@agfpd/iapeer 0.4.38 → 0.4.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.4.38",
+  "version": "0.4.40",
   "description": "Run Claude Code and Codex CLI as local background agents that message each other, wake on demand, and share one memory.",
   "license": "Apache-2.0",
   "author": "agfpd",

package/src/supervisor/client.ts

@@ -2,9 +2,9 @@
 // Block 2, ported from PoC pts.mjs). Detach key Ctrl-] (session keeps running). The two reattach
 // port-deps live here + in protocol.ts: #1 TERM_RESET on EVERY exit path (incl. SIGHUP window-close,
 // via writeSync which works inside a signal handler), and #2 backpressure is the daemon's side.
-import { existsSync, readFileSync, writeSync } from 'node:fs'
+import { writeSync } from 'node:fs'
 import { FRAME_DATA, FRAME_RESIZE, TERM_RESET, frame, makeFramer, sizePayload } from './protocol.ts'
-import { pidPath, sockPath } from './paths.ts'
+import { pidStartToken, readPidFile, sockPath } from './paths.ts'
 
 const DETACH = 0x1d // Ctrl-]
 
@@ -16,9 +16,26 @@ const pidAlive = (p: number): boolean => {
     return false
   }
 }
+
+// В22 — OWNER-validated liveness. kill(pid,0) is the fast fail (dead pid → not alive). When the pid is
+// alive AND the pidfile carries a start-token, verify the token matches the pid's CURRENT start time so a
+// REUSED pid (a different process that inherited the number) never reads as our live session. `ps` is
+// bounded by a short per-session cache — repeated liveness reads within a tick do not re-spawn it.
+const OWNER_TTL_MS = 3000
+const ownerCache = new Map<string, { pid: number; token: string; verdict: boolean; until: number }>()
+
 export function sessionAlive(runDir: string, session: string): boolean {
-  const pf = pidPath(runDir, session)
-  return existsSync(pf) && pidAlive(Number(readFileSync(pf, 'utf8')))
+  const rec = readPidFile(runDir, session)
+  if (!rec || !pidAlive(rec.pid)) return false
+  if (!rec.token) return true // legacy tokenless pidfile → kill-0 only (no regression during rollout)
+  const key = `${runDir}\0${session}`
+  const now = Date.now()
+  const cached = ownerCache.get(key)
+  if (cached && cached.pid === rec.pid && cached.token === rec.token && now < cached.until) return cached.verdict
+  const live = pidStartToken(rec.pid)
+  const verdict = live !== null && live === rec.token // same process instance, not a reused pid
+  ownerCache.set(key, { pid: rec.pid, token: rec.token, verdict, until: now + OWNER_TTL_MS })
+  return verdict
 }
 
 /** Attach an interactive terminal client to a live daemon session. Resolves when the client

package/src/supervisor/daemon.ts

@@ -22,9 +22,10 @@ import {
   frame,
   makeFramer,
   parseSize,
+  splitDanglingEscape,
   stripQueries,
 } from './protocol.ts'
-import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry } from './paths.ts'
+import { attachedPath, geometryPath, pidPath, servePath, sockPath, writeGeometry, writePidFile } from './paths.ts'
 import { nextBootAction, nextNagAction, type BootPredicates, type NagPredicate } from './boot.ts'
 import { modelToPlainText } from './render.ts'
 import { codexAdapter } from '../launch/adapters/codex.ts'
@@ -86,6 +87,10 @@ const BOOT_DRIVE_MS = 120_000
 // survives the hold (our key did not take), the next tick re-fires, so retries stay bounded, not lost.
 const NAG_POLL_MS = 2000
 const NAG_COOLDOWN_MS = 4000
+// В25 — cap the attach-snapshot stabilization wait: under saturating output the model never goes quiet,
+// so without a budget firstAttach would never complete (frozen attach). On timeout we snapshot the
+// current model; live-forward delivers the rest once the gate lifts.
+const MODEL_STABLE_BUDGET_MS = 500
 
