agentbox-app 0.1.12 → 0.1.13

package/main/acp.mjs

@@ -0,0 +1,296 @@
+/**
+ * ONE TRANSPORT FOR EVERY AGENT THAT SPEAKS THE AGENT CLIENT PROTOCOL.
+ *
+ * Grok (`grok agent stdio`), pi, Gemini CLI and Hermes (`hermes acp`) all speak
+ * it, so this file is what a user of ours asked for when they wrote
+ * github.com/savannahfeder/agentbox/issues/21: one engine instead of one
+ * adapter per tool. ACP is JSON-RPC 2.0 over stdio, one object per line, and
+ * the reason it is worth a file of its own is that permission requests are IN
+ * the protocol — an approval card can carry a real approval rather than one
+ * inferred from the bottom of a terminal.
+ *
+ * WHAT THIS FILE IS AND IS NOT. It is the wire: framing, negotiation, the
+ * session calls, and the two directions of request. It holds no opinion about
+ * which tool is on the other end, no card drawing, and no admission policy. A
+ * tool is not offered to anyone because this file works; see docs/harnesses.md.
+ *
+ * THE RULES IT EXISTS TO KEEP, every one of them a lesson
+ * main/codex-app-server.mjs paid for first:
+ *
+ * - A PERMISSION REQUEST IS ALWAYS ANSWERED. The agent is blocked on us while
+ *   it waits, so a dropped answer is not a missing card, it is a task parked
+ *   forever with nothing on the row. If the asker throws, or never comes back
+ *   inside the deadline, the answer is a refusal rather than silence.
+ * - A REFUSAL IS SPOKEN IN THE AGENT'S OWN WORDS. Option ids belong to the
+ *   tool, so "deny" means finding the option whose KIND rejects. If it offered
+ *   none, the answer is `cancelled`: we never invent an id, and we never
+ *   silently pick `allow_always` for someone who pressed Allow once.
+ * - A CANCELLED TURN ANSWERS `cancelled`, which the protocol requires, so a
+ *   card nobody pressed cannot land as an approval after the fact. And a
+ *   request is answered ONCE.
+ * - A DOOR WE NEVER OPENED IS REFUSED OUT LOUD. We advertise no filesystem and
+ *   no terminal, so `fs/*` and `terminal/*` get a method-not-found error.
+ *   Going quiet on a JSON-RPC request is the same hang in the other direction.
+ * - READING NEVER STOPS WHILE A QUESTION WAITS, because the agent may still be
+ *   streaming, and because its other sessions must not be held up by this one.
+ */
+import { StringDecoder } from 'node:string_decoder';
+
+// The version this client negotiates. ACP numbers its protocol, and an agent
+// that answers with another one has told us something we must not paper over.
+export const ACP_PROTOCOL_VERSION = 1;
+
+// What we lend the agent. Nothing: it has its own filesystem and its own
+// terminal, and anything advertised here is a door we then have to police.
+export const CLIENT_CAPABILITIES = Object.freeze({
+  fs: Object.freeze({ readTextFile: false, writeTextFile: false }),
+  terminal: false,
+});
+
+// The four kinds the protocol defines for a permission option. The ids beside
+// them are the tool's own; only the kind is portable.
+export const PERMISSION_KINDS = Object.freeze(['allow_once', 'allow_always', 'reject_once', 'reject_always']);
+const REJECTIONS = Object.freeze(['reject_once', 'reject_always']);
+
+// How long a question may stand before it is refused on the person's behalf.
+// Matches the Codex spool, because it is the same person and the same patience.
+export const PERMISSION_TIMEOUT_MS = 15 * 60_000;
+export const REQUEST_TIMEOUT_MS = 2 * 60_000;
+// A line that never ends is not a message, it is a leak.
+export const MAX_FRAME_LENGTH = 16 * 1024 * 1024;
+
+/**
+ * THE OPTION THAT MEANS NO, out of the ones this agent actually offered.
+ *
+ * `reject_once` before `reject_always`, because refusing one operation is the
+ * smaller claim and the only one a single card can honestly make: remembering
+ * a refusal forever is a different decision that nobody pressed. Null when the
+ * agent offered no refusal at all, which is answered by cancelling the turn.
