Herdr integration: discover external sessions and provide read-only remote access first #29

Goal

Make conversations running in Herdr discoverable and accessible from t3code on remote devices, starting with Copilot CLI sessions.

First milestone: Herdr session discovery plus read-only access, retaining native session IDs and environment identity. Pursue structured control only after choosing the authoritative owner. Do not start with automatic resume/import.

Remote connectivity to a t3code environment is not the same as attaching to a session owned by an external CLI.

Initial scope

• Discover Herdr agent sessions within an explicitly configured environment.
• Correlate by (environment identity, provider, native session ID), retaining Herdr pane/workspace references as navigation metadata.
• Show origin, current owner, last observation time, and availability. Distinguish stale/unknown state from confirmed idle or stopped state.
• Provide read-only access through an available terminal view or bounded transcript snapshot, clearly identifying which is being shown. Mark incomplete history explicitly.
• Keep viewing side-effect free: no session resume, ownership acquisition, prompt submission, tool approval, or implicit import.
• Preserve environment boundaries, including Windows versus WSL. Use existing authenticated environment access; do not expose an unauthenticated Herdr control socket.

A "Herdr" origin tag is useful for discovery, but is not an ownership or synchronization protocol.

Findings and implementation constraints

Repository findings below are pinned to build/fork-native-preview at 1ba8423c8611d65dc9739a970fe84c78c9892710; they do not establish which build any desktop currently runs.

• The fork's Copilot adapter rejects alreadyInUse: true when resuming. Preserve this conflict refusal.
• External-session import supports Claude/Codex only, not Copilot. Import guards concern t3code's state; they do not prove an external CLI has released its session.
• Herdr's Copilot integration reports native session identity. Copilot working/idle/blocked detection is screen-based, not authoritative structured lifecycle information.
• Copilot SDK exposes experimental persisted-history reading, session attachment, and native fork RPCs. Attachment still requires a connection to the appropriate runtime; a native session ID does not discover that endpoint. Cross-process behavior needs a targeted spike rather than assumptions about safe shared ownership.
• Current upstream uses a different Copilot/ACP and orchestration architecture. Evaluate integration against the actual target baseline instead of directly transplanting its adapter.

Later milestone: choose one authoritative owner

Evaluate either a Herdr-side controller that t3code accesses as a client, or a t3code-owned controller with Herdr as another frontend. Structured control must include prompts, interrupts, approvals, authoritative activity/background-work events, reconnect behavior, and history reconciliation.

If ownership transfer is necessary, design explicit admission freeze, confirmed release, controller fencing, and destination admission. Fail closed after uncertain disconnects. Do not let two independent controllers resume/write the same native session, share session storage as a synchronization mechanism, or infer safe handoff from screen "idle".

Acceptance criteria for the first milestone

• An externally owned Herdr Copilot session can be found from a paired remote t3code client.
• Environment and native identity survive refresh/reconnect without creating duplicate conversations.
• Viewing a session does not acquire its ownership or change the source conversation.
• Active source work and approval dialogs remain untouched.
• Offline/stale environments, missing IDs, unsupported transcript access, and partial history are explicit.
• Windows and WSL sessions with similar paths or metadata are never conflated.

Related work

• [A-009] Inventory native provider capabilities versus T3 exposure #16: native provider capability inventory.
• Upstream #25476: recoverable terminal/t3code session handoff, with a Herdr consumer. Closed unmerged; Codex/stopped Claude only, not delivered Copilot support.
• Upstream #6590: native context versus UI history interoperability.
• Upstream #14229: externally driven activity invisible to the inactivity reaper; relevant to later structured control.
• Copilot CLI #4580: separate-terminal fork interface. Related workflow, not a solution to shared-session ownership.