@cohortapp/agent-sdk 2.11.15 → 2.13.0

package/scripts/vendor/sync-skill-packs.mjs

@@ -0,0 +1,242 @@
+#!/usr/bin/env node
+/**
+ * sync-skill-packs.mjs — re-vendor a pinned upstream design skill pack.
+ *
+ * Usage:
+ *   node scripts/vendor/sync-skill-packs.mjs <pack>[ <pack> …]   re-fetch and rewrite
+ *   node scripts/vendor/sync-skill-packs.mjs --all
+ *   node scripts/vendor/sync-skill-packs.mjs --list
+ *   node scripts/vendor/sync-skill-packs.mjs <pack> --dry-run    report, write nothing
+ *   node scripts/vendor/sync-skill-packs.mjs --all --dry-run     RE-VERIFY every
+ *       pack against its pinned upstream commit. This is the only thing that
+ *       establishes provenance: `check-skill-packs.mjs` runs offline and can
+ *       only prove the vendored trees have not moved since review, never that
+ *       they came from upstream. Run this when auditing, not on every commit.
+ *
+ * What it does, for each pack in `scripts/vendor/skill-packs.mjs`:
+ *   1. downloads `https://codeload.github.com/<repo>/tar.gz/<sha>` — the PINNED
+ *      commit, never a branch — into a temp dir and extracts it with `tar`;
+ *   2. copies ONLY the paths the pack's allow-list admits into
+ *      `plugins/maestro-skills/vendor/<pack>/`, deleting anything already there
+ *      that the allow-list no longer admits;
+ *   3. rewrites `UPSTREAM.json` with `{repo, sha, date, license, files:[{path,
+ *      sha256}], omitted, notes}`, sorted, so the diff of a re-sync is readable.
+ *
+ * This is a MAINTAINER tool. It is the only place in the SDK that fetches skill
+ * content, it runs on a developer's machine before a commit, and nothing on a
+ * seat ever calls it: seats get the reviewed bytes from the npm tarball. It
+ * never executes anything out of the downloaded tree.
+ *
+ * Node builtins only (plus the system `tar`, which macOS and Linux both ship).
+ *
+ * @module scripts/vendor/sync-skill-packs
+ */
+
+"use strict";
+
+import { createHash } from "node:crypto";
+import { execFileSync } from "node:child_process";
+import {
+  mkdtempSync, mkdirSync, rmSync, readdirSync, readFileSync, writeFileSync, statSync, existsSync, copyFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { PACKS, findPack, posix, isAllowedDest, manifestDigest } from "./skill-packs.mjs";
+
+const REPO_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..");
+
+/** Where vendored packs live, relative to the repo root. */
+export const VENDOR_REL = path.join("plugins", "maestro-skills", "vendor");
+
+/** @param {string} p @returns {string} */
+export function sha256File(p) {
+  return createHash("sha256").update(readFileSync(p)).digest("hex");
+}
+
+/** Recursively list files under `dir`, as paths relative to it (POSIX). */
+export function listFiles(dir, prefix = "") {
+  let out = [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return out; // an absent directory is an empty one for our purposes
+  }
+  for (const e of entries.sort((a, b) => (a.name < b.name ? -1 : 1))) {
+    const rel = prefix ? `${prefix}/${e.name}` : e.name;
+    if (e.isDirectory()) out = out.concat(listFiles(path.join(dir, e.name), rel));
+    else if (e.isFile()) out.push(rel);
+  }
+  return out;
+}
+
+/**
+ * Expand a pack's rules against a real upstream tree into {from, to} pairs.
+ * Pure over the injected lister so the planner is testable without a download.