+ */
+export function rejectionOption(options = []) {
+  for (const kind of REJECTIONS) {
+    const found = options.find(option => option?.kind === kind);
+    if (found?.optionId) return found.optionId;
+  }
+  return null;
+}
+
+/** Whether an id the asker chose is one the agent really put on the table. */
+export function offeredOption(options = [], optionId) {
+  return options.some(option => option?.optionId === optionId) ? optionId : null;
+}
+
+export function createAcpClient({
+  transport = null,
+  spawn = null,
+  clientInfo = { name: 'agentbox', version: '1.0.0' },
+  onNotification = null,
+  onPermission = null,
+  permissionTimeoutMs = PERMISSION_TIMEOUT_MS,
+  requestTimeoutMs = REQUEST_TIMEOUT_MS,
+  maxFrameLength = MAX_FRAME_LENGTH,
+  stderrLimit = 64 * 1024,
+} = {}) {
+  const child = transport ?? spawn?.();
+  if (!child) throw Error('createAcpClient needs a transport or a spawn that makes one');
+
+  const pending = new Map();      // our request id -> { resolve, reject, timer, method }
+  const permissions = new Map();  // their request id -> { sessionId, options, answer }
+  const decoder = new StringDecoder('utf8');
+  let nextId = 1;
+  let buffer = '';
+  let stderrText = '';
+  let gone = null;                // null while live; the reason once not
+  let negotiated = null;          // what initialize came back with
+
+  /* ------------------------------- writing -------------------------------- */
+
+  function write(message) {
+    if (gone) return false;
+    const line = `${JSON.stringify(message)}\n`;
+    try {
+      // A write that is accepted and then fails reports it in the callback,
+      // and that is the one that matters: a refusal that was "written" and
+      // never arrived cannot be told apart from an approval.
+      child.stdin.write(line, error => { if (error) close(`Write failed: ${error.message}`); });
+    } catch (error) {
+      close(`Write failed: ${error.message}`);
+      return false;
+    }
+    return true;
+  }
+
+  function request(method, params) {
+    if (gone) return Promise.reject(Error(gone));
+    const id = nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        pending.delete(id);
+        reject(Error(`${method} did not answer within ${requestTimeoutMs}ms`));
+      }, requestTimeoutMs);
+      timer.unref?.();
+      pending.set(id, { resolve, reject, timer, method });
+      if (!write({ jsonrpc: '2.0', id, method, params })) {
+        clearTimeout(timer);
+        pending.delete(id);
+        reject(Error(gone ?? 'The agent connection is gone'));
+      }
+    });
+  }
+
+  const notify = (method, params) => write({ jsonrpc: '2.0', method, params });
+
+  /* ------------------------------ permissions ------------------------------ */
+
+  /**
+   * Answer one permission request, once.
+   *
+   * `optionId` when the person chose one of the offered options; null for
+   * `cancelled`, which is what a cancelled turn and an agent that offered no
+   * refusal both come to. The entry is dropped before the write, so a late
+   * answer from a card, a deadline and a cancellation racing each other still
+   * only ever put one response on the wire.
+   */
+  function settlePermission(id, optionId) {
+    const entry = permissions.get(id);
+    if (!entry) return false;
+    permissions.delete(id);
+    clearTimeout(entry.timer);
+    const outcome = optionId ? { outcome: 'selected', optionId } : { outcome: 'cancelled' };
+    write({ jsonrpc: '2.0', id, result: { outcome } });
+    return true;
+  }
+
+  function askPermission(id, params) {
+    const options = Array.isArray(params?.options) ? params.options : [];
+    const deny = () => settlePermission(id, rejectionOption(options));
+    const timer = setTimeout(deny, permissionTimeoutMs);
+    timer.unref?.();
+    permissions.set(id, { sessionId: params?.sessionId ?? null, options, timer });
+    if (!onPermission) return deny();
+    // The asker may answer whenever: the reading loop is not waiting on it.
+    (async () => onPermission({ requestId: id, ...params }))()
+      .then(chosen => settlePermission(id, offeredOption(options, chosen)))
+      .catch(() => deny());
+    return true;
+  }
+
+  /* ------------------------------- reading -------------------------------- */
+
+  function handle(message) {
+    if (message.id != null && (message.result !== undefined || message.error !== undefined)) {
+      const waiting = pending.get(message.id);
+      if (!waiting) return;                       // a response to something we gave up on
+      pending.delete(message.id);
+      clearTimeout(waiting.timer);
+      if (message.error) waiting.reject(Error(`${waiting.method}: ${message.error.message ?? 'failed'}`));
+      else waiting.resolve(message.result);
+      return;
+    }
+    if (message.id != null && message.method) {
+      if (message.method === 'session/request_permission') return void askPermission(message.id, message.params);
+      // Everything else is a capability we did not advertise. Say so.
