claude-wake 0.1.0

package/docs/design.md

@@ -0,0 +1,181 @@
+# claude-wake — Design
+
+_Last updated: 2026-07-07_
+
+## Problem
+
+When the Claude Code **VS Code extension panel** hits a usage limit ("You've hit your
+session limit · resets 3:30pm"), work stops until a human types "continue" after the
+reset. Overnight or AFK, hours are lost. Existing tools (e.g. `claude-auto-retry`)
+only cover the **terminal TUI** via tmux — the native extension panel is a webview
+that tmux can't see, and there is no built-in auto-resume, no hook, and no IPC to
+inject a message into a running panel.
+
+## Verified foundation (reverse-engineered + live-tested on macOS, 2026-07)
+
+1. **Detection** — the extension writes session transcripts to
+   `~/.claude/projects/<enc-cwd>/<sessionId>.jsonl` (same store as the CLI). A real
+   limit is one JSONL line with top-level `isApiErrorMessage: true`,
+   `apiErrorStatus: 429`, `error: "rate_limit"`, plus `sessionId` and message text
+   like `You've hit your session limit · resets 1:20am (America/Los_Angeles)` —
+   reset time **with IANA timezone** included.
+2. **Focus** — `vscode://anthropic.claude-code/open?session=<id>` reveals the exact
+   panel among many (verified in extension source: `claude-vscode.primaryEditor.open`).
+   The `prompt` query param is **ignored when the panel is already open**, so it
+   cannot be used to inject the message — focus only.
+3. **Send** — the panel's webview input **ignores synthetic keystrokes but accepts a
+   paste**: set clipboard → Cmd/Ctrl+V → Return. On macOS the sending process needs
+   Accessibility permission; a small compiled `.app` holds that grant so it works
+   from a background daemon.
+
+All three steps were verified end-to-end in production on 2026-07-07 (two limited
+panels auto-resumed at reset+60s, zero errors).
+
+## Goals / non-goals
+
+**Goals**
+
+- Auto-resume Claude Code extension panels after a usage-limit reset, unattended.
+- Cross-platform: macOS (reference, fully verified), Linux + Windows (implemented,
+  community-verify).
+- `npm i -g claude-wake` → `claude-wake install` and forget. Zero runtime deps.
+- Safe by default: guarded resume message, focus verification before keystrokes,
+  strict input validation, no shell interpolation of untrusted data.
+
+**Non-goals (v1)**
+
+- Terminal TUI sessions (use `claude-auto-retry`).
+- Handoff to other agents (Codex etc.) — possible future plugin surface.
+- Bypassing/queueing around limits — this waits for the official reset, nothing more.
+
+## Architecture
+
+```
+bin/claude-wake.js      CLI: watch | install | uninstall | status | doctor | test | logs
+lib/watch.js            core loop: scan → schedule → fire (single-instance lock)
+lib/detect.js           jsonl tailing + rate-limit entry parsing (pure)
+lib/parse-reset.js      tz-aware "resets 3:30pm (America/Los_Angeles)" → epoch (pure)
+lib/state.js            offsets / pending / fired episodes, atomic writes (pure-ish)
+lib/config.js           defaults + ~/.claude-wake/config.json merge + validation
+lib/editors.js          editor presets (vscode / insiders / cursor / windsurf)
+lib/send/index.js       platform dispatch
+lib/send/darwin.js      pbcopy + compiled KeySender.app (osacompile at setup)
+lib/send/linux.js       xclip|wl-copy + xdotool (X11) / wtype (Wayland, experimental)
+lib/send/win32.js       PowerShell Set-Clipboard + WScript AppActivate/SendKeys
+lib/install.js          launchd / systemd --user / Startup-folder registration
+lib/doctor.js           dependency + permission checks with fix instructions
+```
+
+### Data flow
+
+1. `watch` polls `~/.claude/projects/*/*.jsonl` every `pollSeconds` (20s), reading
+   only bytes appended since the stored per-file offset. First run primes offsets to
+   EOF (never replays history).
+2. A line parses as a limit event iff `isApiErrorMessage === true`, a rate-limit
+   marker is present (`error === "rate_limit"` or `apiErrorStatus === 429`), AND
+   the text carries usage-limit phrasing (transient server 429s say "not your
+   usage limit" and are rejected). Extracts `sessionId` (strict UUID check),
+   text, timestamp, uuid.