+ *
+ * @param {import("./skill-packs.mjs").SkillPack} pack
+ * @param {string} srcRoot
+ * @param {{list?:(dir:string)=>string[], exists?:(p:string)=>boolean}} [deps]
+ * @returns {{ pairs: Array<{from:string,to:string}>, missing: string[] }}
+ */
+export function planPack(pack, srcRoot, deps = {}) {
+  const list = deps.list || ((d) => listFiles(d));
+  const exists = deps.exists || existsSync;
+  const pairs = [];
+  const missing = [];
+  for (const rule of pack.rules) {
+    if (rule.type === "file") {
+      const abs = path.join(srcRoot, rule.from);
+      if (!exists(abs)) { missing.push(rule.from); continue; }
+      pairs.push({ from: rule.from, to: posix(rule.to) });
+      continue;
+    }
+    const absDir = path.join(srcRoot, rule.from);
+    if (!exists(absDir)) { missing.push(`${rule.from}/`); continue; }
+    let taken = 0;
+    for (const rel of list(absDir)) {
+      if (!rule.recursive && rel.includes("/")) continue;
+      const name = rel.slice(rel.lastIndexOf("/") + 1);
+      if (rule.match && !rule.match.test(name)) continue;
+      pairs.push({ from: `${rule.from}/${rel}`, to: posix(rule.to ? `${rule.to}/${rel}` : rel) });
+      taken += 1;
+    }
+    if (taken === 0) missing.push(`${rule.from}/ (matched nothing)`);
+  }
+  // A rule that produced a path the guard would reject is a registry bug, not a
+  // vendoring accident — say so loudly rather than writing an unverifiable tree.
+  for (const p of pairs) {
+    if (!isAllowedDest(pack, p.to)) throw new Error(`rule produced a path its own allow-list rejects: ${p.to}`);
+  }
+  pairs.sort((a, b) => (a.to < b.to ? -1 : a.to > b.to ? 1 : 0));
+  return { pairs, missing };
+}
+
+/** Download the pinned tarball and extract it; returns the extracted repo root. */
+function fetchTree(pack, workDir) {
+  const url = `https://codeload.github.com/${pack.repo}/tar.gz/${pack.sha}`;
+  const tgz = path.join(workDir, "pack.tar.gz");
+  execFileSync("curl", ["-sSLf", "--max-time", "300", "-o", tgz, url], { stdio: ["ignore", "ignore", "pipe"] });
+  const outDir = path.join(workDir, "tree");
+  mkdirSync(outDir, { recursive: true });
+  execFileSync("tar", ["-xzf", tgz, "-C", outDir], { stdio: ["ignore", "ignore", "pipe"] });
+  const roots = readdirSync(outDir, { withFileTypes: true }).filter((e) => e.isDirectory());
+  if (roots.length !== 1) throw new Error(`unexpected tarball layout for ${pack.repo}: ${roots.length} top-level dirs`);
+  return path.join(outDir, roots[0].name);
+}
+
+/** Build the UPSTREAM.json body for a vendored pack. Pure. */
+export function buildManifest(pack, files) {
+  return {
+    repo: pack.repo,
+    sha: pack.sha,
+    date: pack.date,
+    license: pack.license,
+    files: files.slice().sort((a, b) => (a.path < b.path ? -1 : 1)),
+    omitted: pack.omitted.slice(),
+    notes: pack.notes,
+  };
+}
+
+/**
+ * Re-vendor one pack. Returns a summary; throws only on a defect (no network,
+ * a moved upstream path, a rule that contradicts the allow-list).
