@zgeoff/atc 2.12.0 → 2.14.0

package/src/agents/make-claude-headless-runner.ts

@@ -0,0 +1,46 @@
+import type { HeadlessRunEvents, HeadlessRunner } from './agent-adapter';
+import type { ClaudeHeadlessRunRequest } from './build-claude-query-options';
+
+/**
+ * Runs one headless turn through the Claude CLI; the daemon command supplies
+ * the Agent SDK implementation, and tests supply a recorder.
+ */
+export type ClaudeHeadlessRun = (
+  opts: ClaudeHeadlessRunRequest,
+  hooks: HeadlessRunEvents,
+) => { readonly stop: () => void };
+
+/**
+ * Where and how a Claude CLI headless turn runs: the binary, the permission
+ * mode its adapter resolved, the mod folder, and, for a gateway, the
+ * settings file that carries its backend. The folder and file are written
+ * on first use.
+ */
+interface ClaudeHeadlessTarget {
+  readonly claudeBin: string;
+  readonly permissionMode: string;
+  readonly pluginDir: () => string;
+  readonly settings?: () => string;
+}
+
+/**
+ * Turns the Claude CLI's headless run into the neutral runner the daemon
+ * calls. Every headless turn runs under the permission mode its adapter
+ * resolved for the agent's sessions.
+ */
+export function makeClaudeHeadlessRunner(
+  run: ClaudeHeadlessRun,
+  target: ClaudeHeadlessTarget,
+): HeadlessRunner {
+  return (opts, hooks) =>
+    run(
+      {
+        ...opts,
+        claudeBin: target.claudeBin,
+        permissionMode: target.permissionMode,
+        pluginDir: target.pluginDir(),
+        ...(target.settings === undefined ? {} : { settings: target.settings() }),
+      },
+      hooks,
+    );
+}

package/src/agents/plan-pasted-line-input.ts

@@ -0,0 +1,22 @@
+import type { TerminalInputModes } from './agent-adapter';
+
+const PASTE_START = '\u001B[200~';
+const PASTE_END = '\u001B[201~';
+
+/**
+ * Pastes a line into a TUI that tells a paste from typing, then submits it
+ * with a carriage return as its own write. Such a TUI takes a newline inside
+ * a burst of input as part of the text, so a line typed with its newline
+ * stays unsent in the composer. Between bracketed paste markers the whole
+ * text is one paste event, newlines included, and the carriage return after
+ * the closing marker is a separate Enter key event however the two writes
+ * arrive. Paste markers inside the text are dropped, so the text can neither
+ * end the paste early nor start one of its own. A TUI that has not turned
+ * bracketed paste on gets the text unmarked, and may still read both writes
+ * as one burst.
+ */
+export function planPastedLineInput(text: string, modes: TerminalInputModes): readonly string[] {
+  const unmarked = text.replaceAll(PASTE_START, '').replaceAll(PASTE_END, '');
+
+  return modes.bracketedPaste ? [`${PASTE_START}${unmarked}${PASTE_END}`, '\r'] : [unmarked, '\r'];
+}

package/src/agents/plan-typed-line-input.ts

@@ -0,0 +1,8 @@
+/**
+ * Types a line the way a terminal user does: the text and a newline in one
+ * write. A TUI that reads input a line at a time takes the newline as the
+ * submit key.
+ */
+export function planTypedLineInput(text: string): readonly string[] {
+  return [`${text}\n`];
+}

package/src/agents/resolve-claude-permission-mode.ts

@@ -0,0 +1,13 @@
+import { findClaudePermissionMode } from './find-claude-permission-mode';
+
+/**
+ * The permission mode a Claude CLI agent's headless turns run in: the mode
+ * its configuration sets, else auto, since no human is at a terminal to
+ * answer a prompt.
+ */
+export function resolveClaudePermissionMode(
+  args: readonly string[],
+  settings: Readonly<Record<string, unknown>> | undefined,
+): string {
+  return findClaudePermissionMode(args, settings) ?? 'auto';
+}

