${host}`;
+  } else if (tool === 'WebSearch') line = `WebSearch ${safe(i.query, 100)}`;
+  else if (tool === 'Task' || tool === 'Agent') line = `Agent: ${safe(i.description, 100)}`;
+  else if (tool === 'TodoWrite') line = 'Updating its to-do list';
+  else line = tool;
+  return printable(line, 160).trim();
+}
+
+// ---------- your Glow phone (packages/core src/phone.ts; docs/security/review-2026-11-03-signed-runs.md) ----------
+// Glow hands this computer a session or a message only with the signature of its starter's Glow phone: a P-256 key in
+// that phone's Secure Enclave or Keystore, used only after Face ID (or a fingerprint), over exactly what will run. Here
+// it's checked against the phone key this computer pinned (config.phone: the first one Glow named, or the one `glow
+// phone trust` was told to trust) before anything runs or reaches an agent, so Glow's servers alone can neither start
+// anything here nor swap the key. Each signature is used once (~/.glow/seen).
+
+export const RUN_SIGN_V = 'glow-run-v1';
+export const MESSAGE_SIGN_V = 'glow-message-v1';
+/** How far a signature's time may be from this computer's clock, and how long a signed session may wait (core). */
+export const SIGN_SKEW_S = 300;
+export const SIGNED_RUN_TTL_S = 6 * 3600;
+export const SIGNED_MESSAGE_TTL_S = 24 * 3600;
+
+/** What the phone signed: one field a line, no trailing newline (pinned against core in test/cli.test.ts). */
+export const runPayload = (r) => [RUN_SIGN_V, r.session, r.computer, r.repo, r.prompt_sha256, String(r.issued_at)].join('\n');
+export const messagePayload = (m) => [MESSAGE_SIGN_V, m.message, m.computer, m.session_key, m.body_sha256, String(m.issued_at)].join('\n');
+/** "3F9A 1C22 7B0E 44D1": what the app shows under Settings › Glow phone. */
+export const fingerprintText = (hex) => String(hex ?? '').slice(0, 16).toUpperCase().replace(/(.{4})(?!$)/g, '$1 ');
+
+/** An uncompressed P-256 point's SubjectPublicKeyInfo, up to the point. */
+const P256_SPKI = Buffer.from('3059301306072a8648ce3d020106082a8648ce3d03010703420004', 'hex');
+
+/** A phone key (SPKI DER, base64) as bytes: exactly a P-256 key, else null. */
+export function phoneKey(b64) {
+  if (typeof b64 !== 'string' || !/^[A-Za-z0-9+/]{122}={0,2}$/.test(b64)) return null;
+  const b = Buffer.from(b64, 'base64');
+  return b.length === P256_SPKI.length + 64 && b.subarray(0, P256_SPKI.length).equals(P256_SPKI) ? b : null;
+}
+/** SHA-256 of the key's DER, hex: what both ends pin and show. */
+export const phoneFingerprint = (b64) => {
+  const k = phoneKey(b64);
+  return k ? createHash('sha256').update(k).digest('hex') : null;
+};
+
+/** A phone Glow names (GET /api/v1/agent/config's `phone`), checked: its fingerprint is its key's. Else null. */
+export function phoneOf(p) {
+  if (!p || typeof p !== 'object') return null;
+  const fingerprint = phoneFingerprint(p.key);
+  if (!fingerprint || fingerprint !== p.fingerprint) return null;
+  return { key: p.key, fingerprint, name: printable(p.name, 60) || 'your phone' };
+}
+
+/**
+ * Glow's word on the phone (the config answer): pinned here the first time (trust on first use: say so, with its
+ * fingerprint to compare with the app); a different one is only reported, never trusted, until `glow phone trust`.
+ * Returns the config as it now is.
+ */
+export function pinPhone(cfg, glowPhone, say = () => undefined) {
+  const p = phoneOf(glowPhone);
+  if (!p) return cfg;
+  if (!cfg.phone?.fingerprint) {
+    const next = { ...(readConfig() ?? cfg), phone: { ...p, pinned_at: new Date().toISOString() } };
+    try {
+      writeConfig(next);
+    } catch {
+      return cfg; // a read-only home: nothing pinned, nothing runs
+    }
+    say(`Trusting your Glow phone, ${p.name} (${fingerprintText(p.fingerprint)}): the app shows the same under Settings › Glow phone.`);
+    return next;
+  }
+  if (cfg.phone.fingerprint !== p.fingerprint && cfg.phone.offered !== p.fingerprint) {
+    try {
+      writeConfig({ ...(readConfig() ?? cfg), phone: { ...cfg.phone, offered: p.fingerprint } });
+    } catch {
+      // said again next time
+    }
+    say(`Glow says your Glow phone is now ${p.name} (${fingerprintText(p.fingerprint)}). This computer still trusts ${printable(cfg.phone.name, 60)} (${fingerprintText(cfg.phone.fingerprint)}) until you run here: npx @winding-labs/glow phone trust`);
+  }
+  return cfg;
+}
+
+/** Each signature once: a file named after it in ~/.glow/seen, made only if it isn't there. Old ones are cleared. */
+function once(sig) {
+  const seen = path.join(dir(), 'seen');
+  try {
+    fs.mkdirSync(seen, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(seen, createHash('sha256').update(sig).digest('hex').slice(0, 40)), '', { flag: 'wx', mode: 0o600 });
+  } catch (e) {
+    if (e?.code === 'EEXIST') return false;
+    return true; // a read-only home: the runner's own memory of ids still holds
+  }
+  if (Math.random() < 0.05) {
+    const old = Date.now() - (SIGNED_MESSAGE_TTL_S + SIGN_SKEW_S + 3600) * 1000;
+    try {
+      for (const f of fs.readdirSync(seen)) {
+        const at = path.join(seen, f);
+        if (fs.statSync(at).mtimeMs < old) fs.rmSync(at, { force: true });
+      }
+    } catch {
+      // next time
+    }
+  }
+  return true;
+}
+
+/**
+ * Did this computer's Glow phone sign exactly this, recently, for the first time? null when it did, else why not:
+ * `untrusted_phone` (none pinned, or another phone), `not_signed` (no signature, or too old or too new), `bad_signature`
+ * (it doesn't check out, or it was used before). `payload` is built from what will actually run, never from Glow's
+ * word on what was signed.
+ */
+export function checkSigned(cfg, signed, payloadAt, ttlS, now = Date.now() / 1000) {
+  const pinned = cfg?.phone;
+  const key = phoneKey(pinned?.key);
+  if (!key || phoneFingerprint(pinned.key) !== pinned.fingerprint) return 'untrusted_phone';
+  if (!signed || typeof signed !== 'object' || typeof signed.sig !== 'string' || !Number.isSafeInteger(signed.at)) return 'not_signed';
+  if (signed.phone !== pinned.fingerprint) return 'untrusted_phone';
+  if (signed.at > now + SIGN_SKEW_S || signed.at < now - ttlS - SIGN_SKEW_S) return 'not_signed';
+  let ok = false;
+  try {
+    ok = signed.sig.length <= 200 && verify('sha256', Buffer.from(payloadAt(signed.at), 'utf8'), { key: createPublicKey({ key, format: 'der', type: 'spki' }), dsaEncoding: 'der' }, Buffer.from(signed.sig, 'base64'));
+  } catch {
+    ok = false;
+  }
+  if (!ok) return 'bad_signature';
+  return once(signed.sig) ? null : 'bad_signature';
+}