+ * @param {string} id @param {{repoRoot?:string, dryRun?:boolean, log?:Function}} [o]
+ */
+export function syncPack(id, o = {}) {
+  const pack = findPack(id);
+  if (!pack) throw new Error(`unknown pack "${id}" (known: ${PACKS.map((p) => p.id).join(", ")})`);
+  const repoRoot = o.repoRoot || REPO_ROOT;
+  const log = o.log || (() => {});
+  const destRoot = path.join(repoRoot, VENDOR_REL, pack.id);
+  const work = mkdtempSync(path.join(tmpdir(), `maestro-vendor-${pack.id}-`));
+  try {
+    const srcRoot = fetchTree(pack, work);
+    const { pairs, missing } = planPack(pack, srcRoot);
+    if (missing.length) throw new Error(`${pack.id}: upstream paths absent at ${pack.sha}: ${missing.join(", ")}`);
+    const wanted = new Set(pairs.map((p) => p.to));
+    const existingFiles = listFiles(destRoot);
+    const removed = existingFiles.filter((f) => f !== "UPSTREAM.json" && !wanted.has(f));
+    if (!o.dryRun) {
+      for (const rel of removed) rmSync(path.join(destRoot, rel), { force: true });
+      for (const p of pairs) {
+        const dest = path.join(destRoot, p.to);
+        mkdirSync(path.dirname(dest), { recursive: true });
+        copyFileSync(path.join(srcRoot, p.from), dest);
+        // Vendored content is data. Strip any executable bit the upstream tree
+        // carried unless the pack explicitly allows one there.
+        const mode = statSync(dest).mode & 0o777;
+        const want = 0o644;
+        if (mode !== want) execFileSync("chmod", ["644", dest]);
+      }
+      pruneEmptyDirs(destRoot);
+    }
+    const files = pairs.map((p) => ({
+      path: p.to,
+      sha256: o.dryRun ? sha256File(path.join(srcRoot, p.from)) : sha256File(path.join(destRoot, p.to)),
+    }));
+    const manifest = buildManifest(pack, files);
+    const manifestPath = path.join(destRoot, "UPSTREAM.json");
+    if (!o.dryRun) {
+      mkdirSync(destRoot, { recursive: true });
+      writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`);
+    }
+    // The content pin. `UPSTREAM.json` is written from the bytes it records, so
+    // it can only ever agree with itself; the digest below lives in
+    // skill-packs.mjs, a reviewed source file no vendored tree can reach, and is
+    // what makes a change to the vendored file list show up in a diff as one
+    // line rather than as a data blob nobody reads. A re-sync that shifts it is
+    // a real upstream change and wants a real look — hence the loud line.
+    const contentSha256 = manifestDigest(files);
+    const pinned = pack.contentSha256 || null;
+    if (pinned && pinned !== contentSha256) {
+      log(`${pack.id}: CONTENT CHANGED — review the diff, then set contentSha256: "${contentSha256}" in scripts/vendor/skill-packs.mjs (was ${pinned})`);
+    } else if (!pinned) {
+      log(`${pack.id}: set contentSha256: "${contentSha256}" in scripts/vendor/skill-packs.mjs`);
+    }
+    log(`${pack.id}: ${files.length} file(s) from ${pack.repo}@${pack.sha.slice(0, 12)}${removed.length ? `, ${removed.length} removed` : ""}${o.dryRun ? " (dry-run)" : ""}`);
+    return { pack: pack.id, files, removed, contentSha256, pinned, dryRun: !!o.dryRun };
+  } finally {
+    rmSync(work, { recursive: true, force: true });
+  }
+}
+
+/** Remove directories left empty after a prune. */
+function pruneEmptyDirs(root) {
+  let entries;
+  try { entries = readdirSync(root, { withFileTypes: true }); } catch { return; }
+  for (const e of entries) {
+    if (!e.isDirectory()) continue;
+    const child = path.join(root, e.name);
+    pruneEmptyDirs(child);
+    try { if (readdirSync(child).length === 0) rmSync(child, { recursive: true, force: true }); } catch { /* a racing reader is not our problem */ }
+  }
+}
+
+async function main(argv) {
+  const args = argv.slice(2);
+  if (args.includes("--list") || args.length === 0) {
+    for (const p of PACKS) console.log(`${p.id.padEnd(14)} ${p.repo}@${p.sha.slice(0, 12)}  ${p.license}`);
+    if (args.length === 0) console.log("\nusage: node scripts/vendor/sync-skill-packs.mjs <pack>|--all [--dry-run]");
+    return 0;
+  }
+  const dryRun = args.includes("--dry-run");
+  const ids = args.includes("--all") ? PACKS.map((p) => p.id) : args.filter((a) => !a.startsWith("--"));
+  let code = 0;
+  for (const id of ids) {
+    try {
+      syncPack(id, { dryRun, log: (m) => console.log(`sync-skill-packs: ${m}`) });
+    } catch (err) {
+      console.error(`sync-skill-packs: ${id} FAILED — ${err && err.message ? err.message : err}`);
+      code = 1;
+    }
+  }
+  return code;
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main(process.argv).then((c) => process.exit(c)).catch((e) => { console.error("sync-skill-packs: ERROR", e && e.message ? e.message : e); process.exit(2); });
+}
+
+export default { syncPack, planPack, buildManifest, listFiles, sha256File, VENDOR_REL };

package/scripts/vendor/sync-skill-packs.test.mjs

@@ -0,0 +1,103 @@
+/**
+ * Tests for the vendoring maintainer tool — the half that can run with no
+ * network. `syncPack` itself downloads a pinned tarball and is not exercised
+ * here; what IS exercised is the planner and the content pin, because those are
+ * the two places a re-sync can quietly change what the fleet reads.