package/src/{daemon/start-headless-run.ts → agents/start-claude-headless-run.ts}

@@ -1,36 +1,8 @@
-import type { AgentSessionID } from '../shared/agent-session-id';
-import { socketPath } from '../shared/config';
+import { truncateSummary } from '../daemon/truncate-summary';
 import { isCompiledBinary } from '../shared/is-compiled-binary';
 import { isRecord } from '../shared/report';
-import type { SessionID } from '../shared/session-id';
-import { buildHeadlessEnv } from './build-headless-env';
-import { resolveHeadlessExecutable } from './resolve-headless-executable';
-import { truncateSummary } from './truncate-summary';
-
-const PERMISSION_MODES = [
-  'default',
-  'acceptEdits',
-  'bypassPermissions',
-  'plan',
-  'auto',
-  'dontAsk',
-] as const;
-
-// The effort levels the Agent SDK accepts.
-const EFFORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'] as const;
-
-interface HeadlessRunOptions {
-  readonly claudeBin: string;
-  readonly cwd: string;
-  readonly prompt: string;
-  readonly resume?: AgentSessionID;
-  readonly permissionMode?: string;
-  readonly settings?: string;
-  readonly sessionID?: SessionID;
-  readonly pluginDir?: string;
-  readonly model?: string;
-  readonly effort?: string;
-}
+import { buildClaudeQueryOptions } from './build-claude-query-options';
+import type { ClaudeHeadlessRunRequest } from './build-claude-query-options';
 
 interface HeadlessRunHooks {
   readonly onOutput: (text: string) => void;
@@ -48,16 +20,14 @@ interface HeadlessRunHandle {
  * done (with the turn's whole result) or needs_you (errors, turn limits,
  * anything a human must look at).
  */
-export function startHeadlessRun(
-  opts: HeadlessRunOptions,
+export function startClaudeHeadlessRun(
+  opts: ClaudeHeadlessRunRequest,
   hooks: HeadlessRunHooks,
 ): HeadlessRunHandle {
   const controller = new AbortController();
 
   void (async () => {
     try {
-      const mode = PERMISSION_MODES.find((m) => m === opts.permissionMode);
-      const effort = EFFORT_LEVELS.find((level) => level === opts.effort);
       let stderrTail = '';
 
       // The SDK is the heaviest module in the daemon's graph, and only a
@@ -68,28 +38,11 @@ export function startHeadlessRun(
       const stream = sdk.query({
         prompt: opts.prompt,
         options: {
-          cwd: opts.cwd,
-          env: buildHeadlessEnv({
-            socketPath,
-            ...(opts.pluginDir === undefined ? {} : { pluginDir: opts.pluginDir }),
-            ...(opts.sessionID === undefined ? {} : { sessionID: opts.sessionID }),
-          }),
+          ...buildClaudeQueryOptions(opts, isCompiledBinary()),
           abortController: controller,
           stderr: (data: string) => {
             stderrTail = `${stderrTail}${data}`.slice(-2000);
           },
-          ...(opts.resume === undefined ? {} : { resume: opts.resume }),
-          ...(mode === undefined ? {} : { permissionMode: mode }),
-
-          // The session's own model and effort, so the turn runs as its
-          // terminal did.
-          ...(opts.model === undefined ? {} : { model: opts.model }),
-          ...(effort === undefined ? {} : { effort }),
-
-          // The same generated file the terminal spawn passes, so the turn
-          // runs against the session's own backend and instrumentation.
-          ...(opts.settings === undefined ? {} : { extraArgs: { settings: opts.settings } }),
-          ...resolveHeadlessExecutable(opts.claudeBin, isCompiledBinary()),
         },
       });
 

package/src/agents/write-atc-bridge.ts

@@ -1,7 +1,7 @@
 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { stateDir } from '../shared/config';
-import { ATC_BRIDGE_FILES } from './atc-bridge-files';
+import { buildATCBridgeFiles } from './build-atc-bridge-files';
 import { buildCLIArgv } from './build-cli-argv';
 
 /**
@@ -13,7 +13,7 @@ import { buildCLIArgv } from './build-cli-argv';
  * there.
  */
 export function writeATCBridge(dir: string = join(stateDir, 'atc-bridge')): string {
-  const files = { ...ATC_BRIDGE_FILES, 'hooks/atc-cli.ts': renderATCCLIModule(buildCLIArgv()) };
+  const files = buildATCBridgeFiles(buildCLIArgv());
 
   for (const [path, content] of Object.entries(files)) {
     const file = join(dir, path);
@@ -29,10 +29,6 @@ export function writeATCBridge(dir: string = join(stateDir, 'atc-bridge')): stri
   return dir;
 }
 
