@alexjbarnes/cockpit 0.3.1 → 0.4.0

package/dist/src/server/session-manager.js

@@ -4,17 +4,26 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionManager = void 0;
+exports.buildMcpConfigArg = buildMcpConfigArg;
 const node_child_process_1 = require("node:child_process");
+const node_crypto_1 = require("node:crypto");
 const node_events_1 = require("node:events");
 const node_fs_1 = require("node:fs");
+const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
 const uuid_1 = require("uuid");
+const cli_commands_1 = require("../lib/cli-commands");
 const models_1 = require("../lib/models");
+const assistant_settings_1 = require("../server/assistant-settings");
+const claude_bin_1 = require("../server/claude-bin");
 const paths_1 = require("../server/paths");
 const providers_1 = require("../server/providers");
 const debug_logger_1 = require("./debug-logger");
 const defaults_1 = require("./defaults");
 const event_parser_1 = require("./event-parser");
+const job_storage_1 = require("./job-storage");
+const cockpit_agent_prompt_1 = require("./mcp/cockpit-agent-prompt");
+const run_context_1 = require("./mcp/run-context");
 const plans_1 = require("./plans");
 const pty_runtime_1 = require("./pty-runtime");
 const session_prefs_1 = require("./session-prefs");
@@ -26,19 +35,6 @@ const transcript_watcher_1 = require("./transcript-watcher");
 function defaultRuntime() {
     return "stream";
 }
-let resolvedClaudeBin = null;
-function getClaudeBin() {
-    if (resolvedClaudeBin)
-        return resolvedClaudeBin;
-    const cmd = process.platform === "win32" ? "where" : "which";
-    try {
-        resolvedClaudeBin = (0, node_child_process_1.execFileSync)(cmd, ["claude"], { encoding: "utf-8" }).trim().split("\n")[0];
-    }
-    catch {
-        resolvedClaudeBin = "claude";
-    }
-    return resolvedClaudeBin;
-}
 const smLog = (sessionId, msg) => {
     if (!(0, debug_logger_1.isDebugEnabled)())
         return;
@@ -46,8 +42,25 @@ const smLog = (sessionId, msg) => {
     const short = sessionId.slice(0, 8);
     console.log(`[session:${short}] ${ts} ${msg}`);
 };
+function buildMcpConfigArg(url, token) {
+    const dir = node_path_1.default.join((0, node_os_1.tmpdir)(), "cockpit-mcp-config");
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    const filePath = node_path_1.default.join(dir, `${token.slice(0, 16)}.json`);
+    const config = {
+        mcpServers: {
+            "cockpit-config": {
+                type: "http",
+                url: `${url}/mcp`,
+                headers: { Authorization: `Bearer ${token}` },
+            },
+        },
+    };
+    (0, node_fs_1.writeFileSync)(filePath, JSON.stringify(config, null, 2), { mode: 0o600 });
+    return { path: filePath };
+}
 class SessionManager {
     sessions = new Map();
+    _cockpitAgentSessionPromise = null;
     constructor() {
         // Periodically check for sessions stuck in "running" with a dead process
         setInterval(() => {
@@ -55,7 +68,11 @@ class SessionManager {
                 if (session.info.status === "running" && !session.process && !session.ptyRuntime?.isAlive) {
                     const short = id.slice(0, 8);
                     (0, debug_logger_1.debugLog)(`[session:${short}] stale check: status=running but no live process, correcting to idle`);
-                    (0, debug_logger_1.logDiag)(id, "idle:stale-check");
+                    (0, debug_logger_1.logDiag)(id, "idle:stale-check", {
+                        runtime: session.runtime,
+                        spawning: session.spawning ?? false,
+                        hasPtyRuntime: !!session.ptyRuntime,
+                    });
                     session.info.status = "idle";
                     session.emitter.emit("status", id, "idle");
                 }
@@ -67,10 +84,12 @@ class SessionManager {
         const now = Date.now();
         const defaults = (0, defaults_1.getDefaults)();
         const modelSlots = { main: defaults.modelSlots.main ?? "sonnet" };
+        const isCockpitAgent = options?.cockpitAgent === true;
         const rt = options?.runtime ?? defaultRuntime();
+        const sessionName = isCockpitAgent ? "Cockpit Assistant" : name || node_path_1.default.basename(cwd) || cwd;
         const info = {
             id,