+3. `parse-reset` turns the text into an epoch using the embedded IANA timezone
+   (iterative-offset conversion, DST-safe, pure `Intl`), referenced to the EVENT
+   timestamp (not scan time — duplicate lines must parse identically). Fallbacks:
+   "try again in N hours/minutes" → relative to the event; nothing parseable →
+   event + `fallbackWaitHours`. Dates >8 days out are year-boundary mis-parses
+   and resolve backwards (a passed reset fires immediately).
+4. Dedupe: one fire per limit episode. An episode is identified by proximity —
+   same session within ±15 min of a pending/fired fire time — plus the event
+   line's `uuid` (session resume copies history into a new sessionId with the
+   same uuids). Persisted, so restarts and replays never refire.
+5. At `reset + marginSeconds`: optionally skip if the session shows HUMAN
+   activity after the event (`skipIfResumed`, default on; `isMeta`, tool
+   results, and harness-injected tag blocks don't count). Then: open
+   `<scheme>://anthropic.claude-code/open?session=<id>` → wait `focusDelayMs` →
+   **verify the frontmost app** → only now set the clipboard → paste + Enter.
+   Multiple due episodes fire `fireSpacingSeconds` apart.
+
+### The guarded message (default, English, single line — enforced)
+
+> "If you were stopped by a usage or token limit, continue from exactly where you
+> left off. If you were not stopped, or the task is already complete, ignore this
+> message."
+
+Guarded wording makes stray fires harmless (plan upgraded, limit already reset,
+task finished). Configurable via `message` in config; newlines are stripped
+(a newline would submit early).
+
+## Security posture
+
+- **No shell interpolation of transcript-derived data.** Session ids must match
+  a strict UUID pattern before any use; message text only ever travels via stdin /
+  request files; URIs are built from validated ids + fixed schemes.
+- **JSONL events cannot be forged from conversation content**: detection keys on
+  top-level fields of each line; JSON string values cannot contain raw newlines,
+  so content cannot fabricate a new line/entry. (The trust boundary is the file
+  system: `.jsonl` files under the projects dir are trusted as Claude Code's own
+  output — a process that can already write files as the user is out of scope.)
+- **Focus verification before keystrokes**, fail-closed on every verifiable
+  platform: macOS checks the frontmost app's **bundle identifier** (process names
+  like "Electron" are shared across many apps); X11 requires the active window
+  title to end with the editor name; Windows verifies the real foreground window
+  PID via `GetForegroundWindow` (AppActivate's return value lies under
+  focus-stealing prevention). Wayland has no portable check → sends are refused
+  unless `allowUnverifiedPaste: true`. The clipboard is only written after
+  verification passes.
+- **The transient-429 trap**: `error:"rate_limit"` also appears for server-side
+  throttling ("… not your usage limit"). Detection additionally requires
+  usage-limit phrasing, so transient capacity errors never schedule a resume.
+- **Zero runtime dependencies** — nothing to supply-chain.
+- State/config/log files live in `~/.claude-wake/` (0700 dir).
+- Single-instance lock (`watch.lock`, pid + liveness check) prevents double-fires
+  from daemon + manual watch.
+
+## Platform notes
+
+| | clipboard | focus URI | paste+enter | daemon | perms |
+|---|---|---|---|---|---|
+| macOS | `pbcopy` | `open` | compiled `KeySender.app` (AppleScript, frontmost-verified) | launchd LaunchAgent | Accessibility, once, for KeySender.app |
+| Linux X11 | `xclip`/`xsel` | `xdg-open` | `xdotool` (active-window verified) | systemd --user (graphical-session) | none (X11) |
+| Linux Wayland | `wl-copy` | `xdg-open` | `wtype` (experimental; compositor-dependent) | systemd --user | compositor-dependent |
+| Windows | `Set-Clipboard` | `Start-Process` | `WScript.Shell` AppActivate+SendKeys | Startup-folder VBS (hidden) | none |
+
+macOS is the reference implementation (fully live-verified). Linux/Windows are
+implemented to spec and marked **community-verify** in the README; `doctor` checks
+tool availability and prints install hints.