-function renderATCCLIModule(argv: readonly string[]): string {
-  return `export const ATC_CLI: readonly string[] = ${JSON.stringify(argv)};\n`;
-}
-
 function tryReadFileText(file: string): string | null {
   try {
     return readFileSync(file, 'utf8');

package/src/cli.ts

@@ -159,15 +159,17 @@ const main = defineCommand({
           const grok = await import('./agents/grok-adapter');
           const codex = await import('./agents/codex-adapter');
           const gateway = await import('./agents/gateway-adapter');
-          const headless = await import('./daemon/start-headless-run');
+          const headless = await import('./agents/start-claude-headless-run');
           const targets = await import('./daemon/build-execution-targets');
 
           // Test harnesses shrink the outbound queue to force overflow
           // deterministically; unset means the production default.
           const queueBytes = Number(process.env['ATC_QUEUE_BYTES']);
           const cfg = config.loadConfig();
+          const built = targets.buildExecutionTargets(cfg.targets);
+          const targetErrors = [...cfg.targetErrors, ...built.errors];
 
-          for (const error of cfg.targetErrors) {
+          for (const error of targetErrors) {
             const line =
               error.scope === 'config'
                 ? `${error.path} cannot be used (${error.problem}: ${error.detail}); every spawn is refused, local ones included, until it is fixed`
@@ -192,18 +194,12 @@ const main = defineCommand({
           // to it is refused. Tests pin it to 0 to reach the refusal at once.
           const graceOverride = Number(process.env['ATC_TAP_GRACE_MS']);
 
-          const claudeAdapter = new claude.ClaudeAdapter(cfg, (runOpts, hooks) =>
-            headless.startHeadlessRun({ ...runOpts, claudeBin: cfg.claudeBin }, hooks),
-          );
-
+          const claudeAdapter = new claude.ClaudeAdapter(cfg, headless.startClaudeHeadlessRun);
           const grokAdapter = new grok.GrokAdapter(cfg);
           const codexAdapter = new codex.CodexAdapter(cfg);
 
           const gatewayAdapters = cfg.gateways.map(
-            (entry) =>
-              new gateway.GatewayAdapter(entry, cfg, (runOpts, hooks) =>
-                headless.startHeadlessRun({ ...runOpts, claudeBin: entry.bin }, hooks),
-              ),
+            (entry) => new gateway.GatewayAdapter(entry, cfg, headless.startClaudeHeadlessRun),
           );
 
           let handle: Awaited<ReturnType<typeof daemon.startDaemon>>;
@@ -220,9 +216,9 @@ const main = defineCommand({
               legacyFleetPath: config.legacyFleetFile,
               pidPath: config.daemonPidFile,
               hooks: cfg.hooks,
-              targets: targets.buildExecutionTargets(cfg.targets),
+              targets: built.targets,
               defaultTarget: cfg.defaultTarget,
-              targetErrors: cfg.targetErrors,
+              targetErrors,
               principals: cfg.principals,
               restoreBootTimeoutMs,
               ...(Number.isFinite(graceOverride) && graceOverride >= 0

package/src/client/boot-daemon.ts

@@ -4,15 +4,18 @@ import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { toAgentID } from '../agents/agent-adapter';
 import type { AgentID } from '../agents/agent-adapter';
+import { DaemonError } from '../protocol/daemon-error';
 import type { DaemonFeature } from '../protocol/daemon-features';
 import { parseDaemonFeatures } from '../protocol/parse-daemon-features';
+import { PROTOCOL_V } from '../protocol/protocol';
 import { daemonPidFile, daemonRecordFile, daemonSocketPath } from '../shared/config';
 import { findDaemonRecord } from '../shared/find-daemon-record';
 import { getBuild } from '../shared/get-build';
 import { isCompiledBinary } from '../shared/is-compiled-binary';
 import { makeSingleFlight } from '../shared/make-single-flight';
-import { isRecord } from '../shared/report';
 import { DaemonClient } from './daemon-client';
+import { formatProtocolMismatch } from './format-protocol-mismatch';
+import type { ProtocolMismatch } from './format-protocol-mismatch';
 import { pickStaleDaemonPID } from './pick-stale-daemon-pid';
 
 export interface DaemonBoot {
@@ -28,18 +31,28 @@ export interface DaemonBoot {
   readonly socketPath: string;
 }
 