 // Bun-native PTY (Bun ≥1.3.5) is not yet in @types/bun — type the slice we use.
 interface PtyChild {
@@ -187,7 +192,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // (same inode) so a normal cap never triggers a spurious reopen. Tied to output (no idle wakeups) —
   // exactly when the log matters.
   const healPaneLog = (): void => {
-    if (!opts.paneLogPath || paneLogFd < 0) return
+    if (!opts.paneLogPath) return
     const now = Date.now()
     if (now - paneLogCheckedMs < PANELOG_HEAL_MS) return
     paneLogCheckedMs = now
@@ -197,7 +202,12 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
     } catch {
       ino = -1 // path gone
     }
-    if (ino !== paneLogIno) openPaneLog()
+    // В19 — reopen when the fd is DEAD (initial open failed / a prior reopen failed) as well as when the
+    // path maps to a DIFFERENT inode (unlinked/replaced). The old `paneLogFd < 0` early-return above made
+    // a single failed open PERMANENT — the log stayed blind for the whole session (composer-busy detect,
+    // telegram typing, boot ready-gate all read this file). fd<0 with ino=-1 (path also gone) still needs
+    // a reopen attempt: openPaneLog recreates the file.
+    if (paneLogFd < 0 || ino !== paneLogIno) openPaneLog()
   }
   openPaneLog()
 
@@ -210,7 +220,11 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // NO E3 capability) → smeared/overlapping scroll-up history. After the catch-up the supervisor does
   // NOTHING on resize — the child redraws its viewport (SIGWINCH) and the terminal reflows its own
   // scrollback, like a directly-launched claude.
-  const painted = new WeakSet<object>()
+  // В23 — a SET (not a WeakSet) so `.size` gates the .attached marker on INTERACTIVE clients only. A
+  // client is painted iff it sent a FRAME_RESIZE (runClient always does on connect; a deliver-client
+  // NEVER resizes). Using clients.size counted deliver-clients too → a delivery briefly marked "human
+  // attached", falsely holding a concurrent delivery in the composer queue. Kept in sync with removals.
+  const painted = new Set<object>()
   // INITIALIZING GATE (scrollback fix): a client is held OUT of live output-forwarding from connect until
   // its one-time attach snapshot has been sent. Without this, live frames (claude's relative-cursor
   // redraws) race ahead of the snapshot and corrupt the fresh terminal. The model still ingests those
@@ -223,6 +237,10 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // write's parse-callback; `writeSeq` bumps on every write so the drain can detect new arrivals mid-await.
   let writeChain: Promise<void> = Promise.resolve()
   let writeSeq = 0
+  // В24 — a trailing INCOMPLETE escape sequence carried from one child-output chunk to the next, so a
+  // capability query split across a pty read boundary is detected/stripped as a whole (client-facing only;
+  // the model + pane-log always get the raw bytes immediately).
+  let queryTail = ''
   // ATTACHED-CLIENT MARKER (spawn-flip Ф0b-3 slice 3c): keep `<runDir>/<session>.attached` in sync with
   // clients.size — present iff ≥1 operator is attached. The warm-deliver path (a DIFFERENT process)
   // reads it to gate the hosted busy-composer hold: hold ONLY when a human is attached (their unfinished
@@ -231,7 +249,9 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   const attachedMarker = attachedPath(runDir, session)
   const syncAttached = (): void => {
     try {
-      if (clients.size > 0) writeFileSync(attachedMarker, '')
+      // В23 — gate on PAINTED (interactive) clients, not raw client count: a deliver-client connection
+      // must never read as "a human is attached".
+      if (painted.size > 0) writeFileSync(attachedMarker, '')
       else if (existsSync(attachedMarker)) unlinkSync(attachedMarker)
     } catch {
       /* */
@@ -253,7 +273,11 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   /** Backpressure-safe send to one client; drop it (and report false) if its socket is dead. */
   const sendClient = (s: { write(b: Buffer): number }, buf: Buffer): boolean => {
     const ok = writerFor(s).send(buf)
-    if (!ok) clients.delete(s)
+    if (!ok) {
+      clients.delete(s)
+      painted.delete(s as object) // В23 — keep the painted set (marker gate) in sync on every drop
+      syncAttached()
+    }
     return ok
   }
 
