opencode-context-indicator 1.5.4 → 1.7.0

package/lib/commands.js

@@ -9,6 +9,8 @@ import {
   breakdownCategories,
   fmt,
   fmtCell,
+  isHookMeasuredEntry,
+  isHookSource,
   isSafeSessionKey,
   oneLine,
   safeCategories,
@@ -70,6 +72,23 @@ import {
 // from state.json / live, but the category cells stay n/a.
 const COMMAND_COLLECT_BUDGET_MS = 3500;
 
+// Session ids for which this instance already tried a live enrichment and found
+// nothing better than state.json. The Desktop panel polls collectFamilyReports
+// (and therefore collectSessionReport) every 1.5 s; without this, a session
+// whose state entry has no agent/model would issue session.get() on every poll,
+// forever. Bounded: an instance only ever tracks the sessions it has seen.
+const ENRICH_ATTEMPTED_MAX = 256;
+const enrichAttempted = new Set();
+
+function markEnrichAttempted(sessionID) {
+  if (enrichAttempted.has(sessionID)) return;
+  if (enrichAttempted.size >= ENRICH_ATTEMPTED_MAX) {
+    const oldest = enrichAttempted.values().next().value;
+    enrichAttempted.delete(oldest);
+  }
+  enrichAttempted.add(sessionID);
+}
+
 // `resume` for the full /context-breakdown command. resume:true admits the
 // payload to the transcript AND wakes the session, so the agent echoes the table
 // as a normal message that the Desktop renders in full (the notice chip only
@@ -140,10 +159,14 @@ function collectDescendantSessionIDs(rootID, state) {
 // Moved to lib/estimate.js (shared with the V2 live log); re-used here so the
 // residual computation has exactly one implementation.
 
-// Short source tag for the table (kept tiny on purpose).
+// Short source tag for the table (kept tiny on purpose). A hook-family source
+// is a real measurement of the request payload, so it reads "live".
 function sourceTag(source) {
   switch (source) {
     case "context-hook":
+    case "compaction-hook":
+    case "transform":
+    case "system-transform":
       return "live";
     case "client-context":
       return "fallback";
@@ -192,9 +215,16 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
   // state.json is stale. ParentID comes from state.json ONLY (entry?.parentID)
   // so the table is root-consistent; in-memory sessionParentCache is cross-session
   // and must NOT be used for attribution.
+  //
+  // A state.json entry that already carries the agent/model counts as warm, and
+  // one live attempt per session is enough: this path is polled (the Desktop
+  // panel calls it every 1.5 s) and a session this instance never observed live
+  // would otherwise issue session.get() on every poll, for the root and every
+  // descendant.
   const needEnrich =
-    !sessionAgentCache.has(sessionID) ||
-    lastKnownModel(sessionID) === "unknown";
+    !enrichAttempted.has(sessionID) &&
+    ((!sessionAgentCache.has(sessionID) && !entry?.agent) ||
+      (lastKnownModel(sessionID) === "unknown" && !entry?.model));
 