+export interface DaemonBootOptions {
+  // Called when the daemon speaks another protocol version. Resolving true
+  // stops that daemon and boots one from this build, which ends every
+  // session it hosts; without the callback, or resolving false, the boot
+  // rejects and the daemon keeps running.
+  readonly onProtocolMismatch?: (mismatch: ProtocolMismatch) => Promise<boolean>;
+}
+
 /**
  * Opens a handshaken client to the daemon, booting the daemon first when
  * neither the computed socket nor the one in the daemon's record answers.
- * Overlapping calls in one process share a single boot. A daemon from an older build stays in service — killing
- * it would kill every hosted session — and is reported as stale so the
- * caller can offer a deliberate restart. Only a protocol mismatch, where
- * talking would misbehave, forces the restart immediately. The expected
- * build is read from disk on every attempt: a long-lived caller holding a
- * build string from its own boot would otherwise flag daemons that are
- * already current.
+ * Overlapping calls in one process share a single boot. A daemon from an
+ * older build stays in service, since stopping it would end every hosted
+ * session, and is reported as stale so the caller can offer a deliberate
+ * restart. A daemon on another protocol version stays in service too: the
+ * boot rejects with `protocol_mismatch` and a message holding both builds,
+ * both versions, and the way to restart it, unless the caller's
+ * `onProtocolMismatch` confirms a restart. The expected build is read from
+ * disk on every attempt: a long-lived caller holding a build string from
+ * its own boot would otherwise flag daemons that are already current.
  */
-export async function bootDaemonClient(): Promise<DaemonBoot> {
+export async function bootDaemonClient(options: DaemonBootOptions = {}): Promise<DaemonBoot> {
   for (let attempt = 0; attempt < 2; attempt++) {
     const build = getBuild();
 
@@ -60,21 +73,35 @@ export async function bootDaemonClient(): Promise<DaemonBoot> {
     } catch (error) {
       client.stop();
 
-      if (attempt > 0 || !isProtocolMismatch(error)) {
+      if (attempt > 0 || !(error instanceof DaemonError) || error.code !== 'protocol_mismatch') {
         throw error;
       }
 
-      await stopStaleDaemon(opened.socketPath);
+      const mismatch: ProtocolMismatch = {
+        socketPath: opened.socketPath,
+        daemonPID: findDaemonPID(opened.socketPath),
+        clientBuild: build,
+        clientProtocol: PROTOCOL_V,
+        daemonMessage: error.message,
+      };
+
+      // Without a pid there is no daemon this client could stop, so the
+      // caller is not asked.
+      if (
+        mismatch.daemonPID === null ||
+        options.onProtocolMismatch === undefined ||
+        !(await options.onProtocolMismatch(mismatch))
+      ) {
+        throw new DaemonError('protocol_mismatch', formatProtocolMismatch(mismatch));
+      }
+
+      await stopDaemon(mismatch.daemonPID);
     }
   }
 
   throw new Error('the atc daemon could not be restarted');
 }
 
-function isProtocolMismatch(error: unknown): boolean {
-  return isRecord(error) && error['code'] === 'protocol_mismatch';
-}
-
 interface OpenedDaemon {
   readonly client: DaemonClient;
   readonly socketPath: string;
@@ -177,18 +204,17 @@ function isProcessAlive(pid: number): boolean {
   }
 }
 
-async function stopStaleDaemon(socketPath: string): Promise<void> {
-  const pid = pickStaleDaemonPID({
+// The pid of the daemon behind the socket that refused the handshake.
+function findDaemonPID(socketPath: string): number | null {
+  return pickStaleDaemonPID({
     socketPath,
     record: findDaemonRecord(daemonRecordFile),
     pidFileSocketPath: daemonSocketPath,
     pidFilePID: findPidFilePID(),
   });
+}
 