package/lib/hook.mjs

@@ -7,11 +7,19 @@
 //                {"decision":"block","reason":…}, which Codex takes as the next prompt.
 //
 // `npx @winding-labs/glow messages off` stops both: Glow then holds no message for this computer's sessions.
+// A repo ignored here (`glow ignore`, /glow:ignore) sends nothing at all: the hook stops before any request. A session
+// Glow started here (`glow run`, lib/runner.mjs) is the runner's to report.
+//
+// A message reaches the agent only if this computer's Glow phone signed it (core checkSigned: after Face ID, over its id,
+// this computer, this session and its exact text, within a day, once); any other is dropped here, whatever Glow says.
 //
 // Quiet by design: whatever goes wrong, it exits 0 and the agent carries on. Nothing is written to a log.
 import fs from 'node:fs';
 import path from 'node:path';
-import { api, dir, gitContext, mask, prIn, printable, readConfig, repoOf, SESSION_RE, sha, writeConfig } from './core.mjs';
+import {
+  api, checkSigned, dir, gitContext, ignoredOf, mask, messagePayload, pinPhone, prIn, printable, promptIn, readConfig, repoOf, runMarker, SESSION_RE, sha, SIGNED_MESSAGE_TTL_S, tools,
+  writeConfig,
+} from './core.mjs';
 
 const LISTEN_MS = 25 * 60_000;
 // GLOW_POLL_MS only speeds up the tests (timing, never where anything is sent).
@@ -34,9 +42,11 @@ async function main() {
   if (!cfg || cfg.off) return 0;
   const session = typeof input.session_id === 'string' ? input.session_id : '';
   if (!SESSION_RE.test(session)) return 0;
+  // A session Glow started here (`glow run`): the runner sends its reply itself.
+  if (fs.existsSync(runMarker(session))) return 0;
   const cwd = typeof input.cwd === 'string' && path.isAbsolute(input.cwd) ? input.cwd : process.cwd();
   const repo = repoOf(cwd);
-  if (!repo || !(await linked(cfg, repo))) return 0;
+  if (!repo || ignoredOf(cfg).includes(repo) || !(await linked(cfg, repo))) return 0;
 