-            name: name || node_path_1.default.basename(cwd) || cwd,
+            name: sessionName,
             cwd,
             createdAt: now,
             lastActiveAt: now,
@@ -85,10 +104,9 @@ class SessionManager {
             process: null,
             stdin: null,
             emitter: new node_events_1.EventEmitter(),
-            hasSpawnedBefore: false,
             cliSessionId: id,
             previousCliSessionIds: [],
-            bypassAllPermissions: options?.bypassPermissions ?? defaults.bypassAllPermissions,
+            bypassAllPermissions: isCockpitAgent ? false : (options?.bypassPermissions ?? defaults.bypassAllPermissions),
             planMode: false,
             needsRespawnForPermissions: false,
             compacting: false,
@@ -114,10 +132,38 @@ class SessionManager {
             todoWatcher: null,
             attachmentPaths: [],
             totalTokens: { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 },
+            cockpitAgent: isCockpitAgent,
+            cockpitAgentCleanups: [],
         });
-        (0, session_prefs_1.setSessionPrefs)(id, { runtime: rt });
+        (0, session_prefs_1.setSessionPrefs)(id, { runtime: rt, ...(isCockpitAgent ? { cockpitAgent: true } : {}) });
+        if (isCockpitAgent) {
+            this.registerCockpitAgentOnInit(id);
+        }
         return info;
     }
+    registerCockpitAgentOnInit(id) {
+        const session = this.sessions.get(id);
+        if (!session)
+            return; // TypeScript narrows to Session below; push is safe
+        const cleanup = this.onInit(id, async (data) => {
+            for (const server of data.mcpServers) {
+                if (server.name !== "cockpit-config" && server.status !== "disabled") {
+                    try {
+                        await this.mcpToggle(id, server.name, false);
+                    }
+                    catch {
+                        // best effort — server may not be started yet
+                    }
+                }
+            }
+        });
+        if (cleanup) {
+            session.cockpitAgentCleanups.push(cleanup); // destroySession iterates this to unsubscribe
+        }
+        else {
+            console.warn(`[cockpit-agent] onInit returned null for session ${id.slice(0, 8)}`);
+        }
+    }
     ensureSession(id, cwd) {
         let session = this.sessions.get(id);
         if (!session) {
@@ -147,10 +193,9 @@ class SessionManager {
                 process: null,
                 stdin: null,
                 emitter: new node_events_1.EventEmitter(),
-                hasSpawnedBefore: true,
                 cliSessionId: cliId,
                 previousCliSessionIds: prevIds,
-                bypassAllPermissions: prefs?.bypassAllPermissions ?? defaults.bypassAllPermissions,
+                bypassAllPermissions: (prefs?.cockpitAgent ? false : prefs?.bypassAllPermissions) ?? defaults.bypassAllPermissions,
                 planMode: prefs?.planMode ?? false,
                 pendingPlanReminder: prefs?.planMode ?? false,
                 needsRespawnForPermissions: false,
@@ -180,11 +225,68 @@ class SessionManager {
                 todoWatcher: null,
                 attachmentPaths: [],
                 totalTokens: { input: 0, output: 0, cacheCreate: 0, cacheRead: 0 },
+                cockpitAgent: prefs?.cockpitAgent ?? false,
+                cockpitAgentCleanups: [],
             };
             this.sessions.set(id, session);
+            if (prefs?.cockpitAgent) {
+                this.registerCockpitAgentOnInit(id);
+            }
         }
         return session;
     }
+    async getOrCreateCockpitAgentSession() {
+        // Fast path: the session is already live in memory (the common case once the
+        // modal has been opened this server lifetime). Returns synchronously.
+        const stored = (0, assistant_settings_1.getAssistantSettings)().sessionId;
+        if (stored && this.sessions.has(stored))
+            return stored;
+        // Slow path: restore-from-disk or create-new. There is no `await` between the
+        // null-check and the assignment below, so the first caller sets the promise
+        // before any other caller can run; every concurrent first-open then awaits
+        // that same single execution. The finally clears it for the next miss.