-  if (pid === null) {
-    return;
-  }
-
+async function stopDaemon(pid: number): Promise<void> {
   try {
     process.kill(pid, 'SIGTERM');
   } catch {

package/src/client/format-protocol-mismatch.ts

@@ -0,0 +1,37 @@
+// A daemon that refused this client's handshake because it speaks another
+// protocol version.
+export interface ProtocolMismatch {
+  readonly socketPath: string;
+
+  // The daemon's pid from its record or pid file, or null when neither
+  // belongs to the socket that refused.
+  readonly daemonPID: number | null;
+
+  readonly clientBuild: string;
+  readonly clientProtocol: number;
+
+  // The daemon's own refusal, which holds its build and protocol version.
+  readonly daemonMessage: string;
+}
+
+/**
+ * Describes a daemon on another protocol version: both builds and both
+ * versions, that it was left running, and how to restart it on purpose.
+ */
+export function formatProtocolMismatch(mismatch: ProtocolMismatch): string {
+  const pid = mismatch.daemonPID === null ? 'pid unknown' : `pid ${mismatch.daemonPID}`;
+
+  // Without a pid the TUI cannot stop the daemon either, so the restart is
+  // left to the user.
+  const restart =
+    mismatch.daemonPID === null
+      ? `To restart it, find its pid with \`ss -xlp | grep ${mismatch.socketPath}\` on Linux or \`lsof -U | grep ${mismatch.socketPath}\` on macOS, stop that process, and run \`atc\` again: every hosted session ends, and \`R\` respawns them from their transcripts.`
+      : 'To restart it, run `atc` from the build you want and confirm its restart prompt: every hosted session ends, and the fleet is restored on the new daemon.';
+
+  return [
+    `the atc daemon (${pid}, socket ${mismatch.socketPath}) speaks another protocol than this client, ${mismatch.clientBuild} on protocol v${mismatch.clientProtocol}.`,
+    `The daemon answered: ${mismatch.daemonMessage}`,
+    'It was left running, so the sessions it hosts keep running.',
+    restart,
+  ].join('\n');
+}

package/src/client/index.ts

@@ -2,6 +2,7 @@ import { match } from 'ts-pattern';
 import { createActor } from 'xstate';
 import type { AgentID } from '../agents/agent-adapter';
 import { countSessionStates, sortGroupedSessionViews, sortSessionViews } from '../daemon/sessions';
+import { DaemonError } from '../protocol/daemon-error';
 import type { EventMsg } from '../protocol/protocol';
 import { loadConfig } from '../shared/config';
 import { makeSingleFlight } from '../shared/make-single-flight';
@@ -9,6 +10,7 @@ import { bootDaemonClient } from './boot-daemon';
 import { buildClientMachine } from './build-client-machine';
 import { buildLeaderChords } from './build-leader-chords';
 import { findFuzzyScore, formatDir } from './dirs';
+import type { ProtocolMismatch } from './format-protocol-mismatch';
 import { KEY, isDown, isUp, planTextEdit } from './keys';
 import { parseDaemonEvent } from './parse-daemon-event';
 import { pickTabTarget } from './pick-tab-target';
@@ -20,6 +22,10 @@ import { ansi, cols, drawHelp, drawHome, drawOverlay, drawPicker, drawStatusBar,
 let overlaySelected = 0;
 let confirmKill = false;
 
+// The session whose forget waits on a confirm because it destroys the
+// session's host, or null.
+let confirmDestroyID: string | null = null;
+
 // The client's mirror of the daemon's fleet, kept fresh by events.
 let fleet: MirrorSession[] = [];
 
@@ -95,6 +101,36 @@ async function sendQuiet(m: string, p?: Readonly<Record<string, unknown>>) {
   } catch {}
 }
 
+// A kill the daemon refuses because forgetting the session destroys its
+// host asks once more before the forget.
+async function sendKill(sessionID: string) {
+  try {
+    await client.sendRequest('session.kill', { session: sessionID });
+  } catch (error) {
+    if (error instanceof DaemonError && error.code === 'confirmation_required') {
+      confirmDestroyID = sessionID;
+
+      if (service.getSnapshot().value === 'overlay') {
+        renderOverlay();
+      }
+    }
+  }
+}
+
+// Takes the confirm token the daemon offers and hands it straight back:
+// the operator already confirmed in the overlay.
+async function sendForget(sessionID: string) {
+  try {
+    const offered = await client.sendRequest('session.forget', { session: sessionID });
+
+    const confirmToken = offered['confirmToken'];
+
+    if (typeof confirmToken === 'string') {
+      await client.sendRequest('session.forget', { session: sessionID, confirmToken });
+    }
+  } catch {}
+}
+
 async function attach(sessionID: string) {
   service.send({ type: 'ATTACH', sessionID });
 