+
+## Config (`~/.claude-wake/config.json`, all optional)
+
+| key | default | notes |
+|---|---|---|
+| `message` | guarded English text | single line enforced |
+| `marginSeconds` | 60 | wait after printed reset |
+| `pollSeconds` | 20 | transcript scan interval |
+| `focusDelayMs` | 2500 | URI-open → paste delay (cold starts need more) |
+| `fallbackWaitHours` | 5 | when reset time can't be parsed |
+| `maxEventAgeHours` | 8 | ignore stale events on startup |
+| `fireSpacingSeconds` | 5 | gap between simultaneous resumes |
+| `editor` | `"vscode"` | `vscode` \| `vscode-insiders` \| `cursor` \| `windsurf` |
+| `skipIfResumed` | true | skip if user was active after the limit |
+| `allowUnverifiedPaste` | false | Wayland only: allow blind sends |
+| `claudeDir` | `$CLAUDE_CONFIG_DIR` or `~/.claude` | transcript root |
+
+## Testing
+
+- `node --test`: pure modules get unit tests — reset parsing (12h/24h, "Oct 9,
+  10am", DST boundaries, half-hour zones, relative forms), detection (real fixture
+  lines, forged-content negative cases), episode dedupe, config validation.
+- `claude-wake test [--session <id>] [--dry-run]` — manual end-to-end fire for
+  setup verification.
+- `claude-wake watch --dry-run` — full pipeline, prints instead of sending.
+
+## Known limitations (documented in README)
+
+- Limits are **account-wide**: several panels resuming together re-consume quota
+  quickly (spacing helps, doesn't solve).
+- An auto-resumed panel continues **autonomous execution** unattended — same trust
+  level as leaving Claude Code running.
+- If the user is actively typing at fire time, focus verification aborts rather
+  than risk pasting into the wrong window (that episode is skipped, logged).
+- Depends on two stable-ish contracts: the transcript rate-limit line shape and the
+  `vscode://anthropic.claude-code/open?session=` handler. Both are version-checked
+  realities, not documented APIs; a `doctor` warning + fast patch release is the
+  mitigation strategy.

package/lib/config.js

@@ -0,0 +1,174 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+export const HOME = os.homedir();
+export const BASE_DIR = path.join(HOME, ".claude-wake");
+export const CONFIG_FILE = path.join(BASE_DIR, "config.json");
+export const STATE_FILE = path.join(BASE_DIR, "state.json");
+export const LOCK_FILE = path.join(BASE_DIR, "watch.lock");
+export const LOG_FILE = path.join(BASE_DIR, "watcher.log");
+export const PAUSE_FILE = path.join(BASE_DIR, "paused");
+
+/** Paused = auto-resume is suspended. While paused the watcher stays alive but
+ *  does not scan or fire; on resume it re-primes to now (ignores limits that
+ *  happened during the pause — you paused on purpose). */
+export function isPaused() {
+  try {
+    return fs.existsSync(PAUSE_FILE);
+  } catch {
+    return false;
+  }
+}
+
+export function setPaused(paused) {
+  ensureBaseDir();
+  if (paused) {
+    fs.writeFileSync(PAUSE_FILE, new Date().toISOString(), { mode: 0o600 });
+  } else {
+    fs.rmSync(PAUSE_FILE, { force: true });
+  }
+}
+
+export const DEFAULT_MESSAGE =
+  "If you were stopped by a usage or token limit, continue from exactly where " +
+  "you left off. If you were not stopped, or the task is already complete, " +
+  "ignore this message.";
+
+export const DEFAULTS = Object.freeze({
+  message: DEFAULT_MESSAGE,
+  marginSeconds: 60,
+  pollSeconds: 20,
+  focusDelayMs: 2500,
+  fallbackWaitHours: 5,
+  maxEventAgeHours: 8,
+  fireSpacingSeconds: 5,
+  editor: "vscode",
+  skipIfResumed: true,
+  // Wayland has no portable "which window is focused" check, so a send there
+  // is blind. Fail closed unless the user explicitly opts in.
+  allowUnverifiedPaste: false,
+  claudeDir: null, // resolved lazily: $CLAUDE_CONFIG_DIR or ~/.claude
+});
+
+function clampNumber(value, fallback, min, max) {
+  const n = Number(value);
+  if (!Number.isFinite(n)) return fallback;
+  return Math.min(max, Math.max(min, n));
+}
+
+/**
+ * Make an arbitrary string safe as a resume message: one line (a newline would
+ * submit early), length-capped, and never a leading slash-command / @-mention.
