hooks/hooks.json was generated from a template by scripts/gen-hooks.mjs. Once every
hook became a command hook that reads hook.secret from $GLANCE_HOME itself, the
template had exactly two placeholders left: {{HOOK_TOKEN}}, which nothing had ever
substituted into anything, and {{APPROVAL_TIMEOUT_SECS}}. Generating a whole file to
compute one number is not a good trade, so the number is now fixed at 125s in the
committed hooks.json and the coupling is enforced in code instead: the daemon clamps
approval.timeoutMs to APPROVAL_MAX_WAIT_MS (90s), which keeps the script inside its
own hook timeout no matter what a hand-edited config.json says. Losing that clamp is
what would actually hurt — a killed script never runs its fail-open path.
Also removed:
- `glance sync-hooks`, `npm run build:hooks`, and hookSecret({create}). The daemon is
the only thing that should ever mint the secret.
- The ?k= query-string carrier for the hook secret. It existed for hooks that cannot
set headers; there are none, and a secret in a URL lands in logs and shell history.
- Snapshot.now and SessionView.startedAt, which were written on every snapshot and
every persist and read by nobody.
- An unused crypto import.
Docs and the e2e suite follow. The suite's ~12 sync-hooks assertions become static
checks on the committed file, plus new ones that hooks.json, APPROVAL_HOOK_TIMEOUT_SECS
and APPROVAL_MAX_WAIT_MS still agree, and that ?k= is refused. 220 checks, all passing.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
One daemon already saw every session; the dashboard only ever showed one of
them well. Under four parallel agents it failed in specific ways, each fixed
here:
- Sessions were identified by workspace basename, so two agents in one repo
were indistinguishable. The daemon now hands out a small ordinal badge in
arrival order and the web UI colours each agent by it — rows, timeline
lines, and approval cards, which previously asked you to approve `rm -rf`
"in remote-grok" without saying which one.
- `currentTool` held a single call, so parallel tools overwrote each other.
It is now a list; durations are matched FIFO per tool name, since hook
payloads carry no call id.
- One 400-event ring, evicted oldest-first, let a chatty agent blank
everyone else's history. Eviction now takes from whichever session holds
the most of the ring.
- Sessions sorted by recency jumped under a moving thumb. They are ordered
waiting -> error -> working -> idle -> ended, ties on badge, so an agent
keeps its slot.
- Events carry no workspace root, so a restart came back with a full
timeline and an empty roster. The session map is persisted to
sessions.json (debounced, flushed on shutdown, 12h cutoff on load).
In-flight tools are dropped on the way out: they belonged to a process
that no longer exists.
- Snapshot pushes now back off to 1s once a snapshot exceeds 24KB, since
full-snapshot SSE cost scales with agent count.
- Pending approvals are ordered by which expires first, not by arrival.
`glance status` and /local/status report the roster by state. e2e suite:
220 passed, 0 failed.