   // Fallback categories only when neither the live cache nor a state snapshot
   // has them: derive user/assistant/reasoning/tool-args from the persisted
@@ -204,6 +234,7 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
   // Enrichment and the context fallback run CONCURRENTLY, both bounded by the
   // shared budget. Non-fatal: any failure resolves to null and keeps whatever
   // the cache / state.json already provides.
+  if (needEnrich && budget > 0) markEnrichAttempted(sessionID);
   const [live, contextMsgs] = await Promise.all([
     needEnrich && budget > 0
       ? withTimeout(ctx.session.get({ sessionID }), budget, "session.get").then(
@@ -228,7 +259,25 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
   let categories = null;
   let source = "none";
   let fallbackParts = null;
-  if (bd) {
+  // In-memory breakdown priority. Hook data (the full request payload: system
+  // prompt AND tool schemas) wins outright. The client-context fallback only
+  // fills a session that has no hook-measured categories: it is rebuilt from the
+  // persisted messages, so it cannot see the system prompt or the tool schemas -
+  // reporting them as 0 would push their whole mass into `other` and make a
+  // second instance (the Desktop window's, which answered the RPC without ever
+  // running the hook) show 0 / 0 / inflated-other for a session that state.json
+  // measured correctly.
+  //
+  // A state entry is hook-measured when it carries a hook-family provenance
+  // (`source`, see isHookSource: the V2 context / compaction hooks and the V1
+  // transform hooks), or - for legacy entries without `source` - when
+  // system/tool schemas are non-null (only a hook can estimate those). An entry
+  // written by the fallback stays a fair game for a newer fallback: it is the
+  // best data available for that session.
+  const entryHookMeasured = isHookMeasuredEntry(entry);
+  const bdFromHook = !!bd && isHookSource(bd.source);
+  const useBd = !!bd && (bdFromHook || !entryHookMeasured);
+  if (useBd) {
     // Sanitise: every value reaches a markdown/log sink and must be a number.
     categories = safeCategories(
       breakdownCategories(bd, lastKnownInput(sessionID) || entry?.input || 0),
@@ -273,9 +322,10 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
   const updatedAt =
     entry?.updatedAt ||
     (bd?.capturedAt ? new Date(bd.capturedAt).toISOString() : null);
-  const toolOutByTool = bd
+  const toolOutByTool = useBd
     ? safeToolOutByTool(bd.toolOutByTool)
     : safeToolOutByTool(entry?.toolOutByTool) ||
+      safeToolOutByTool(bd?.toolOutByTool) ||
       safeToolOutByTool(fallbackParts?.toolOutByTool);
   const compactStale = entry?.compactStale === true;
   // Provider-reported prompt cache (exact; subset of input). Live cache first,
@@ -287,13 +337,16 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
     safeSaneOrNull(lastKnownCacheWrite(sessionID)) ??
     safeSaneOrNull(entry?.cacheWrite);
   // Redundant tool output. The live breakdown owns targets; the persisted entry
-  // has them stripped (path-free) — sanitise both.
-  const reclaim = bd
+  // has them stripped (path-free) — sanitise both. The fallback-derived entry
+  // loses to the persisted one, for the same reason as the categories above.
+  const reclaim = useBd
     ? safeReclaim(bd.reclaim, true)
-    : safeReclaim(entry?.reclaim, false);
+    : safeReclaim(entry?.reclaim, false) || safeReclaim(bd?.reclaim, false);
   // Top heaviest single items. The live breakdown has targets; the persisted
   // copy is path-free (sanitised on write), so keepTarget is false there.
-  const top = bd ? safeTop(bd.top, true) : safeTop(entry?.top, false);
+  const top = useBd
+    ? safeTop(bd.top, true)
+    : safeTop(entry?.top, false) || safeTop(bd?.top, false);
   // Previous distinct measurement (state.json only) for /context-diff.
   const previous = safeSnapshot(entry?.previous);
   return {
@@ -319,6 +372,21 @@ async function collectSessionReport(ctx, sessionID, state, deadline) {
   };
 }
 
+// Root report plus the reports of every descendant that has a measurement,
+// collected in parallel under one shared wall-clock budget. Shared by
+// /context-breakdown and the Desktop RPC (lib/desktop.js), so the family walk,
+// the budget and the per-session collection exist once.
+async function collectFamilyReports(ctx, sessionID, budgetMs) {
+  const state = readStateSnapshot();
+  const childIDs = collectDescendantSessionIDs(sessionID, state);
+  const deadline = Date.now() + (budgetMs || COMMAND_COLLECT_BUDGET_MS);
+  const [root, ...children] = await Promise.all([
+    collectSessionReport(ctx, sessionID, state, deadline),
+    ...childIDs.map((cid) => collectSessionReport(ctx, cid, state, deadline)),
+  ]);
+  return { root, children };
+}
+
 // One markdown table row. Categories sit in columns (short headers) to keep the
 // table compact; the ctx column already carries the percentage.
 function renderSessionRow(r, isMain) {
@@ -731,20 +799,14 @@ async function commandContextBreakdown(ctx, invocation, opts) {
     // state.json is read immediately and synchronously; the root and every
     // descendant are then collected IN PARALLEL under one cumulative budget, so
     // the command costs ~budget regardless of the subagent count (not N × 3s).
-    const state = readStateSnapshot();
-    const childIDs = collectDescendantSessionIDs(sid, state);
-    const deadline = Date.now() + COMMAND_COLLECT_BUDGET_MS;
-    const [root, ...children] = await Promise.all([
-      collectSessionReport(ctx, sid, state, deadline),
-      ...childIDs.map((cid) => collectSessionReport(ctx, cid, state, deadline)),
-    ]);
+    const { root, children } = await collectFamilyReports(sid);
     const rows = [renderSessionRow(root, true)];
     for (const rep of children) rows.push(renderSessionRow(rep, false));
-    const table = renderBreakdownTable(rows, childIDs.length, root);
+    const table = renderBreakdownTable(rows, children.length, root);
     const payload = resume
       ? `${BREAKDOWN_MODEL_INSTRUCTION}\n\n<context-breakdown>\n${table}\n</context-breakdown>`
       : table;
-    const description = `Full context breakdown — ${1 + childIDs.length} session(s)`;
+    const description = `Full context breakdown — ${1 + children.length} session(s)`;
 