+        if (!this._cockpitAgentSessionPromise) {
+            this._cockpitAgentSessionPromise = this._resolveOrCreateCockpitAgentSession().finally(() => {
+                this._cockpitAgentSessionPromise = null;
+            });
+        }
+        return this._cockpitAgentSessionPromise;
+    }
+    async _resolveOrCreateCockpitAgentSession() {
+        const settings = (0, assistant_settings_1.getAssistantSettings)();
+        const stored = settings.sessionId;
+        if (stored) {
+            if (this.sessions.has(stored))
+                return stored; // restored by an earlier caller
+            const prefs = (0, session_prefs_1.getSessionPrefs)(stored);
+            // Only restore a stored id that is genuinely a cockpit agent session. A
+            // pointer to a regular session (e.g. a hand-edited assistant.json) must not
+            // be rehydrated here — it would lack the MCP-disable/permission restrictions.
+            if (prefs?.cockpitAgent) {
+                const cwd = (await (0, transcript_1.findSessionCwd)(prefs.cliSessionId || stored)) ?? (await (0, transcript_1.findSessionCwd)(stored));
+                if (cwd) {
+                    // ensureSession rebuilds in-memory state and (Step 5) registers the MCP-disable
+                    // onInit listener. Model/thinking are restored from session-prefs — which the
+                    // in-modal selector and the settings-page write-through both keep current —
+                    // so no re-apply is needed here.
+                    this.ensureSession(stored, cwd);
+                    return stored;
+                }
+            }
+        }
+        // No stored id, or its transcript is gone — create a fresh session seeded from
+        // assistant.json. createSession is synchronous (this.sessions.set before return).
+        const info = this.createSession((0, paths_1.getCockpitDir)(), undefined, {
+            cockpitAgent: true,
+            runtime: settings.runtime,
+        });
+        if (settings.model)
+            this.setModel(info.id, settings.model, settings.contextSize);
+        if (settings.thinkingLevel)
+            this.setThinkingLevel(info.id, settings.thinkingLevel);
+        (0, assistant_settings_1.updateAssistantSettings)({ sessionId: info.id });
+        return info.id;
+    }
     async getSession(id) {
         let session = this.sessions.get(id);
         if (!session) {
@@ -507,9 +609,6 @@ class SessionManager {
             return false;
         }
         this.killProcess(session);
-        if (!(0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd)) {
-            session.hasSpawnedBefore = false;
-        }
         session.pendingRequests.clear();
         this.notifyPendingChanged(session, sessionId);
         session.streamingSnapshot = null;
@@ -540,6 +639,24 @@ class SessionManager {
             session.todoWatcher = null;
         }
         this.cleanupAttachments(session);
+        for (const cleanup of session.cockpitAgentCleanups) {
+            try {
+                cleanup();
+            }
+            catch {
+                /* best effort */
+            }
+        }
+        if (session.mcpToken) {
+            (0, run_context_1.clearToken)(session.mcpToken);
+            const configPath = node_path_1.default.join((0, node_os_1.tmpdir)(), "cockpit-mcp-config", `${session.mcpToken.slice(0, 16)}.json`);
+            try {
+                (0, node_fs_1.unlinkSync)(configPath);
+            }
+            catch {
+                /* best effort */
+            }
+        }
         session.emitter.removeAllListeners();
         this.sessions.delete(id);
         return true;
@@ -734,7 +851,7 @@ class SessionManager {
     }
     setBypassAllPermissions(sessionId) {
         const session = this.sessions.get(sessionId);
-        if (!session || session.bypassAllPermissions)
+        if (!session || session.bypassAllPermissions || session.cockpitAgent)
             return;
         session.bypassAllPermissions = true;
         (0, session_prefs_1.setSessionPrefs)(sessionId, { bypassAllPermissions: true });
@@ -766,7 +883,6 @@ class SessionManager {
             return;
         if (session.info.status === "idle") {
             this.killProcess(session);
-            session.hasSpawnedBefore = (0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd);
         }
         else {
             session.needsRespawnForPermissions = true;
@@ -894,9 +1010,6 @@ class SessionManager {
         else {
             this.log(sessionId, `setModel: killing process (hasStdin=${!!session.stdin}, contextChanged=${contextChanged})`);
             this.killProcess(session);
-            if (!(0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd)) {
-                session.hasSpawnedBefore = false;
-            }
             session.queuedMessages.length = 0;
             session.queuePaused = false;
             session.info.status = "idle";
@@ -1176,9 +1289,13 @@ class SessionManager {
                 return;
             const u = raw.message.usage;
             const used = (u.input_tokens || 0) + (u.cache_creation_input_tokens || 0) + (u.cache_read_input_tokens || 0);
-            const usage = { used, total: session.contextWindowSize };
-            session.contextUsage = usage;
-            session.emitter.emit("usage", sessionId, usage);
+            // Only move the gauge on a real reading. An interrupted/cancelled turn
+            // emits an all-zero usage block; setting it would wipe the gauge to 0.