@@ -269,19 +293,26 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
         const buf = Buffer.isBuffer(d) ? d : typeof d === 'string' ? Buffer.from(d, 'utf8') : Buffer.from(d)
         // PANE-LOG: the RAW child bytes, exactly as pipe-pane writes them (before any query-stripping
         // for clients) — written as a Buffer, never a string. The `s` below is for query DETECTION only.
-        if (paneLogFd >= 0) {
-          healPaneLog() // reopen if the path was unlinked/replaced out from under us (Defect 2)
-          try {
-            writeSync(paneLogFd, buf)
-          } catch {
-            /* best-effort */
+        if (opts.paneLogPath) {
+          healPaneLog() // reopen if never-opened / unlinked / replaced out from under us (Defect 2 + В19)
+          if (paneLogFd >= 0) {
+            try {
+              writeSync(paneLogFd, buf)
+            } catch {
+              /* best-effort */
+            }
           }
         }
-        const s = buf.toString('latin1')
         writeSeq++ // a new write arrived (lets the attach drain detect bytes that land mid-await)
-        writeChain = new Promise<void>(resolve => xterm.write(buf, () => resolve())) // authoritative model (+ parse barrier)
-        for (const r of capabilityResponses(s)) child.terminal.write(r) // answer capability queries
-        const fwd = Buffer.from(stripQueries(s), 'latin1') // forward to clients sans queries (daemon is authoritative)
+        writeChain = new Promise<void>(resolve => xterm.write(buf, () => resolve())) // authoritative model (+ parse barrier) — RAW bytes
+        // В24 — run capability detect/strip over the chunk PLUS any carried tail, holding back a trailing
+        // INCOMPLETE escape for the next chunk so a query split across a pty read boundary is matched as a
+        // whole. The model + pane-log above get the RAW bytes immediately; only the client-facing detect/
+        // strip is tail-buffered (the held bytes reach the client next chunk, once complete).
+        const [complete, dangling] = splitDanglingEscape(queryTail + buf.toString('latin1'))
+        queryTail = dangling
+        for (const r of capabilityResponses(complete)) child.terminal.write(r) // answer capability queries
+        const fwd = Buffer.from(stripQueries(complete), 'latin1') // forward to clients sans queries (daemon is authoritative)
         if (fwd.length) {
           // Forward live output to every ATTACHED client — but NOT to one still INITIALIZING (its
           // snapshot hasn't been sent; these bytes are already in the model and will be in that snapshot,
@@ -337,6 +368,12 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
   // bytes still land in the model and bump writeSeq — loop until the sequence holds steady so the snapshot
   // reflects every byte received so far (no stale screen, no dropped tail).
   const awaitModelParsedStable = async (): Promise<void> => {
+    // В25 — BOUND the stabilization. Under a saturating output stream (a big file dump, a verbose build,
+    // a tailing log) every await window sees a new write → seq never holds steady → firstAttach never
+    // completes, so the attaching operator sees a FROZEN blank screen while their keystrokes go to the
+    // child blind. Cap the wait: on timeout, snapshot the CURRENT model — bytes that land after are
+    // delivered by normal live-forward once the gate lifts (the model already ingests them).
+    const deadline = Date.now() + MODEL_STABLE_BUDGET_MS
     for (;;) {
       const seq = writeSeq
       try {
@@ -345,6 +382,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
         /* a write parse-callback should not reject */
       }
       if (seq === writeSeq) return
+      if (Date.now() > deadline) return // saturating output — snapshot now, live-forward catches the rest
     }
   }
   // Build + send the one-time attach SNAPSHOT (full resolved model: scrollback + screen + cursor + SGR colour
@@ -428,6 +466,7 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       const sz = parseSize(payload)
       if (!painted.has(s as object)) {
         painted.add(s as object)
+        syncAttached() // В23 — this client is now INTERACTIVE (it resized) → the .attached marker reflects it
         void firstAttach(s, sz.cols, sz.rows) // split-resize: model → snapshot → gate-lift → child (clean frame0)
       } else {
         applyGeometry(sz.cols, sz.rows) // LATER resize: one real resize, no re-snapshot
@@ -458,23 +497,25 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
         framers.get(s)?.(d)
       },
       drain(s: object) {
-        if (!writers.get(s)?.flush()) { clients.delete(s); syncAttached() } // writable again → flush queued tail
+        if (!writers.get(s)?.flush()) { clients.delete(s); painted.delete(s); syncAttached() } // writable again → flush queued tail
       },
       close(s: object) {
         clients.delete(s)
+        painted.delete(s)
         writers.delete(s)
         syncAttached()
         restoreServeGeometryIfIdle() // last client gone → un-stick the pty from its size
       },
       error(s: object) {
         clients.delete(s)
+        painted.delete(s)
         writers.delete(s)
         syncAttached()
         restoreServeGeometryIfIdle()
       },
     },
   })
-  writeFileSync(pid, String(process.pid))
+  writePidFile(runDir, session, process.pid) // В22 — `<pid> <startToken>` so a reused pid can't impersonate this session
   writeGeometry(runDir, session, serveCols, serveRows) // initial geometry sidecar (= serve); updated on every real child resize
 