     const delivered = await deliverSynthetic(ctx, sid, payload, description, resume);
 
@@ -765,6 +827,7 @@ export {
   commandContextBreakdown,
   commandContextDiff,
   CONTEXT_BREAKDOWN_RESUME,
+  collectFamilyReports,
   collectSessionReport,
   renderSessionRow,
   renderBreakdownTable,

package/lib/desktop.js

@@ -0,0 +1,102 @@
+// lib/desktop.js
+//
+// Server side of the Desktop GUI panel: registers the RPC contract from
+// lib/rpc.js and answers it from the SAME collection the /context-breakdown
+// command uses (lib/commands.js collectFamilyReports). The GUI is a window in
+// the desktop app and cannot read state.json or the plugin's memory, so this is
+// its only data path.
+//
+// Nothing here runs on hosts without the GUI API: the registration is guarded
+// and a failure is logged, never thrown, so the TUI and the slash commands are
+// unaffected. For the same reason lib/rpc.js - which imports
+// `@opencode/plugin/rpc`, an OPTIONAL peer - is loaded lazily inside the guard:
+// a host that does not provide that module must still load index.js, not fail
+// at import time.
+
+import { collectFamilyReports } from "./commands.js";
+import { num } from "./format.js";
+import { logErr } from "./state.js";
+
+// A GUI panel polls this while it is open, so the budget is much smaller than
+// the command's: the collection is state.json + in-memory caches only (the live
+// lookups are skipped once the state entry carries the agent/model), and a poll
+// must never hold a hook longer than a fraction of a second.
+const DESKTOP_COLLECT_BUDGET_MS = 2000;
+
+// One wire row (see lib/rpc.d.ts). JSON has no undefined/null in this contract:
+// every optional value is flattened to "" or 0, which the GUI treats as
+// "unknown". `report` is the sanitized object from collectSessionReport.
+function toDesktopRow(report) {
+  const c = report?.categories || {};
+  return {
+    sessionID: typeof report?.sessionID === "string" ? report.sessionID : "",
+    parentID: typeof report?.parentID === "string" ? report.parentID : "",
+    agent: typeof report?.agent === "string" ? report.agent : "",
+    modelID: typeof report?.modelID === "string" ? report.modelID : "",
+    providerID: typeof report?.providerID === "string" ? report.providerID : "",
+    ctx: num(report?.ctxTokens),
+    input: num(report?.inputTokens),
+    usable: num(report?.usable),
+    reserve: num(report?.reserve),
+    user: num(c.user),
+    assistant: num(c.assistant),
+    reasoning: num(c.reasoning),
+    toolArgs: num(c.toolArgs),
+    toolOut: num(c.toolOut),
+    system: num(c.system),
+    toolSchemas: num(c.toolSchemas),
+    other: num(c.other),
+    source: typeof report?.source === "string" ? report.source : "",
+    updatedAt: typeof report?.updatedAt === "string" ? report.updatedAt : "",
+    stale: report?.compactStale === true,
+  };
+}
+
+// A row is worth showing only when the session has been measured at least once:
+// no tokens, no window and no timestamp means "never seen by this plugin" (a
+// foreign or already-pruned session), and a full row of zeros would read as a
+// real, empty context. The GUI turns an empty list into its empty state.
+function hasMeasurement(row) {
+  return row.ctx > 0 || row.usable > 0 || row.updatedAt !== "";
+}
+
+// Registers the contract on a V2 plugin context. Returns the registration (so
+// the caller can keep it alive / dispose it) or null when this host has no RPC
+// support (opencode 2.0.x), does not provide `@opencode/plugin/rpc`, or the
+// registration failed.
+async function registerDesktopRpc(ctx) {
+  try {
+    if (!ctx?.rpc || typeof ctx.rpc.register !== "function") return null;
+    const { DesktopContextRpc } = await import("./rpc.js");
+    return await ctx.rpc.register(DesktopContextRpc, {
+      family: async (input) => {
+        const sessionID =
+          input && typeof input.sessionID === "string" ? input.sessionID : "";
+        if (!sessionID) return { rows: [] };
+        const { root, children } = await collectFamilyReports(
+          ctx,
+          sessionID,
+          DESKTOP_COLLECT_BUDGET_MS,
+        );
+        const rootRow = toDesktopRow(root);
+        if (!hasMeasurement(rootRow)) return { rows: [] };
+        return {
+          rows: [
+            rootRow,
+            ...children.map(toDesktopRow).filter(hasMeasurement),
+          ],
+        };
+      },
+    });
+  } catch (err) {
+    logErr("desktop RPC registration failed", err);
+    return null;
+  }
+}
+
+export {
+  registerDesktopRpc,
+  toDesktopRow,
+  hasMeasurement,
+  DESKTOP_COLLECT_BUDGET_MS,
+};