+            if (used > 0) {
+                const usage = { used, total: session.contextWindowSize };
+                session.contextUsage = usage;
+                session.emitter.emit("usage", sessionId, usage);
+            }
             session.totalTokens.input += u.input_tokens || 0;
             session.totalTokens.output += u.output_tokens || 0;
             session.totalTokens.cacheCreate += u.cache_creation_input_tokens || 0;
@@ -1237,6 +1354,10 @@ class SessionManager {
             session.ptyRuntime = null;
             runtime.kill().catch(() => { });
         }
+        // A kill ends any in-flight spawn, so clear the ensureProcess guard now. A
+        // deliberate kill-then-respawn (settings change, /clear, restart) must not
+        // be blocked until the dying runtime's start() promise happens to settle.
+        session.spawning = false;
         session.compacting = false;
     }
     emitSystem(session, sessionId, text) {
@@ -1329,6 +1450,47 @@ class SessionManager {
             else if (pa.type === "auto_deny") {
                 this.respondToPermission(sessionId, pa.requestId, false, undefined, undefined, pa.denyReason);
             }
+            else if (session.cockpitAgent && pa.toolName !== "AskUserQuestion") {
+                const tool = pa.toolName;
+                const isReadOnlyBuiltin = ["Read", "Grep", "Glob"].includes(tool);
+                const cockpitPrefix = "mcp__cockpit-config__";
+                const isCockpitTool = tool.startsWith(cockpitPrefix);
+                const cockpitAction = isCockpitTool ? tool.slice(cockpitPrefix.length).split("_")[0] : "";
+                const isCockpitRead = isCockpitTool && (cockpitAction === "list" || cockpitAction === "get");
+                const isCockpitWrite = isCockpitTool && !isCockpitRead;
+                (0, debug_logger_1.logDiag)(sessionId, "cockpit-agent:permission", {
+                    toolName: tool,
+                    decision: isReadOnlyBuiltin || isCockpitRead ? "auto_approve" : isCockpitWrite ? "proposal" : "auto_deny",
+                });
+                if (isReadOnlyBuiltin || isCockpitRead) {
+                    this.respondToPermission(sessionId, pa.requestId, true, pa.rawToolInput);
+                }
+                else if (isCockpitWrite) {
+                    const suffix = tool.replace("mcp__cockpit-config__", "");
+                    const parts = suffix.split("_");
+                    const action = parts[0];
+                    const domain = parts.slice(1).join("_");
+                    let displayName;
+                    if (domain === "job" && (action === "update" || action === "delete")) {
+                        const jobId = pa.rawToolInput?.id;
+                        if (typeof jobId === "string") {
+                            displayName = (0, job_storage_1.getJob)(jobId)?.name;
+                        }
+                    }
+                    session.pendingRequests.set(pa.requestId, {
+                        type: "permission",
+                        requestId: pa.requestId,
+                        toolName: pa.toolName,
+                        toolInput: pa.toolInput || "",
+                        rawToolInput: pa.rawToolInput,
+                        configProposal: { toolName: tool, domain, action, ...(displayName ? { displayName } : {}) },
+                    });
+                    this.notifyPendingChanged(session, sessionId);
+                }
+                else {
+                    this.respondToPermission(sessionId, pa.requestId, false, undefined, undefined, "This tool is not available in the cockpit assistant");
+                }
+            }
             else if (session.bypassAllPermissions && !session.planMode && pa.toolName !== "AskUserQuestion") {
                 this.respondToPermission(sessionId, pa.requestId, true, pa.rawToolInput);
                 bypassedRequestIds.add(pa.requestId);
@@ -1437,7 +1599,6 @@ class SessionManager {
                 // generate a new CLI session ID to get a fresh context.