+      write({ jsonrpc: '2.0', id: message.id, error: { code: -32601, message: `${message.method} is not supported by this client` } });
+      return;
+    }
+    if (message.method) onNotification?.(message.method, message.params ?? {});
+  }
+
+  function absorb(chunk) {
+    if (gone) return;
+    buffer += decoder.write(chunk);
+    let index;
+    while ((index = buffer.indexOf('\n')) >= 0) {
+      const line = buffer.slice(0, index).trim();
+      buffer = buffer.slice(index + 1);
+      if (!line) continue;
+      let message = null;
+      try { message = JSON.parse(line); } catch { continue; } // a line we cannot read is not a reason to die
+      if (message && typeof message === 'object') handle(message);
+    }
+    if (buffer.length > maxFrameLength) close(`A frame longer than ${maxFrameLength} bytes was too long to be a message`);
+  }
+
+  function close(reason) {
+    if (gone) return gone;
+    gone = reason;
+    // Every question still standing goes with the connection: an answer whose
+    // asker has quit is worth nothing, and the agent is already gone.
+    for (const id of [...permissions.keys()]) {
+      const entry = permissions.get(id);
+      permissions.delete(id);
+      clearTimeout(entry.timer);
+    }
+    for (const [id, waiting] of [...pending]) {
+      pending.delete(id);
+      clearTimeout(waiting.timer);
+      waiting.reject(Error(reason));
+    }
+    try { child.stdin.end(); } catch {}
+    try { child.kill?.(); } catch {}
+    return gone;
+  }
+
+  child.stdout?.on('data', absorb);
+  child.stdout?.on('end', () => close(gone ?? 'The agent closed its output'));
+  child.stderr?.on('data', chunk => {
+    if (stderrText.length < stderrLimit) stderrText += chunk.toString().slice(0, stderrLimit - stderrText.length);
+  });
+  child.on?.('error', error => close(`The agent could not be run: ${error.message}`));
+  child.on?.('exit', code => close(gone ?? `The agent exited with code ${code}`));
+
+  /* -------------------------------- the API -------------------------------- */
+
+  return {
+    async initialize() {
+      negotiated = await request('initialize', {
+        protocolVersion: ACP_PROTOCOL_VERSION,
+        clientCapabilities: { fs: { ...CLIENT_CAPABILITIES.fs }, terminal: CLIENT_CAPABILITIES.terminal },
+        clientInfo,
+      });
+      return negotiated;
+    },
+    /**
+     * WHAT THE AGENT SAID IT CAN DO, and nothing we assumed. Speaking ACP does
+     * not make a tool resumable: `loadSession` is optional in the protocol, so
+     * a tool that cannot do it must be read as cannot rather than as untested.
+     */
+    can(capability) {
+      const agent = negotiated?.agentCapabilities ?? {};
+      if (capability === 'image' || capability === 'audio' || capability === 'embeddedContext') {
+        return agent.promptCapabilities?.[capability] === true;
+      }
+      return agent[capability] === true;
+    },
+    authMethods: () => negotiated?.authMethods ?? [],
+    authenticate: methodId => request('authenticate', { methodId }),
+    newSession: ({ cwd, mcpServers = [], additionalDirectories }) =>
+      request('session/new', { cwd, mcpServers, ...(additionalDirectories ? { additionalDirectories } : {}) }),
+    loadSession({ sessionId, cwd, mcpServers = [] }) {
+      // Refused before anything reaches the wire, so a thread cannot be
+      // silently restarted as an empty conversation on a tool that cannot
+      // resume. The caller's job is then to say so on the row.
+      if (!this.can('loadSession')) return Promise.reject(Error('This agent cannot resume a session, so there is no thread to load'));
+      return request('session/load', { sessionId, cwd, mcpServers });
+    },
+    prompt: ({ sessionId, text, blocks = null }) =>
+      request('session/prompt', { sessionId, prompt: blocks ?? [{ type: 'text', text }] }),
+    /**
+     * Stop the turn, and answer what it was parked on. The protocol says a
+     * cancelled turn MUST be answered `cancelled`, and this is the only place
+     * that is true of, so it happens here rather than at a call site.
