Supervise several agents at once

One daemon already saw every session; the dashboard only ever showed one of
them well. Under four parallel agents it failed in specific ways, each fixed
here:

- Sessions were identified by workspace basename, so two agents in one repo
  were indistinguishable. The daemon now hands out a small ordinal badge in
  arrival order and the web UI colours each agent by it — rows, timeline
  lines, and approval cards, which previously asked you to approve `rm -rf`
  "in remote-grok" without saying which one.
- `currentTool` held a single call, so parallel tools overwrote each other.
  It is now a list; durations are matched FIFO per tool name, since hook
  payloads carry no call id.
- One 400-event ring, evicted oldest-first, let a chatty agent blank
  everyone else's history. Eviction now takes from whichever session holds
  the most of the ring.
- Sessions sorted by recency jumped under a moving thumb. They are ordered
  waiting -> error -> working -> idle -> ended, ties on badge, so an agent
  keeps its slot.
- Events carry no workspace root, so a restart came back with a full
  timeline and an empty roster. The session map is persisted to
  sessions.json (debounced, flushed on shutdown, 12h cutoff on load).
  In-flight tools are dropped on the way out: they belonged to a process
  that no longer exists.
- Snapshot pushes now back off to 1s once a snapshot exceeds 24KB, since
  full-snapshot SSE cost scales with agent count.
- Pending approvals are ordered by which expires first, not by arrival.

`glance status` and /local/status report the roster by state. e2e suite:
220 passed, 0 failed.

skills/glance/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: glance
-description: Set up, inspect, or control grok-glance — the passkey-guarded phone dashboard for this Grok Build session. Use when the user asks to watch a session from their phone, enrol a device, expose the dashboard over Tailscale, or turn remote approve/deny on or off.
+description: Set up, inspect, or control grok-glance — the passkey-guarded phone dashboard for this Grok Build session. Use when the user asks to watch one or several sessions from their phone, enrol a device, expose the dashboard over Tailscale, or turn remote approve/deny on or off.
 ---
 
 # grok-glance
@@ -8,6 +8,9 @@ description: Set up, inspect, or control grok-glance — the passkey-guarded pho
 A local daemon plus web dashboard that shows what Grok Build is doing, readable from a phone
 behind a WebAuthn passkey. It can also pause risky tool calls until someone taps approve.
 
+One daemon covers every session on the machine, so several agents running at once all appear on the
+same dashboard — no per-session setup.
+
 The daemon is started automatically by the `SessionStart` hook. Everything below is done through
 the `glance` CLI at `$GROK_PLUGIN_ROOT/bin/glance`.
 
@@ -37,6 +40,26 @@ glance approval <off|risky|all>    # remote approve/deny policy
 glance sync-hooks                  # regenerate hooks/hooks.json from hooks/hooks.template.json
 ```
 
+## Watching several agents
+
+Nothing to configure — every session that runs the hooks shows up. `glance status` reports the
+roster and what each agent is doing:
+
+```
+  sessions      : 4 (1 waiting on you, 1 error, 2 working)
+```
+
+Points worth passing on to the user:
+
+- Agents are identified by a coloured badge (`●1`, `●2`) as well as the workspace name, because two
+  agents in the same repo carry the same label. The badge is stable across daemon restarts.
+- The list is ordered by who needs attention (waiting → error → working → idle → ended) and never
+  re-sorts underneath a tap.
+- Approval cards say which agent is asking; with `approval risky` on and several agents, expect
+  several cards.
+- One noisy agent will not push the others out of the timeline — the event ring is trimmed from
+  whichever session is using the most of it.
+
 ## Getting it onto a phone
 
 The dashboard listens on `127.0.0.1` only. Passkeys need a real hostname with valid TLS — a bare
@@ -79,6 +102,9 @@ and wait for a tap on the phone. Defaults that matter:
   `hooks/hooks.json` exists and is registered — it is generated, so `glance sync-hooks` rebuilds it
   from the template.
 - **Page says "run npm install && npm run build"** → the web bundle is missing; build it.
+- **Only one agent shows up** → the others were started before the plugin was installed, or in an
+  environment where the hooks are not registered. A session appears on its next hook event; nothing
+  can be back-filled for one that already ran.
 
 ## What it deliberately does not do