                 session.previousCliSessionIds.push(session.cliSessionId);
                 session.cliSessionId = (0, uuid_1.v4)();
-                session.hasSpawnedBefore = false;
                 session.queuedMessages.length = 0;
                 session.queuePaused = false;
                 session.todoItems = [];
@@ -1505,6 +1666,24 @@ class SessionManager {
                 return true;
             }
             case "/context": {
+                // Forward to the CLI's own /context: it shows the live per-category
+                // breakdown and the ACTUAL window, which cockpit's readout (picked size
+                // only) can't. /context is a local command (no model turn → no Stop hook),
+                // so never enter the running state — that would hang the session on
+                // "processing". If no CLI is live (e.g. a context-size switch just killed
+                // it), spawn one rather than showing cockpit's one-liner; the spawn applies
+                // the freshly-picked window so /context reflects the switch immediately.
+                // Output arrives as a local_command transcript entry (ANSI-stripped). When a
+                // turn is already running we don't interfere — fall back to the local readout.
+                if (session.runtime === "pty" && session.info.status !== "running") {
+                    if (session.ptyRuntime?.isAlive) {
+                        session.ptyRuntime.sendText("/context").catch(() => { });
+                    }
+                    else {
+                        this.spawnPtyProcess(session, sessionId, "/context");
+                    }
+                    return true;
+                }
                 if (!session.contextUsage) {
                     this.emitSystem(session, sessionId, "Context usage data not available yet.");
                     return true;
@@ -1521,66 +1700,32 @@ class SessionManager {
                 return true;
             }
         }
-        // In PTY mode, intercept commands that render CLI dialogs to prevent hangs
+        // In PTY mode, only model-invoking commands are safe to forward to the REPL:
+        // they run a turn that fires a Stop hook, which clears the running state.
+        // CLI-local commands don't: "local-jsx" opens an interactive panel cockpit
+        // renders from the transcript, not the raw PTY, so it can't show or drive; and
+        // "local" acts with no Stop hook, hanging the session on "processing". Block
+        // both. Classification (incl. aliases) is generated from the CLI binary; see
+        // src/lib/cli-commands.ts. Unknown commands (custom/project/plugin) are
+        // prompt-style and pass through.
         if (session.ptyRuntime?.isAlive) {
-            const dialogCmd = cmd.replace("/", "");
-            if (SessionManager.DIALOG_COMMANDS.has(dialogCmd)) {
-                this.emitSystem(session, sessionId, `"${cmd}" opens an interactive CLI dialog that isn't available in remote mode.`);
+            const kind = (0, cli_commands_1.classifyCliCommand)(cmd);
+            // /compact is CLI-local but cockpit drives compaction through it (PostCompact
+            // clears the running state), so it must reach the CLI -- let it pass through.
+            const passThrough = SessionManager.PTY_FORWARD_LOCAL.has(cmd.replace(/^\//, ""));
+            if (!passThrough && (kind === "local" || kind === "local-jsx")) {
+                const detail = kind === "local-jsx" ? "opens an interactive CLI dialog" : "runs in the CLI only";
+                this.emitSystem(session, sessionId, `"${cmd}" ${detail} and isn't available in remote mode.`);
                 return true;
             }
         }
         // All other slash commands pass through to Claude
         return false;
     }
-    static DIALOG_COMMANDS = new Set([
-        "config",
-        "usage",
-        "session",
-        "stats",
-        "doctor",
-        "diff",
-        "mcp",
-        "permissions",
-        "hooks",
-        "tasks",
-        "agents",
-        "skills",
-        "memory",
-        "theme",
-        "fast",
-        "feedback",
-        "copy",
-        "branch",
-        "plan",
-        "chrome",
-        "desktop",
-        "ide",
-        "mobile",
-        "bridge",
-        "sandbox",
-        "export",
-        "login",
-        "logout",
-        "upgrade",
-        "rate-limit-options",
-        "privacy-settings",
-        "terminal-setup",
-        "install-github-app",
-        "remote-env",
-        "remote-setup",
-        "resume",
-        "add-dir",
-        "btw",
-        "extra-usage",
-        "passes",
-        "think-back",
-        "ultrareview",
-        "tag",
-        "exit",
-        "effort",
-        "color",
-        "files",
-    ]);
+    // CLI-local commands cockpit intentionally forwards in PTY despite their type,
+    // because their lifecycle is handled (e.g. /compact fires PostCompact, which
+    // clears the running state the same way a Stop hook would).