+ * Returns "" for non-strings / blank input (→ caller falls back to the default).
+ */
+export function sanitizeMessage(s) {
+  if (typeof s !== "string") return "";
+  // Collapse ANY CR/LF run (incl. a lone \r) to a space — a bare carriage
+  // return can submit early when pasted.
+  let msg = s
+    .replace(/\s*[\r\n]+\s*/g, " ")
+    .trim()
+    .slice(0, 2000);
+  if (/^[/@]/.test(msg)) msg = " " + msg;
+  return msg;
+}
+
+/** Read config.json as a plain object (or {} if missing/invalid). */
+export function readConfigRaw() {
+  try {
+    const o = JSON.parse(fs.readFileSync(CONFIG_FILE, "utf8"));
+    return o && typeof o === "object" && !Array.isArray(o) ? o : {};
+  } catch {
+    return {};
+  }
+}
+
+/** Atomically write a config object. */
+export function writeConfigRaw(obj) {
+  ensureBaseDir();
+  const tmp = CONFIG_FILE + ".tmp";
+  fs.writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: 0o600 });
+  fs.renameSync(tmp, CONFIG_FILE);
+}
+
+/** Merge user config over defaults; invalid values fall back silently-but-logged. */
+export function loadConfig({ warn = () => {}, file = CONFIG_FILE } = {}) {
+  let user = {};
+  try {
+    user = JSON.parse(fs.readFileSync(file, "utf8"));
+    if (typeof user !== "object" || user === null || Array.isArray(user)) {
+      warn(`config: ${file} is not a JSON object; using defaults`);
+      user = {};
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT")
+      warn(`config: cannot read ${file}: ${err.message}`);
+  }
+
+  const cfg = { ...DEFAULTS };
+
+  if (typeof user.message === "string" && user.message.trim()) {
+    const msg = sanitizeMessage(user.message);
+    if (msg) cfg.message = msg;
+  }
+  cfg.marginSeconds = clampNumber(
+    user.marginSeconds,
+    DEFAULTS.marginSeconds,
+    0,
+    3600,
+  );
+  // Max is bounded well under the lock heartbeat's stale window so the
+  // watcher can never starve its own single-instance lock between polls.
+  cfg.pollSeconds = clampNumber(user.pollSeconds, DEFAULTS.pollSeconds, 5, 120);
+  cfg.focusDelayMs = clampNumber(
+    user.focusDelayMs,
+    DEFAULTS.focusDelayMs,
+    500,
+    30000,
+  );
+  cfg.fallbackWaitHours = clampNumber(
+    user.fallbackWaitHours,
+    DEFAULTS.fallbackWaitHours,
+    0.1,
+    24 * 8,
+  );
+  cfg.maxEventAgeHours = clampNumber(
+    user.maxEventAgeHours,
+    DEFAULTS.maxEventAgeHours,
+    0.1,
+    24 * 8,
+  );
+  // Kept small so a multi-episode fire burst can't outrun the lock heartbeat
+  // (a huge spacing + a slow send could exceed the stale window → double-fire).
+  cfg.fireSpacingSeconds = clampNumber(
+    user.fireSpacingSeconds,
+    DEFAULTS.fireSpacingSeconds,
+    0,
+    30,
+  );
+  if (typeof user.editor === "string") cfg.editor = user.editor.slice(0, 64);
+  if (typeof user.skipIfResumed === "boolean")
+    cfg.skipIfResumed = user.skipIfResumed;
+  if (typeof user.allowUnverifiedPaste === "boolean")
+    cfg.allowUnverifiedPaste = user.allowUnverifiedPaste;
+  if (typeof user.claudeDir === "string" && user.claudeDir.trim())
+    cfg.claudeDir = user.claudeDir;
+
+  return cfg;
+}
+
+/** Transcript root: explicit config > $CLAUDE_CONFIG_DIR > ~/.claude */
+export function resolveClaudeDir(cfg) {
+  if (cfg.claudeDir) return cfg.claudeDir;
+  if (process.env.CLAUDE_CONFIG_DIR) return process.env.CLAUDE_CONFIG_DIR;
+  return path.join(HOME, ".claude");
+}
+
+export function projectsDir(cfg) {
+  return path.join(resolveClaudeDir(cfg), "projects");
+}
+
+export function ensureBaseDir() {
+  fs.mkdirSync(BASE_DIR, { recursive: true, mode: 0o700 });
+}

package/lib/detect.js

@@ -0,0 +1,223 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isValidSessionId } from "./editors.js";
+
+/**
+ * Transcript scanning + rate-limit event parsing.
