- Shipped
- September 4, 2026 at 8:41 PM UTC
- Author
- Kamo
- Commit
- d91f3d5
is here, because the machine is the only thing that knows any of it. ## The session index home, exactly as their terminals are whatever tmux is running. No table, for the same reason: the disk already knows, it is what the CLI itself resumes from, and Memoized on (mtime, size), and it has to be — the machine this was built against holds 444 sessions and 1.1 GB of transcript, one of them 205 MB. Only the first and last 128 KB of each file are read: the working directory, the branch and the opening prompt are in the first records, the generated title and the summary are appended as the session goes on, and the middle is tool calls. Measured against the real store: 2.8s cold, 17ms warm. ## Two things a transcript cannot say A transcript does not record that the console started it, so a session started without it the row a member just created is missing from the list they are looking at, which reads as the button having done nothing. And a transcript does not record where it is being driven from, so a shell that is running one now carries the session id as a tmux user option (@kamo_coder), beside the title that already lives there. That is the whole duplicate rule: resuming a session that is already attached gives one conversation two heads, with both CLIs writing to one transcript and the second replaying what the first is in the middle of. The listing therefore grows a field, so `list-sessions -F` now asks for seven — the title stays LAST and the split stays bounded, because the separator is printable and a member can type it. ## The caller still never supplies a command The command line is composed here: the CLI's path resolved under the account's own home, the session id minted or found on this disk, and `--permission-mode bypassPermissions`, which is not a parameter and cannot be one. Prepared records now carry a `kind`, and one that predates the field is a Send-to-AI hand-off, which is the only kind there was. The working directory is the one thing a request can influence and is bounded by realpath to the account's own home. That is not a privilege boundary — the terminal already runs as that account — it keeps the set of directories a REQUEST can name smaller than the set a person can reach. A record that names an account is also only redeemable by that account's terminal. 40 new tests, 199 in the suite, all passing. The index is verified against the real 444-session store rather than fixtures alone. Ships by install-agent.sh, not by CI: pushing this deploys nothing to the VM.