   let down = false
@@ -542,8 +583,16 @@ export function runSupervisorDaemon(opts: SupervisorDaemonOptions): void {
       } catch {
         return // transient model read — retry next tick
       }
+      // В21 — check the deadline FIRST, independent of the action. Previously the clearInterval only
+      // fired in the `else` branch, so a boot-dialog predicate that kept returning 'dialog' (a resume-
+      // picker whose layout changed after a claude update, a screen matching the dialog pattern) drove
+      // keystrokes into the pty EVERY tick for the whole session — the BOOT_DRIVE_MS backstop was dead.
+      if (Date.now() > driveDeadline) {
+        clearInterval(driver)
+        return
+      }
       if (action.kind === 'dialog') child.terminal.write(action.bytes)
-      else if (action.kind === 'ready' || Date.now() > driveDeadline) clearInterval(driver)
+      else if (action.kind === 'ready') clearInterval(driver)
     }, BOOT_POLL_MS)
     ;(driver as { unref?: () => void }).unref?.()
   }

package/src/supervisor/index.ts

@@ -8,7 +8,7 @@ import { spawn as nodeSpawn } from 'node:child_process'
 import { closeSync, existsSync, mkdirSync, openSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs'
 import { fileURLToPath } from 'node:url'
 import { runSupervisorClient, sessionAlive } from './client.ts'
-import { defaultRunDir, logPath, pidPath, servePath, sockPath } from './paths.ts'
+import { defaultRunDir, logPath, pidPath, pidStartToken, readPidFile, servePath, sockPath } from './paths.ts'
 
 // daemon.ts loads @xterm. It is dynamic-imported ONLY in the 'daemon' CLI case below (the detached
 // daemon process, where @xterm belongs), so importing THIS module — e.g. launch resolving
@@ -125,17 +125,35 @@ export async function startSupervisorDaemon(opts: StartDaemonOptions): Promise<S
   const deadline = Date.now() + (opts.timeoutMs ?? 5000)
   while (Date.now() < deadline) {
     if (existsSync(sockPath(runDir, session)) && sessionAlive(runDir, session)) {
-      return { state: 'started', pid: Number(readFileSync(pidPath(runDir, session), 'utf8')) }
+      return { state: 'started', pid: readPidFile(runDir, session)?.pid }
     }
     await Bun.sleep(80) // yield the loop — never a sync block in the daemon's wake path
   }
-  // Failed to come up — drop the serve-spec we wrote so it can't mislead a later read.
+  // Failed to come up in time. В20 — KILL the spawned child FIRST. A merely-slow child that becomes the
+  // daemon AFTER we unlink the serve-spec would readServeSpec → undefined → come up as a BARE CONDUIT
+  // ([bin] runtime with NO PEER_IDENTITY / composed argv / doctrine) that captures the peer's identity:
+  // liveness then reads it "online", messages route into an identity-less session, and if it slipped
+  // past enroll-on-FAILED it is invisible to idle-reap (an unbounded orphan). Better a dead peer (the
+  // next wake respawns clean) than an identity-less conduit. Kill, THEN drop the spec + any stale
+  // sock/pid the dying child created (SIGKILL skips the child's own cleanup).
+  try {
+    child.kill('SIGKILL')
+  } catch {
+    /* already gone */
+  }
   if (opts.serve)
     try {
       unlinkSync(servePath(runDir, session))
     } catch {
       /* */
     }
+  for (const p of [sockPath(runDir, session), pidPath(runDir, session)]) {
+    try {
+      if (existsSync(p)) unlinkSync(p)
+    } catch {
+      /* best-effort */
+    }
+  }
   return { state: 'failed', detail: `daemon did not come up; see ${logPath(runDir, session)}` }
 }
 