@@ -215,6 +251,7 @@ function renderOverlay() {
     agentMarks,
     selected: overlaySelected,
     confirmKill,
+    confirmDestroy: confirmDestroyID !== null,
     filter: overlayFilter,
     stale: daemonStale && !daemonRestarting,
     grouped: overlayGrouped,
@@ -225,6 +262,7 @@ function renderOverlay() {
 
 function openOverlay() {
   confirmKill = false;
+  confirmDestroyID = null;
   overlayFilter = null;
 
   const focusedIndex = pickOverlaySessions().findIndex((s) => s.id === focusedID);
@@ -510,7 +548,7 @@ function applyOverlayKey(buf: Buffer) {
 
   if (confirmKill) {
     if (buf[0] === 0x79 /* y */ && sel !== undefined) {
-      void sendQuiet('session.kill', { session: sel.id });
+      void sendKill(sel.id);
     }
 
     confirmKill = false;
@@ -520,6 +558,18 @@ function applyOverlayKey(buf: Buffer) {
     return;
   }
 
+  if (confirmDestroyID !== null) {
+    if (buf[0] === 0x79 /* y */) {
+      void sendForget(confirmDestroyID);
+    }
+
+    confirmDestroyID = null;
+
+    renderOverlay();
+
+    return;
+  }
+
   if (applyOverlayFilterKey(buf)) {
     return;
   }
@@ -732,7 +782,17 @@ const service = createActor(
   }),
 );
 
-const boot = await bootDaemonClient();
+// A daemon on another protocol is restarted only when the user confirms
+// it, and the fleet it hosted is then restored on the new one.
+let restartedOnBoot = false;
+
+const boot = await bootDaemonClient({
+  onProtocolMismatch: async (mismatch) => {
+    restartedOnBoot = await waitForRestartConsent(mismatch);
+
+    return restartedOnBoot;
+  },
+});
 
 let client = boot.client;
 let daemonStale = boot.stale;
@@ -741,8 +801,50 @@ let daemonRestarting = false;
 lastUsedAgent = boot.lastUsedAgent;
 client.onEvent = applyDaemonEvent;
 
+if (restartedOnBoot) {
+  await sendQuiet('fleet.restore', { cols: cols(), rows: ptyRows() });
+}
+
 await refreshMirror();
 
+/**
+ * Asks on the terminal whether to restart a daemon that speaks another
+ * protocol, reading a single key. Anything but `y` declines, and so does a
+ * terminal that cannot answer.
+ */
+async function waitForRestartConsent(mismatch: ProtocolMismatch): Promise<boolean> {
+  if (!process.stdin.isTTY) {
+    return false;
+  }
+
+  process.stderr.write(
+    [
+      `atc: the daemon (pid ${mismatch.daemonPID}) speaks another protocol than this client, ${mismatch.clientBuild} on protocol v${mismatch.clientProtocol}.`,
+      `The daemon answered: ${mismatch.daemonMessage}`,
+      'Restart it now? Every session it hosts ends, then the fleet is restored on the new daemon. [y/N] ',
+    ].join('\n'),
+  );
+
+  process.stdin.setRawMode(true);
+  process.stdin.resume();
+
+  const key = await new Promise<string>((resolve) => {
+    process.stdin.once('data', (buf: Buffer) => {
+      resolve(buf.toString());
+    });
+  });
+
+  process.stdin.setRawMode(false);
+  process.stdin.pause();
+
+  const confirmed = key === 'y' || key === 'Y';
+  const echo = confirmed ? 'y\n' : 'n\n';
+
+  process.stderr.write(echo);
+
+  return confirmed;
+}
+
 async function refreshMirror() {
   const list = await client.sendRequest('session.list');
 

package/src/client/ui.ts

@@ -196,6 +196,10 @@ export interface OverlayView {
   agentMarks: Readonly<Record<AgentID, string>>;
   selected: number;
   confirmKill: boolean;
+
+  // A kill the daemon refused because forgetting the session destroys its
+  // host waits on a second confirm.
+  confirmDestroy: boolean;
   filter: string | null;
   stale: boolean;
   grouped: boolean;
@@ -271,6 +275,10 @@ export function drawOverlay(view: OverlayView) {
     hint = formatKillConfirm(selected, view.sessions);
   }
 
+  if (view.confirmDestroy) {
+    hint = 'forget destroys its host and everything on it? y / n';
+  }
+
   rowsList.push(dimRow(width, hint), boxBottom(width));
 
   drawBox(rowsList);