+     */
+    cancel(sessionId) {
+      for (const [id, entry] of [...permissions]) {
+        if (!sessionId || entry.sessionId === sessionId) settlePermission(id, null);
+      }
+      return notify('session/cancel', { sessionId });
+    },
+    /** An answer from a card. False when the question is no longer standing. */
+    answerPermission: (requestId, optionId) => settlePermission(requestId, optionId),
+    openPermissions: () => permissions.size,
+    closed: () => gone,
+    close,
+    diagnostics: () => stderrText,
+  };
+}

package/main/agent-homes.mjs

@@ -0,0 +1,158 @@
+// EVERY FOLDER CLAUDE CODE AND CODEX KEEP SESSIONS IN, so the import reads all
+// of them rather than the one each tool uses by default (w-e46f2e9cea).
+//
+// Claude Code writes a session to `$CLAUDE_CONFIG_DIR/projects`, and to
+// `~/.claude/projects` only when that variable is unset (read out of the 2.1.293
+// binary, 2026-10-11). Codex does the same with `CODEX_HOME` and `~/.codex`.
+// The import read only the two defaults, and on the Mac this was measured on
+// every Claude Code session its owner had run lived in `~/.claude-2`. The walk's
+// last card is drawn only when the finder hands something back, so a finder
+// looking in the wrong folder does not draw an empty card. It draws no card,
+// and the person is never told importing exists.
+//
+// READING THE VARIABLE IS NOT ENOUGH. An app opened from the Dock never sees
+// what a shell profile exports, so somebody with `export CLAUDE_CONFIG_DIR=...`
+// in their .zshrc gets an app whose environment has no such variable. The
+// folders are looked for instead, by the same rule main/account-discovery.mjs
+// uses to find a second login: `.claude` or `.claude-<anything>` directly under
+// home. That module asks whether a folder holds a LOGIN; this one asks whether
+// it holds SESSIONS, which is a different question with a different answer. A
+// backup folder holds no login and may hold the only copy of a conversation,
+// and two folders signed in as one account are one account but two sets of
+// sessions.
+//
+// A FOLDER COUNTS ONLY IF IT HAS SESSIONS IN IT: `projects/` for Claude Code,
+// `sessions/` for Codex. `~/.claude-worktrees` is named like a data folder and
+// is not one. A folder named `claude-src`, with no dot, is somebody's checkout
+// and is never looked at.
+//
+// Duplicates are the reader's to settle, by session id: a backup folder with a
+// copy of a conversation is ordinary, and the newest copy is the one to offer.
+
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { shellDataDirsNow } from './shell-path.mjs';
+
+const isDir = (p) => { try { return fs.statSync(p).isDirectory(); } catch { return false; } };
+
+/** `.claude`, `.claude-work`, `.codex-2`: every directory under home named `.<tool>` or `.<tool>-<anything>`. */
+function shapedUnderHome(home, tool) {
+  let names = [];
+  try { names = fs.readdirSync(home); } catch { return []; }
+  return names
+    .filter((n) => n === `.${tool}` || n.startsWith(`.${tool}-`))
+    .sort()
+    .map((n) => path.join(home, n));
+}
+
+/**
+ * The candidates, in the order given, kept when they hold `inner/` and named
+ *  once each. Two spellings of one folder (a trailing slash, a symlink) are
+ *  one folder. */
+function keepWithSessions(candidates, inner) {
+  const out = [];
+  const seen = new Set();
+  for (const c of candidates) {
+    if (typeof c !== 'string' || !c.trim()) continue;
+    const dir = path.resolve(c.trim());
+    let real = dir;
+    try { real = fs.realpathSync(dir); } catch { continue; }
+    if (seen.has(real)) continue;
+    if (!isDir(path.join(dir, inner))) continue;
+    seen.add(real);
+    out.push(dir);
+  }
+  return out;
+}
+
+/** A configured profile is 'default' (the tool's own default folder) or a folder. */
+const profileDirs = (configured, dflt) => (Array.isArray(configured) ? configured : [configured])
+  .filter((p) => typeof p === 'string' && p.trim())
+  .map((p) => (p === 'default' ? dflt : p));
+
+/**
+ * EVERY CLAUDE CODE DATA FOLDER ON THIS MACHINE THAT HOLDS SESSIONS.