   const reply = typeof input.last_assistant_message === 'string' ? input.last_assistant_message : '';
   const inbox = cfg.messages !== false;
@@ -44,18 +54,34 @@ async function main() {
   if (reply.trim()) {
     const ctx = gitContext(cwd);
     const pr = prIn(reply, repo);
+    // The request this reply answers (masked), so Glow can name the recipe you ran; `recipes off` leaves it out.
+    const prompt = cfg.recipes === false ? '' : promptIn(input.transcript_path);
     const res = await api(cfg, 'POST', '/api/v1/agent/reports', {
-      agent, session_id: session, repo, ...(ctx.branch ? { branch: ctx.branch } : {}), message: mask(reply).slice(0, MESSAGE_MAX), commits: ctx.commits, ...(pr ? { pr_url: pr } : {}), inbox,
+      agent, session_id: session, repo, ...(ctx.branch ? { branch: ctx.branch } : {}), message: mask(reply).slice(0, MESSAGE_MAX), ...(prompt ? { prompt } : {}), commits: ctx.commits, ...(pr ? { pr_url: pr } : {}), inbox, tools: tools(),
     }, agent === 'codex' ? 6_000 : 10_000);
     if (res.status === 401 || res.status === 403) return 0;
     if (res.json?.skipped === 'repo_not_linked' && Array.isArray(res.json.repos)) saveRepos(cfg, res.json.repos);
     messages = inbox && Array.isArray(res.json?.messages) ? res.json.messages : [];
   }
-  if (messages.length) return deliver(messages);
-  if (agent === 'claude_code' && inbox) return listen(cfg, session);
+  const signed = messages.length ? await signedOnly(cfg, session, messages) : [];
+  if (signed.length) return deliver(signed);
+  if (agent === 'claude_code' && inbox) return listen(cfg, session, repo);
   return 0;
 }
 
+/** The messages this computer's Glow phone signed (each checked over what the agent would read); a phone not pinned yet
+ *  is looked up once (core pinPhone). */
+async function signedOnly(cfg, session, messages) {
+  let c = cfg;
+  if (!c.phone?.fingerprint) {
+    const res = await api(c, 'GET', '/api/v1/agent/config', undefined, 5_000);
+    if (res.status === 200) c = pinPhone(c, res.json?.phone);
+  }
+  const key = `${c.computer?.id ?? ''}:${agent}:${session}`;
+  return messages.filter((m) => m && typeof m.id === 'string' && typeof m.body === 'string'
+    && !checkSigned(c, m.signed, (at) => messagePayload({ message: m.id, computer: c.computer?.id ?? '', session_key: key, body_sha256: sha(m.body), issued_at: at }), SIGNED_MESSAGE_TTL_S));
+}
+
 /** Is this repo linked to a product? The list is cached in the config, refreshed when a repo isn't on it (≤ every 2 min). */
 async function linked(cfg, repo) {
   const repos = Array.isArray(cfg.repos) ? cfg.repos : [];
@@ -98,9 +124,10 @@ const timeOf = (iso) => {
 
 /**
  * Claude Code, idle: ask Glow for a message every 15 s for up to 25 minutes. One listener per session: a newer reply
- * writes its own token to the lock and this one stops. Stops too when Claude Code itself has gone.
+ * writes its own token to the lock and this one stops. Stops too when Claude Code itself has gone, or when sending,
+ * messages or this repo are turned off here.
  */
-async function listen(cfg, session) {
+async function listen(cfg, session, repo) {
   const locks = path.join(dir(), 'sessions');
   fs.mkdirSync(locks, { recursive: true, mode: 0o700 });
   const lock = path.join(locks, `${sha(`${agent}:${session}`).slice(0, 24)}.lock`);
@@ -115,10 +142,10 @@ async function listen(cfg, session) {
       await new Promise((r) => setTimeout(r, POLL_MS));
       if (!mine(lock, token) || !alive(parent)) return 0;
       const now = readConfig();
-      if (!now || now.off || now.messages === false) return 0;
+      if (!now || now.off || now.messages === false || ignoredOf(now).includes(repo)) return 0;
       const res = await api(now, 'GET', q, undefined, 10_000);
       if (res.status === 401 || res.status === 403 || res.status === 404) return 0;
-      const messages = Array.isArray(res.json?.messages) ? res.json.messages : [];
+      const messages = Array.isArray(res.json?.messages) ? await signedOnly(now, session, res.json.messages) : [];
       if (messages.length) return deliver(messages);
     }
     return 0;