+ *
+ * A usage-limit event is one JSONL line with TOP-LEVEL `isApiErrorMessage:
+ * true`, a rate-limit marker (`error: "rate_limit"` or `apiErrorStatus: 429`),
+ * AND limit phrasing in the text. The phrase requirement matters: transient
+ * server-side 429s also log `error: "rate_limit"` but say "Server is
+ * temporarily limiting requests (not your usage limit)" — resuming those
+ * would be a spurious fire (found in hostile review).
+ *
+ * Conversation content cannot forge these events: detection keys on top-level
+ * fields of each line, and JSON string values cannot contain the raw newline
+ * needed to fabricate a separate JSONL line.
+ */
+
+const LIMIT_PHRASE_RE =
+  /hit your (?:session |weekly |monthly )?limit|usage limit reached|limit reached|out of extra usage|try again in \d+\s*(?:hour|minute)/i;
+const NOT_USAGE_LIMIT_RE = /not your usage limit/i;
+
+const UUID_BASENAME_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/;
+
+/** Cap per-file bytes read in one poll (hostile review: unbounded alloc). */
+const MAX_READ_BYTES = 8 * 1024 * 1024;
+
+/** Extract plain text from a transcript message object. */
+export function textOfMessage(message) {
+  if (!message) return "";
+  const c = message.content;
+  if (typeof c === "string") return c;
+  if (Array.isArray(c)) {
+    return c
+      .map((b) =>
+        b && typeof b === "object" && typeof b.text === "string" ? b.text : "",
+      )
+      .join(" ");
+  }
+  return "";
+}
+
+/** Parse one JSONL line → rate-limit event or null. */
+export function parseLimitLine(line) {
+  // Cheap pre-filter before JSON.parse (hot path: most lines are not errors).
+  if (!line.includes('"isApiErrorMessage"')) return null;
+  let d;
+  try {
+    d = JSON.parse(line);
+  } catch {
+    return null;
+  }
+  if (d === null || typeof d !== "object" || d.isApiErrorMessage !== true)
+    return null;
+
+  const text = textOfMessage(d.message);
+  const marker = d.error === "rate_limit" || d.apiErrorStatus === 429;
+  if (!marker) return null;
+  if (!LIMIT_PHRASE_RE.test(text) || NOT_USAGE_LIMIT_RE.test(text)) return null;
+  if (!isValidSessionId(d.sessionId)) return null;
+
+  let eventEpochMs = Date.parse(d.timestamp);
+  if (!Number.isFinite(eventEpochMs)) eventEpochMs = Date.now();
+
+  return {
+    sessionId: d.sessionId,
+    uuid: typeof d.uuid === "string" ? d.uuid : null,
+    text,
+    eventEpochMs,
+  };
+}
+
+/**
+ * List session transcript files under <claudeDir>/projects.
+ * Only UUID-named files (real panel sessions — excludes agent side files);
+ * symlinks are skipped. Returns null when the ROOT cannot be read, so a
+ * transient readdir failure is distinguishable from "no files" (a `[]` here
+ * once wiped all offsets and caused a full-history replay — hostile review).
+ */
+export function listTranscripts(projectsRoot) {
+  const out = [];
+  let dirs;
+  try {
+    dirs = fs.readdirSync(projectsRoot, { withFileTypes: true });
+  } catch {
+    return null;
+  }
+  for (const dir of dirs) {
+    if (!dir.isDirectory()) continue;
+    const sub = path.join(projectsRoot, dir.name);
+    let files;
+    try {
+      files = fs.readdirSync(sub);
+    } catch {
+      continue;
+    }
+    for (const f of files) {
+      if (!UUID_BASENAME_RE.test(f)) continue;
+      const full = path.join(sub, f);
+      try {
+        if (!fs.lstatSync(full).isFile()) continue; // skip symlinks & oddities
+      } catch {
+        continue;
+      }
+      out.push(full);
+    }
+  }
+  return out;
+}
+
+/**
+ * Read newly appended bytes of `file` since `offset` (capped per poll).