package/lib/estimate.js

@@ -111,8 +111,6 @@ function safeCategories(raw) {
   };
 }
 
-// A session key safe to use as an object property / map key. Rejects the
-// prototype-pollution vectors ("__proto__", "constructor", "prototype").
 // Sum of the 8 canonical category fields (null `system`/`toolSchemas` count as
 // 0). The single place the "total measured tokens" is derived — shared by the
 // residual-`other` computation, the continuity test and the log/summary writers.
@@ -158,6 +156,35 @@ function breakdownCategories(rec, inputTokens) {
   return { user, assistant, reasoning, toolArgs, toolOut, system, toolSchemas, other };
 }
 
+// True when a persisted state.json entry carries a categories object measured by
+// a request/transform payload that saw the assembled prompt: the V2 context and
+// compaction hooks ("context-hook" / "compaction-hook") and the V1 transform
+// hooks ("transform" / "system-transform"). Those see the system prompt and the
+// tool schemas. `source` is persisted by lib/state.js since 1.7.1; legacy
+// entries have none, and for them only a non-null system / tool-schema estimate
+// proves a hook ran (the message-based fallback cannot produce one). Shared by
+// the state writer, the command report and the live log so the priority rule
+// exists once.
+const HOOK_SOURCES = new Set([
+  "context-hook",
+  "compaction-hook",
+  "transform",
+  "system-transform",
+]);
+
+function isHookSource(source) {
+  return typeof source === "string" && HOOK_SOURCES.has(source);
+}
+
+function isHookMeasuredEntry(entry) {
+  if (!entry || typeof entry !== "object" || !entry.categories) return false;
+  if (isHookSource(entry.source)) return true;
+  return (
+    entry.source == null &&
+    (entry.categories.system != null || entry.categories.toolSchemas != null)
+  );
+}
+
 // A session key safe to use as an object property / map key. Rejects the
 // prototype-pollution vectors ("__proto__", "constructor", "prototype").
 function isSafeSessionKey(k) {
@@ -607,6 +634,8 @@ export {
   safeCategories,
   sumCategories,
   breakdownCategories,
+  isHookSource,
+  isHookMeasuredEntry,
   isSafeSessionKey,
   safeToolOutByTool,
   toolOutEntries,

package/lib/format.js

@@ -0,0 +1,19 @@
+// lib/format.js
+//
+// Number formatting shared by every surface: the TUI sidebar and breakdown
+// panel (re-exported from lib/tui-data.js, so existing imports keep working)
+// and the Desktop GUI panel.
+//
+// Pure JS with no imports at all: the Desktop GUI bundle inlines this file, and
+// a `node:*` import here would break the browser-side bundle.
+
+// Compact token count: 12846 -> "12.8k", 940 -> "940".
+export function fmt(n) {
+  if (!Number.isFinite(n)) return "0"
+  return n >= 1000 ? `${(n / 1000).toFixed(1)}k` : String(Math.round(n))
+}
+
+// Coerce any untrusted value (state.json is user-writable) to a finite number.
+export function num(v) {
+  return typeof v === "number" && Number.isFinite(v) ? v : 0
+}