@@ -146,16 +164,22 @@ export function listSessions(runDir: string): Array<{ session: string; alive: bo
     .map(f => f.replace(/\.sock$/, ''))
     .map(session => {
       const alive = sessionAlive(runDir, session)
-      return { session, alive, pid: alive ? Number(readFileSync(pidPath(runDir, session), 'utf8')) : undefined }
+      return { session, alive, pid: alive ? readPidFile(runDir, session)?.pid : undefined }
     })
 }
 
 export function killSession(runDir: string, session: string): boolean {
-  const pf = pidPath(runDir, session)
-  if (!existsSync(pf)) return false
-  const pid = Number(readFileSync(pf, 'utf8'))
+  const rec = readPidFile(runDir, session)
+  if (!rec) return false
+  // В22 — verify the pid is STILL our daemon before SIGTERM. After an abnormal death + pid reuse, a bare
+  // kill here would SIGTERM the INNOCENT process that inherited the pid. Skip the kill when the start-token
+  // no longer matches (a legacy tokenless pidfile keeps the old behavior — no regression during rollout).
+  if (rec.token) {
+    const live = pidStartToken(rec.pid)
+    if (live !== null && live !== rec.token) return false // reused pid — NOT our session; do not signal it
+  }
   try {
-    process.kill(pid, 'SIGTERM')
+    process.kill(rec.pid, 'SIGTERM')
   } catch {
     /* already gone */
   }

package/src/supervisor/paths.ts

@@ -3,6 +3,7 @@
 // socket/pid files never touch a real location.
 import { renameSync, writeFileSync } from 'node:fs'
 import { readFileSync } from 'node:fs'
+import { spawnSync } from 'node:child_process'
 import { join } from 'node:path'
 import { pluginStateDir } from '../storage/index.ts'
 
@@ -13,6 +14,49 @@ export function defaultRunDir(env: NodeJS.ProcessEnv = process.env): string {
 
 export const sockPath = (runDir: string, session: string): string => join(runDir, `${session}.sock`)
 export const pidPath = (runDir: string, session: string): string => join(runDir, `${session}.pid`)
+
+// ── pid-OWNERSHIP token (В22) ───────────────────────────────────────────────────
+// kill(pid,0) proves SOME process holds the pid, not that it is STILL our daemon: after an abnormal
+// death (SIGKILL/panic/reboot) the pidfile survives, and if the OS reuses that pid for another same-uid
+// process, a bare kill(pid,0) reads the dead session as "alive" (peer undeliverable + unreapable) and a
+// kill() would SIGTERM the innocent reuser. The pidfile therefore stores `<pid> <startToken>` where the
+// token is the process's start time; a reused pid has a DIFFERENT start time, so ownership is verifiable.
+
+/** The OS-reported start time of `pid` (a stable per-process-instance token), or null if it is not
+ *  running / unreadable. `ps -o lstart=` is a single spawn — callers bound its frequency (see the
+ *  liveness cache in client.ts). */
+export function pidStartToken(pid: number): string | null {
+  if (!Number.isInteger(pid) || pid <= 0) return null
+  try {
+    const r = spawnSync('ps', ['-o', 'lstart=', '-p', String(pid)], { encoding: 'utf8' })
+    const t = (r.stdout ?? '').trim()
+    return t.length > 0 ? t : null
+  } catch {
+    return null
+  }
+}
+
+/** Write the pidfile as `<pid> <startToken>` (В22). Falls back to bare `<pid>` if the token is
+ *  unavailable — a tokenless pidfile is treated as legacy (owner-check skipped, kill-0 only). */
+export function writePidFile(runDir: string, session: string, pid: number): void {
+  const token = pidStartToken(pid)
+  writeFileSync(pidPath(runDir, session), token ? `${pid} ${token}` : String(pid))
+}
+
+/** Parse the pidfile → { pid, token } (token '' for a legacy bare-pid file). null when absent/invalid. */
+export function readPidFile(runDir: string, session: string): { pid: number; token: string } | null {
+  let raw: string
+  try {
+    raw = readFileSync(pidPath(runDir, session), 'utf8').trim()
+  } catch {
+    return null
+  }
+  if (!raw) return null
+  const sp = raw.indexOf(' ')
+  const pid = Number(sp < 0 ? raw : raw.slice(0, sp))
+  if (!Number.isInteger(pid) || pid <= 0) return null
+  return { pid, token: sp < 0 ? '' : raw.slice(sp + 1).trim() }
+}
 export const logPath = (runDir: string, session: string): string => join(runDir, `${session}.log`)
 /** Serving spec (cutover Block 2 slice b): the composed {argv, env, cwd} a detached daemon serves.
  *  Written 0600 by startSupervisorDaemon BEFORE spawn (env can carry launch.env secrets), read by