+ * Returns { events, newOffset }. Handles truncation (offset reset to 0).
+ *
+ * Incomplete trailing lines (no final newline yet) are NOT consumed — the
+ * offset stops at the last complete line so a partially-flushed JSON entry is
+ * re-read intact on the next poll.
+ */
+export function scanFile(file, offset) {
+  let size;
+  try {
+    size = fs.statSync(file).size;
+  } catch {
+    return { events: [], newOffset: offset };
+  }
+  let from = offset;
+  if (size < from) from = 0; // truncated / rotated
+  if (size === from) return { events: [], newOffset: from };
+
+  let fd;
+  try {
+    fd = fs.openSync(file, "r");
+  } catch {
+    return { events: [], newOffset: from };
+  }
+  let chunk;
+  try {
+    const len = Math.min(size - from, MAX_READ_BYTES);
+    const buf = Buffer.alloc(len);
+    const read = fs.readSync(fd, buf, 0, len, from);
+    chunk = buf.subarray(0, read).toString("utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
+
+  const lastNl = chunk.lastIndexOf("\n");
+  if (lastNl === -1) {
+    // No newline in this window. If we read a FULL cap without one, the line
+    // is pathologically large (embedded image / giant tool_result) — advance
+    // past it so scanning never wedges and later events are still seen. A
+    // short read (< cap) is just an incomplete trailing line still being
+    // written — leave the offset so it's re-read intact.
+    if (size - from > MAX_READ_BYTES) {
+      return { events: [], newOffset: from + Buffer.byteLength(chunk, "utf8") };
+    }
+    return { events: [], newOffset: from };
+  }
+  const complete = chunk.slice(0, lastNl);
+  const newOffset =
+    from + Buffer.byteLength(chunk.slice(0, lastNl + 1), "utf8");
+
+  const events = [];
+  for (const line of complete.split("\n")) {
+    const ev = parseLimitLine(line);
+    if (ev) events.push({ ...ev, transcriptPath: file });
+  }
+  return { events, newOffset };
+}
+
+/** Auto-injected user-type lines that no human typed (skill loads, hook output …). */
+const INJECTED_TEXT_RE =
+  /^\s*<(?:local-command|command-name|command-message|system-reminder|task-notification)/;
+
+/**
+ * Did the human interact with this session AFTER the limit event?
+ * Used by skipIfResumed: if yes, the user already resumed manually — don't fire.
+ *
+ * Counts only genuine human text: skips `isMeta` lines, tool_result-only
+ * entries, and harness-injected tag blocks (all of which are `type:"user"`
+ * lines no human typed — hostile review found they silently cancelled
+ * legitimate resumes).
+ *
+ * Reads only the tail (last 256 KB) — enough for anything after a recent event.
+ */
+export function sessionResumedAfter(transcriptPath, eventEpochMs) {
+  let size, fd;
+  try {
+    size = fs.statSync(transcriptPath).size;
+    fd = fs.openSync(transcriptPath, "r");
+  } catch {
+    return false;
+  }
+  let tail;
+  try {
+    const len = Math.min(size, 256 * 1024);
+    const buf = Buffer.alloc(len);
+    const read = fs.readSync(fd, buf, 0, len, size - len);
+    tail = buf.subarray(0, read).toString("utf8");
+  } finally {
+    fs.closeSync(fd);
+  }
+  for (const line of tail.split("\n")) {
+    if (!line.includes('"type":"user"') && !line.includes('"type": "user"'))
+      continue;
+    let d;
+    try {
+      d = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (d.type !== "user") continue;
+    if (d.isMeta === true) continue;
+    const ts = Date.parse(d.timestamp);
+    if (!Number.isFinite(ts) || ts <= eventEpochMs) continue;
+    const text = textOfMessage(d.message);
+    if (!text || !text.trim()) continue; // tool_result blocks have no .text
+    if (INJECTED_TEXT_RE.test(text)) continue;
+    return true; // real human text after the event
+  }
+  return false;
+}