package/lib/limits.js

@@ -7,11 +7,16 @@
 // hydrateModelLimitsFromState() seeds the maps from the shared state.json
 // snapshot via ./state.js. Extracted 1:1 (code + WHY comments) from index.js.
 //
-// Compaction ceiling (opencode 2.1.4): opencode's core calculateCeiling() in
-// packages/core/src/session/compaction.ts derives the auto-compaction trigger
-// ceiling as window - reserve, where window = limit.input || limit.context
-// (null/zero falls through to the context window) and
-//   reserve = max(floor(window * 0.15), window >= 2 * 16_000 ? 16_000 : 0)
+// Compaction ceiling (opencode calculateCeiling): opencode's core
+// calculateCeiling() in packages/core/src/session/compaction.ts derives the
+// auto-compaction trigger ceiling as window - reserve, where
+// window = limit.input || limit.context (null/zero falls through to the context
+// window) and
+//   reserve = max(floor(window * 0.10), window >= 2 * 16_000 ? 16_000 : 0)
+// The share was 15% up to v2.1.x and is 10% since v2.2.0 (PR #51271 "fit output
+// limits to the context window"); the `2 * RESERVE_MIN` gate is unchanged. A
+// wrong reserve makes every displayed percentage wrong, so this mirrors the
+// host exactly.
 // A compaction.buffer configured in opencode itself is NOT visible to the
 // plugin (the plugin cannot read opencode's internal compaction config); the
 // env var OPENCODE_CONTEXT_INDICATOR_COMPACT_BUFFER overrides the reserve for
@@ -79,10 +84,12 @@ function getModelLimit(providerID, modelID) {
   return typeof rec.context === "number" && rec.context > 0 ? rec.context : null;
 }
 
-// Compute the reserve for a given window, matching opencode 2.1.4
-// packages/core/src/session/compaction.ts calculateCeiling(). Returns null when
+// Compute the reserve for a given window, matching opencode's
+// packages/core/src/session/compaction.ts calculateCeiling() in 2.2.x (the
+// share became 10% in 2.2.0; the 2 * RESERVE_MIN gate is older and unchanged).
+// Returns null when
 // window is not a finite positive number.
-const RESERVE_SHARE = 0.15; // core: RESERVE_SHARE
+const RESERVE_SHARE = 0.1; // core: 10% of the window (15% before v2.2.0)
 const RESERVE_MIN = 16_000; // core: RESERVE_MIN
 function reserveFor(window, bufferOverride) {
   if (
@@ -102,7 +109,7 @@ function reserveFor(window, bufferOverride) {
     return bufferOverride;
   }
   // Default reserve formula (mirror of opencode core):
-  //   max(floor(window * 0.15), window >= 2 * RESERVE_MIN ? RESERVE_MIN : 0)
+  //   max(floor(window * 0.10), window >= 2 * RESERVE_MIN ? RESERVE_MIN : 0)
   // The threshold is 2 * RESERVE_MIN (32_000), not RESERVE_MIN.
   return Math.max(
     Math.floor(window * RESERVE_SHARE),
@@ -110,7 +117,7 @@ function reserveFor(window, bufferOverride) {
   );
 }
 
-// Native opencode compaction ceiling (2.1.4 calculateCeiling):
+// Native opencode compaction ceiling (calculateCeiling, core v2.2.x):
 //   window = limit.input || limit.context  (zero/null falls through to context)
 //   reserve = reserveFor(window)  [or bufferOverride when provided]
 //   usable  = window - reserve