+ *
+ *  `env` is the app's own environment and is passed in rather than read here,
+ *  so a test with a made-up home is not handed the real folder the test runner
+ *  happens to have in CLAUDE_CONFIG_DIR. `configured` is `authProfiles`. The
+ *  last candidate is `~/.config/claude`, where some Claude Code versions kept
+ *  their data; 2.1.293 no longer does, but a machine that still has sessions
+ *  there gets them read. */
+export function claudeDataDirs({ home = os.homedir(), env = {}, configured = [] } = {}) {
+  const dflt = path.join(home, '.claude');
+  const xdg = env?.XDG_CONFIG_HOME ? path.join(env.XDG_CONFIG_HOME, 'claude') : path.join(home, '.config', 'claude');
+  return keepWithSessions([
+    env?.CLAUDE_CONFIG_DIR,
+    ...profileDirs(configured, dflt),
+    dflt,
+    ...shapedUnderHome(home, 'claude'),
+    xdg,
+  ], 'projects');
+}
+
+/**
+ * BOTH LISTS, AS THE RUNNING APP SEES THEM: its own environment, the Claude
+ *  profiles it was configured with, and the Codex homes its supervisor runs on.
+ *  The one call the import card, the Codex watch and the import answer share,
+ *  so the three cannot disagree about where somebody's sessions are. */
+export function sessionFolders({ claudeProfiles = [], codexHomes = [], env = process.env, home = os.homedir() } = {}) {
+  return {
+    dirs: claudeDataDirs({ home, env, configured: claudeProfiles }),
+    codexDirs: codexDataDirs({ home, env, configured: codexHomes }),
+  };
+}
+
+/**
+ * THE CODEX HOMES THE SUPERVISOR RUNS ON, or as many of them as can be named.
+ *  Each profile is resolved on its own, so one that throws costs that one home
+ *  and not the list (found by Codex's review of this change, 2026-10-11). */
+export function codexHomesOf(supervisor) {
+  let profiles = [];
+  try { profiles = supervisor?._codexProfiles?.() ?? []; } catch { profiles = []; }
+  if (!Array.isArray(profiles)) return [];
+  const out = [];
+  for (const p of profiles) {
+    try {
+      const h = supervisor._codexProfileHome(p);
+      if (typeof h === 'string' && h.trim()) out.push(h);
+    } catch { /* that one home is unknown; the rest still count */ }
+  }
+  return out;
+}
+
+/**
+ * WHAT THE RUNNING APP HANDS EVERY READER: its own config and supervisor, made
+ *  safe. A missing config, a supervisor without the Codex methods, or a home
+ *  that will not resolve each lose only their own part. The first draft built
+ *  both lists inside one try, so any one of those left the import reading
+ *  nothing beyond the defaults, and without the app's own CLAUDE_CONFIG_DIR or
+ *  CODEX_HOME either. */
+export function appSessionFolders({ config = null, supervisor = null, env = process.env, shellEnv = shellDataDirsNow(), home = os.homedir() } = {}) {
+  let claudeProfiles = [];
+  try { claudeProfiles = config?.authProfiles ?? []; } catch { claudeProfiles = []; }
+  if (!Array.isArray(claudeProfiles)) claudeProfiles = [claudeProfiles];
+  // AND WHAT THE LOGIN SHELL EXPORTS (main/shell-path.mjs), which an app opened
+  // from the Dock never sees in its own environment.
+  return sessionFolders({
+    claudeProfiles: [...claudeProfiles, shellEnv?.CLAUDE_CONFIG_DIR],
+    codexHomes: [...codexHomesOf(supervisor), shellEnv?.CODEX_HOME],
+    env,
+    home,
+  });
+}
+
+/**
+ * EVERY CODEX DATA FOLDER ON THIS MACHINE THAT HOLDS SESSIONS. Same rule:
+ *  `CODEX_HOME`, whatever the app was configured with, `~/.codex` and every
+ *  `~/.codex-<name>`. */
+export function codexDataDirs({ home = os.homedir(), env = {}, configured = [] } = {}) {
+  const dflt = path.join(home, '.codex');
+  return keepWithSessions([
+    env?.CODEX_HOME,
+    ...profileDirs(configured, dflt),
+    dflt,
+    ...shapedUnderHome(home, 'codex'),
+  ], 'sessions');
+}

package/main/agent-sessions.mjs

@@ -12,7 +12,9 @@
 //
 // WHERE A THREAD LIVES. Two places, because she named two:
 //
-//   ~/.claude/projects/<folder>/<id>.jsonl     every terminal session
+//   ~/.claude/projects/<folder>/<id>.jsonl     every terminal session (and the
+//                                              same under every other Claude
+//                                              data folder: main/agent-homes.mjs)
 //   ~/Library/Application Support/Claude/
 //     claude-code-sessions/**/local_<id>.json  the desktop app
 //
@@ -49,6 +51,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { claudeDataDirs } from './agent-homes.mjs';
 
 /**
  * "Recent = last few days", in days.