package/src/supervisor/protocol.ts

@@ -70,6 +70,51 @@ export function stripQueries(s: string): string {
   return s.replace(QUERY_RE, '')
 }
 
+// ── chunk-boundary query buffering (В24) ────────────────────────────────────────
+// A capability query split across a pty read boundary (`\x1b[>` in one chunk, `q` in the next)
+// matches NEITHER chunk → the daemon neither answers nor strips it, and the fragment LEAKS to an
+// attached client whose real terminal answers it as keystrokes into the child. Before running the
+// capability detect/strip on a chunk, carry a trailing INCOMPLETE escape into the next one.
+
+const MAX_DANGLING = 16 // a real short query fits well within this — a longer trailing ESC is passed through
+
+function isCompleteEscape(seq: string): boolean {
+  if (seq.length < 2) return false // a bare ESC — could begin any sequence
+  switch (seq[1]) {
+    case '[': {
+      // CSI — parameter/intermediate bytes then a FINAL byte 0x40–0x7e
+      for (let i = 2; i < seq.length; i++) {
+        const c = seq.charCodeAt(i)
+        if (c >= 0x40 && c <= 0x7e) return true
+      }
+      return false
+    }
+    case ']':
+    case 'P':
+    case 'X':
+    case '^':
+    case '_':
+      // OSC / DCS / SOS / PM / APC — terminated by BEL or ST (\x1b\)
+      return seq.includes('\x07') || seq.includes('\x1b\\')
+    case 'O':
+      return seq.length >= 3 // SS3 (ESC O <byte>)
+    default:
+      return true // any other 2-byte escape (ESC + one final char) is complete once the 2nd byte arrives
+  }
+}
+
+/** Split `s` into [complete, dangling]: `dangling` is a trailing incomplete escape sequence to prepend
+ *  to the NEXT chunk before capability detect/strip. Bounded — a lone trailing ESC with no follow-up
+ *  never stalls the forward forever (it is passed through once it exceeds MAX_DANGLING). Pure/testable. */
+export function splitDanglingEscape(s: string): [string, string] {
+  const esc = s.lastIndexOf('\x1b')
+  if (esc < 0) return [s, '']
+  const tail = s.slice(esc)
+  if (tail.length > MAX_DANGLING) return [s, '']
+  if (isCompleteEscape(tail)) return [s, '']
+  return [s.slice(0, esc), tail]
+}
+
 // ── key-name → pty bytes (boot-driver, serving slice a) ─────────────────────────
 // Translate a tmux send-keys-style key list into the raw bytes a pty expects, so the supervisor
 // boot-driver can answer startup dialogs (codex trust/update/hooks, claude trust/resume-picker) off