package/lib/rpc.d.ts

@@ -0,0 +1,47 @@
+// lib/rpc.d.ts
+//
+// Type surface of the Desktop RPC contract (lib/rpc.js). The GUI part is
+// TypeScript, the server part is JS, so the row type lives here once and the
+// GUI imports it: `DesktopRow` must stay in sync with ROW_PROPERTIES, which the
+// T30 gate check enforces at runtime.
+
+import type { Rpc } from "@opencode/plugin/rpc"
+
+/** One row of the Desktop context panel: one session, its own window. */
+export interface DesktopRow {
+  readonly sessionID: string
+  /** "" for the root session of the family. */
+  readonly parentID: string
+  readonly agent: string
+  readonly modelID: string
+  readonly providerID: string
+  /** Context tokens in use (prompt + tool schemas + system). */
+  readonly ctx: number
+  readonly input: number
+  /** The engine's usable window; 0 when the model limits are not known yet. */
+  readonly usable: number
+  /** The compaction reserve subtracted from the window; 0 when unknown. */
+  readonly reserve: number
+  readonly user: number
+  readonly assistant: number
+  readonly reasoning: number
+  readonly toolArgs: number
+  readonly toolOut: number
+  readonly system: number
+  readonly toolSchemas: number
+  readonly other: number
+  /** "live" | "snapshot" | "client-context" | "no-data" (or an engine tag). */
+  readonly source: string
+  /** ISO timestamp of the measurement; "" when unknown. */
+  readonly updatedAt: string
+  /** The session was compacted after this measurement. */
+  readonly stale: boolean
+}
+
+/** Output of the `family` method. */
+export interface DesktopFamilyResult {
+  readonly rows: readonly DesktopRow[]
+}
+
+export declare const DesktopContextRpc: Rpc.PortableDefinition
+export declare const DESKTOP_ROW_KEYS: readonly string[]

package/lib/rpc.js

@@ -0,0 +1,88 @@
+// lib/rpc.js
+//
+// The RPC contract between the server part and the Desktop GUI part. The server
+// registers it in V2 setup (lib/desktop.js) and the GUI calls it through
+// `ctx.client.rpc()`; it is also published as the `./rpc` export so other
+// plugins and clients can call it without loading the implementation.
+//
+// JSON Schema only. A Standard Schema validator (zod/valibot) would give
+// inferred TypeScript types but adds a runtime dependency to the published
+// package; every consumer here casts the one response it reads anyway, and the
+// app validates both formats identically.
+//
+// The wire shape is FLAT on purpose: `lib/desktop.js` builds every row from one
+// report, and the T30 gate check compares the schema keys with that builder's
+// output keys, so a field added to one side without the other fails the gate.
+
+import { Rpc } from "@opencode/plugin/rpc"
+
+const ROW_PROPERTIES = {
+  // Session ids and the parent link, as reported by the state snapshot.
+  sessionID: { type: "string" },
+  // "" for the root session (JSON has no undefined; nulls would need a union
+  // type every consumer has to narrow).
+  parentID: { type: "string" },
+  agent: { type: "string" },
+  modelID: { type: "string" },
+  providerID: { type: "string" },
+  // Token counts. `usable` and `reserve` are 0 when the window is unknown.
+  ctx: { type: "number" },
+  input: { type: "number" },
+  usable: { type: "number" },
+  reserve: { type: "number" },
+  // The eight breakdown categories, in tokens.
+  user: { type: "number" },
+  assistant: { type: "number" },
+  reasoning: { type: "number" },
+  toolArgs: { type: "number" },
+  toolOut: { type: "number" },
+  system: { type: "number" },
+  toolSchemas: { type: "number" },
+  other: { type: "number" },
+  // Provenance of the numbers and the measurement time ("" when unknown).
+  source: { type: "string" },
+  updatedAt: { type: "string" },
+  // True when the session was compacted after this measurement.
+  stale: { type: "boolean" },
+}
+
+const ROW_REQUIRED = Object.keys(ROW_PROPERTIES)
+
+export const DesktopContextRpc = Rpc.define({
+  // Same id as the plugin itself: one RPC per plugin keeps the event names and
+  // client subclients unambiguous.
+  id: "context-indicator",
+  methods: {
+    // Root session plus every descendant that has a measurement, in the same
+    // order /context-breakdown uses (root first, then breadth-first children).
+    family: {
+      input: {
+        type: "object",
+        properties: { sessionID: { type: "string" } },
+        required: ["sessionID"],
+        additionalProperties: false,
+      },
+      output: {
+        type: "object",
+        properties: {
+          rows: {
+            type: "array",
+            items: {
+              type: "object",
+              properties: ROW_PROPERTIES,
+              required: ROW_REQUIRED,
+              additionalProperties: false,
+            },
+          },
+        },
+        required: ["rows"],
+        additionalProperties: false,
+      },
+    },
+  },
+  events: {},
+})
+
+// Exported for the T30 gate check (schema/row drift) without a second copy of
+// the key list.
+export const DESKTOP_ROW_KEYS = ROW_REQUIRED