+    static PTY_FORWARD_LOCAL = new Set(["compact"]);
     static MEDIA_EXT = {
         "image/png": ".png",
         "image/jpeg": ".jpg",
@@ -1784,7 +1929,13 @@ Additional Cockpit rules beyond the CLI's defaults:
     }
     ensureProcess(sessionId) {
         const session = this.sessions.get(sessionId);
-        if (!session || session.process || session.ptyRuntime?.isAlive)
+        // `spawning` guards the PTY startup window: the runtime is assigned before
+        // its async start() resolves, and during that window ptyRuntime.isAlive is
+        // false, so a second ensureProcess (a WS reconnect, or a startup race)
+        // would otherwise spawn a duplicate CLI for the same session — two
+        // processes racing on the same --session-id. (Stream sets session.process
+        // synchronously, so it is already covered by that check.)
+        if (!session || session.process || session.ptyRuntime?.isAlive || session.spawning)
             return;
         this.spawnProcess(session, sessionId);
     }
@@ -1805,23 +1956,24 @@ Additional Cockpit rules beyond the CLI's defaults:
             this.spawnPtyProcess(session, sessionId, text, images, documents);
             return;
         }
-        this.log(sessionId, `spawning CLI process (resume=${session.hasSpawnedBefore}, model=${session.info.model || "sonnet"})`);
+        const willResume = (0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd);
+        this.log(sessionId, `spawning CLI process (resume=${willResume}, model=${session.info.model || "sonnet"})`);
         const args = ["-p", "--verbose", "--output-format", "stream-json", "--input-format", "stream-json"];
         // In plan mode, omit --allow-dangerously-skip-permissions so the CLI
         // natively enforces tool restrictions and sends permission_requests for
         // write tools (which the server auto-denies).
         // Outside plan mode, enable bypass so it can be toggled mid-session.
-        if (!session.planMode) {
+        if (!session.planMode && !session.cockpitAgent) {
             args.push("--allow-dangerously-skip-permissions");
         }
         args.push("--permission-prompt-tool", "stdio");
         if (session.planMode) {
             args.push("--permission-mode", "plan");
         }
-        else if (session.bypassAllPermissions) {
+        else if (session.bypassAllPermissions && !session.cockpitAgent) {
             args.push("--permission-mode", "bypassPermissions");
         }
-        if (session.hasSpawnedBefore || (0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd)) {
+        if (willResume) {
             args.push("--resume", session.cliSessionId);
         }
         else {
@@ -1849,13 +2001,43 @@ Additional Cockpit rules beyond the CLI's defaults:
         if (models_1.CONTEXT_SIZES[sizeKey].disableEnv) {
             env.CLAUDE_CODE_DISABLE_1M_CONTEXT = "1";
         }
+        else {
+            // 1m: drop any inherited override so cockpit's pick stays authoritative and
+            // a CLAUDE_CODE_DISABLE_1M_CONTEXT in cockpit's own env can't force 200k.