@@ -149,9 +152,22 @@ export function isScratchProjectDir(name, home = os.homedir()) {
  *
  *  An entrypoint we have never seen is treated as not hers. The cost of being
  *  wrong that way is one missing row on a card; the other way is the hundreds
- *  she is complaining about. */
+ *  she is complaining about.
+ *
+ *  `claude-vscode` IS A PERSON TOO (w-e46f2e9cea, 2026-10-11). It is what the
+ *  Claude Code extension writes in VS Code, Cursor and Windsurf, and leaving it
+ *  out threw away every session of everybody who runs Claude Code in an editor.
+ *  Read out of the 2.1.293 binary, which maps it to `claude_code_vscode`. The
+ *  `remote*` family stays out: those run in the cloud, not on this disk. */
+const BY_HAND = new Set(['cli', 'claude-desktop', 'claude-vscode']);
 export function startedByHand(entrypoint) {
-  return entrypoint === 'cli' || entrypoint === 'claude-desktop';
+  return BY_HAND.has(entrypoint);
+}
+
+/** Which of the three places a person starts Claude Code a session came from. */
+export function sourceOf(entrypoint) {
+  if (entrypoint === 'claude-desktop') return 'desktop';
+  return entrypoint === 'claude-vscode' ? 'editor' : 'terminal';
 }
 
 /**
@@ -251,9 +267,11 @@ export function readTranscriptHead(file, bytes = HEAD_BYTES, most = FIRST_TURN_B
     const n = fs.readSync(fd, buf, 0, bytes, 0);
     const text = buf.slice(0, n).toString('utf8');
     // The last line of a fixed read is usually cut in half. Dropping it costs
-    // nothing, because what is wanted is at the top.
+    // nothing, because what is wanted is at the top. UNLESS THE WHOLE FILE FIT:
+    // then the last line is complete, and a file whose one row has no newline
+    // after it lost that row (found by Codex's review, 2026-10-11).
     const lines = text.split('\n');
-    const cut = lines.pop();
+    const cut = n < bytes ? null : lines.pop();
     let cwd = null;
     let entrypoint = null;
     const said = [];
@@ -278,7 +296,7 @@ export function readTranscriptHead(file, bytes = HEAD_BYTES, most = FIRST_TURN_B
     // only when nothing she said was found and the session is not already
     // known to be the app's own, so the thousands of worker transcripts are
     // never read past their head.
-    if (!said.length && n === bytes && cut && /"type":"user"/.test(cut.slice(0, 2048))
+    if (!said.length && n === bytes && cut && /"type"\s*:\s*"user"/.test(cut.slice(0, 2048))
       && (!entrypoint || startedByHand(entrypoint))) {
       const rest = restOfLine(fd, n, most - n);
       if (rest) take(Buffer.concat([buf.subarray(buf.lastIndexOf(0x0a, n - 1) + 1, n), rest]).toString('utf8'));
@@ -331,25 +349,35 @@ function messageText(row) {
  *  `skipped` comes back with it because the counts are the argument for the
  *  filters, and a session that changes one of them should be able to see what
  *  it changed rather than take this comment's word for it. */
-function readTerminalThreads({ home, cutoff, max, skipIds = new Set() }) {
-  const root = path.join(home, '.claude', 'projects');
-  const skipped = { old: 0, scratch: 0, started: 0, subagent: 0, empty: 0, unread: 0, desktopDupe: 0 };
+function readTerminalThreads({ home, dirs, cutoff, max, skipIds = new Set() }) {
+  const skipped = { old: 0, scratch: 0, started: 0, subagent: 0, empty: 0, unread: 0, desktopDupe: 0, copy: 0 };
   const out = [];
-  const all = [];
-  walkTranscripts(root, all);
   // Stat everything, keep the recent, newest first, and only then start opening
   // files. This is the order that makes `max` safe: whatever it cuts off is
   // older than everything it kept.