+            delete env.CLAUDE_CODE_DISABLE_1M_CONTEXT;
+        }
         if (session.modelSlots.subagent && session.modelSlots.subagent !== session.modelSlots.main) {
             const resolvedSub = (0, providers_1.resolveProviderModel)(session.modelSlots.subagent);
             env.ANTHROPIC_SMALL_FAST_MODEL = resolvedSub ? resolvedSub.model.modelId : session.modelSlots.subagent;
         }
+        if (session.cockpitAgent) {
+            args.push("--append-system-prompt", cockpit_agent_prompt_1.COCKPIT_AGENT_SYSTEM_PROMPT);
+            const cockpitMcp = (0, singleton_1.getCockpitMcp)();
+            if (cockpitMcp) {
+                if (session.mcpToken) {
+                    (0, run_context_1.clearToken)(session.mcpToken);
+                    try {
+                        (0, node_fs_1.unlinkSync)(node_path_1.default.join((0, node_os_1.tmpdir)(), "cockpit-mcp-config", `${session.mcpToken.slice(0, 16)}.json`));
+                    }
+                    catch {
+                        /* best effort */
+                    }
+                }
+                const token = (0, node_crypto_1.randomBytes)(24).toString("hex");
+                if (session.runContext) {
+                    (0, run_context_1.registerRunContext)(token, session.runContext);
+                }
+                else {
+                    (0, run_context_1.registerAuthToken)(token);
+                }
+                session.mcpToken = token;
+                const configFile = buildMcpConfigArg(cockpitMcp.getUrl(), token);
+                args.push("--mcp-config", configFile.path);
+            }
+        }
         (0, node_fs_1.mkdirSync)(session.info.cwd, { recursive: true });
         const isWin = process.platform === "win32";
-        const proc = (0, node_child_process_1.spawn)(getClaudeBin(), args, {
+        const proc = (0, node_child_process_1.spawn)((0, claude_bin_1.getClaudeBin)(), args, {
             cwd: session.info.cwd,
             env,
             stdio: ["pipe", "pipe", "pipe"],
@@ -1863,7 +2045,6 @@ Additional Cockpit rules beyond the CLI's defaults:
         });
         session.process = proc;
         session.stdin = proc.stdin;
-        session.hasSpawnedBefore = true;
         this.log(sessionId, `CLI process spawned (pid=${proc.pid})`);
         this.startTodoWatcher(session, sessionId);
         // Send initialize control request before the first user message to get
@@ -1879,7 +2060,7 @@ Additional Cockpit rules beyond the CLI's defaults:
         if (session.planMode) {
             this.sendPermissionMode(session, sessionId, "plan");
         }
-        else if (session.bypassAllPermissions) {
+        else if (session.bypassAllPermissions && !session.cockpitAgent) {
             this.sendPermissionMode(session, sessionId, "bypassPermissions");
         }
         if (text) {
@@ -2010,13 +2191,20 @@ Additional Cockpit rules beyond the CLI's defaults:
             session.emitter.emit("error", sessionId, msg);
             return;
         }
-        this.log(sessionId, `spawning PTY claude (resume=${session.hasSpawnedBefore}, model=${session.info.model || "sonnet"})`);
+        const willResume = (0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd);
+        this.log(sessionId, `spawning PTY claude (resume=${willResume}, model=${session.info.model || "sonnet"})`);
+        const spawnBeginAt = Date.now();
+        (0, debug_logger_1.logDiag)(sessionId, "pty:spawn-begin", {
+            model: session.info.model,
+            hasText: !!text,
+            status: session.info.status,
+        });
         (0, node_fs_1.mkdirSync)(session.info.cwd, { recursive: true });
         const streamState = (0, stream_processor_1.createStreamState)();
         session.streamState = streamState;
         streamState.thinkingStartedAt = Date.now();
         const extraArgs = [];
-        if (session.hasSpawnedBefore || (0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd)) {
+        if ((0, transcript_1.transcriptExists)(session.cliSessionId, session.info.cwd)) {
             extraArgs.push("--resume", session.cliSessionId);
         }
         else {
@@ -2032,7 +2220,7 @@ Additional Cockpit rules beyond the CLI's defaults:
         if (session.planMode) {
             extraArgs.push("--permission-mode", "plan");
         }
-        else if (session.bypassAllPermissions) {
+        else if (session.bypassAllPermissions && !session.cockpitAgent) {
             extraArgs.push("--permission-mode", "bypassPermissions");
         }
         const extraEnv = {};
@@ -2046,12 +2234,37 @@ Additional Cockpit rules beyond the CLI's defaults:
             const resolvedSub = (0, providers_1.resolveProviderModel)(session.modelSlots.subagent);
             extraEnv.ANTHROPIC_SMALL_FAST_MODEL = resolvedSub ? resolvedSub.model.modelId : session.modelSlots.subagent;
         }
+        if (session.cockpitAgent) {
+            extraArgs.push("--append-system-prompt", cockpit_agent_prompt_1.COCKPIT_AGENT_SYSTEM_PROMPT);
+            const cockpitMcp = (0, singleton_1.getCockpitMcp)();
+            if (cockpitMcp) {
+                if (session.mcpToken) {
+                    (0, run_context_1.clearToken)(session.mcpToken);
+                    try {
+                        (0, node_fs_1.unlinkSync)(node_path_1.default.join((0, node_os_1.tmpdir)(), "cockpit-mcp-config", `${session.mcpToken.slice(0, 16)}.json`));
+                    }
+                    catch {
+                        /* best effort */
+                    }
+                }
+                const token = (0, node_crypto_1.randomBytes)(24).toString("hex");
+                if (session.runContext) {
+                    (0, run_context_1.registerRunContext)(token, session.runContext);
+                }
+                else {
+                    (0, run_context_1.registerAuthToken)(token);
+                }
+                session.mcpToken = token;
+                const configFile = buildMcpConfigArg(cockpitMcp.getUrl(), token);
+                extraArgs.push("--mcp-config", configFile.path);
+            }
+        }
         const runtime = new pty_runtime_1.PtyRuntime({
             sessionId,
             cwd: session.info.cwd,
             cliSessionId: session.cliSessionId,
             hookRouter,
-            claudeBin: getClaudeBin(),
+            claudeBin: (0, claude_bin_1.getClaudeBin)(),
             extraArgs,
             extraEnv,
             onEvents: (events) => {
@@ -2069,8 +2282,14 @@ Additional Cockpit rules beyond the CLI's defaults:
                 if (session.ptyRuntime !== runtime)
                     return;
                 session.ptyRuntime = null;
+                session.spawning = false;
                 session.streamingSnapshot = null;
-                (0, debug_logger_1.logDiag)(sessionId, "idle:pty-exit", { exitCode, flushedOnMessageDone: streamState.flushedOnMessageDone });
+                (0, debug_logger_1.logDiag)(sessionId, "idle:pty-exit", {
+                    exitCode,
+                    signal: signal ?? null,
+                    flushedOnMessageDone: streamState.flushedOnMessageDone,
+                    sinceSpawnMs: Date.now() - spawnBeginAt,
+                });
                 if (session.transcriptWatcher) {
                     session.transcriptWatcher.stop();
                     session.transcriptWatcher = null;
@@ -2098,7 +2317,7 @@ Additional Cockpit rules beyond the CLI's defaults:
             },
         });
         session.ptyRuntime = runtime;
-        session.hasSpawnedBefore = true;
+        (0, debug_logger_1.logDiag)(sessionId, "pty:runtime-assigned", { elapsedMs: Date.now() - spawnBeginAt });
         this.cleanupAttachments(session);
         const attachments = this.writeAttachments(images, documents);
         session.attachmentPaths.push(...attachments);
@@ -2127,19 +2346,38 @@ Additional Cockpit rules beyond the CLI's defaults:
         });
         session.transcriptWatcher = watcher;
         this.startTodoWatcher(session, sessionId);
+        // Set the in-flight guard immediately before start(). Everything above is
+        // synchronous (no re-entrancy is possible until start() yields to the event
+        // loop), so a synchronous throw in the setup above can never strand
+        // spawning=true and permanently block ensureProcess for this session.
+        session.spawning = true;
         runtime
             .start(ptyText)
             .then(() => {
+            session.spawning = false;
             this.log(sessionId, `PTY claude ready (pid=${runtime.pid})`);
+            (0, debug_logger_1.logDiag)(sessionId, "pty:start-resolved", {
+                pid: runtime.pid,
+                elapsedMs: Date.now() - spawnBeginAt,
+                isAlive: runtime.isAlive,
+                status: session.info.status,
+            });
             watcher.start();
         })
             .catch((err) => {
+            session.spawning = false;
             const msg = err instanceof Error ? err.message : String(err);
             this.log(sessionId, `pty runtime start failed: ${msg}`);
+            (0, debug_logger_1.logDiag)(sessionId, "pty:start-rejected", { error: msg, elapsedMs: Date.now() - spawnBeginAt });
+            const dead = session.ptyRuntime;
             session.ptyRuntime = null;
+            // Emit error BEFORE idle: a job's onStatus("idle") maps to success, so an
+            // idle-first order would mark a failed spawn as a successful empty run.
+            session.emitter.emit("error", sessionId, msg);
             session.info.status = "idle";
             session.emitter.emit("status", sessionId, "idle");
-            session.emitter.emit("error", sessionId, msg);
+            // Reap the half-started PTY so a failed delivery can't leak an idle CLI.
+            dead?.kill().catch(() => { });
         });
     }
     async loadAgentChildren(session, sessionId, messageId, cwd) {