+  //
+  // EVERY DATA FOLDER, NOT ONLY ~/.claude (main/agent-homes.mjs). They are
+  // pooled before the sort, so the cap and the time budget are spent on the
+  // newest sessions on the machine, whichever folder they are in.
   const recent = [];
-  for (const file of all) {
-    let when = 0;
-    try { when = fs.statSync(file).mtimeMs; } catch { continue; }
-    if (when < cutoff) { skipped.old += 1; continue; }
-    if (isSubagentPath(file.slice(root.length))) { skipped.subagent += 1; continue; }
-    if (isScratchProjectDir(path.relative(root, file).split(path.sep)[0], home)) { skipped.scratch += 1; continue; }
-    recent.push({ file, when });
+  for (const dir of dirs) {
+    const root = path.join(dir, 'projects');
+    const all = [];
+    walkTranscripts(root, all);
+    for (const file of all) {
+      let when = 0;
+      try { when = fs.statSync(file).mtimeMs; } catch { continue; }
+      if (when < cutoff) { skipped.old += 1; continue; }
+      if (isSubagentPath(file.slice(root.length))) { skipped.subagent += 1; continue; }
+      if (isScratchProjectDir(path.relative(root, file).split(path.sep)[0], home)) { skipped.scratch += 1; continue; }
+      recent.push({ file, when });
+    }
   }
   recent.sort((a, b) => b.when - a.when);
+  // ONE SESSION IS ONE ROW, even when two folders hold it: a backup folder with
+  // a copy of a conversation is ordinary. Newest first, so the copy kept is the
+  // one still being written to.
+  const seenIds = new Set();
   // THE CAP COUNTS WHAT IS KEPT, NOT WHAT IS OPENED (w-ec62ab6b38, 2026-09-28).
   // On a busy machine the last seven days held 9,073 transcripts, the newest
   // 1,200 were opened, and every one of those was started by agentbox itself,
@@ -373,14 +401,18 @@ function readTerminalThreads({ home, cutoff, max, skipIds = new Set() }) {
     // one desktop thread in her store. Its own record wins, because the app
     // wrote a real title into it and this side would have to guess one.
     if (skipIds.has(id)) { skipped.desktopDupe += 1; continue; }
+    if (seenIds.has(id)) { skipped.copy += 1; continue; }
     const { cwd, entrypoint, said } = readTranscriptHead(file);
+    // A copy is only the copy once it could be read. A damaged newer one, cut
+    // off mid-write, would otherwise hide the good older one in another folder.
+    if (cwd || entrypoint) seenIds.add(id);
     if (!startedByHand(entrypoint)) { skipped.started += 1; continue; }
     if (isScratchFolder(cwd, home)) { skipped.scratch += 1; continue; }
     const title = threadTitle(said);
     if (!title) { skipped.empty += 1; continue; }
     out.push({
       id,
-      source: entrypoint === 'claude-desktop' ? 'desktop' : 'terminal',
+      source: sourceOf(entrypoint),
       folder: cwd,
       folderName: path.basename(cwd),
       short: shortFolder(cwd, home),
@@ -484,6 +516,11 @@ function walkDesktop(dir, into, max, depth = 3) {
  *  the card groups by it, the same way it already groups agent files. */
 export function readSessionThreads({
   home = os.homedir(),
+  // Every Claude Code data folder to read (main/agent-homes.mjs). The app hands
+  // in the list it made with its own environment and settings; left out, it is
+  // the folders under `home`, and nothing from whatever CLAUDE_CONFIG_DIR the
+  // caller's process happens to carry.
+  dirs = claudeDataDirs({ home }),
   days = RECENT_DAYS,
   now = Date.now(),
   max = MAX_READS,
@@ -492,7 +529,7 @@ export function readSessionThreads({
   // The desktop side goes first so its ids are known before the transcripts are
   // walked, which is what stops one thread appearing twice.
   const desk = readDesktopThreads({ home, cutoff, max });
-  const term = readTerminalThreads({ home, cutoff, max, skipIds: desk.owned });
+  const term = readTerminalThreads({ home, dirs, cutoff, max, skipIds: desk.owned });
   const threads = [...term.threads, ...desk.threads].sort((a, b) => b.when - a.when);
   return {
     threads,