+ *
+ * @module scripts/vendor/sync-skill-packs.test
+ */
+
+import { describe, it } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { planPack, buildManifest, sha256File } from "./sync-skill-packs.mjs";
+import { PACKS, findPack, manifestDigest } from "./skill-packs.mjs";
+
+const REPO_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..");
+const VENDOR = path.join(REPO_ROOT, "plugins", "maestro-skills", "vendor");
+
+describe("sync-skill-packs: the content pin", () => {
+  it("manifestDigest is order-independent and moves for any file added, removed or changed", () => {
+    const a = [{ path: "SKILL.md", sha256: "aa" }, { path: "reference/x.md", sha256: "bb" }];
+    assert.equal(manifestDigest(a), manifestDigest([...a].reverse()), "sorted, so a re-sort is not a change");
+    assert.notEqual(manifestDigest(a), manifestDigest([...a, { path: "reference/y.md", sha256: "cc" }]));
+    assert.notEqual(manifestDigest(a), manifestDigest([a[0]]));
+    assert.notEqual(manifestDigest(a), manifestDigest([a[0], { path: "reference/x.md", sha256: "b0" }]));
+  });
+
+  it("what the syncer would write for each committed pack still matches its pinned digest", () => {
+    // buildManifest is what a re-sync produces; if it and the committed
+    // UPSTREAM.json disagree, someone hand-edited a vendored tree.
+    for (const pack of PACKS) {
+      const doc = JSON.parse(readFileSync(path.join(VENDOR, pack.id, "UPSTREAM.json"), "utf8"));
+      const rebuilt = buildManifest(pack, doc.files);
+      assert.deepEqual(rebuilt.files, doc.files, pack.id);
+      assert.deepEqual(rebuilt.omitted, doc.omitted, `${pack.id} omitted[] matches the registry`);
+      assert.equal(rebuilt.notes, doc.notes, `${pack.id} notes match the registry`);
+      assert.equal(manifestDigest(rebuilt.files), pack.contentSha256, pack.id);
+    }
+  });
+
+  it("every recorded sha256 is the sha256 of the file on disk", () => {
+    for (const pack of PACKS) {
+      const doc = JSON.parse(readFileSync(path.join(VENDOR, pack.id, "UPSTREAM.json"), "utf8"));
+      for (const f of doc.files) {
+        assert.equal(sha256File(path.join(VENDOR, pack.id, f.path)), f.sha256, `${pack.id}/${f.path}`);
+      }
+    }
+  });
+});
+
+describe("sync-skill-packs: the planner", () => {
+  /** A fake upstream tree, so the planner runs with no network. */
+  function upstream(files) {
+    const root = mkdtempSync(path.join(tmpdir(), "maestro-upstream-"));
+    for (const [rel, body] of Object.entries(files)) {
+      const abs = path.join(root, rel);
+      mkdirSync(path.dirname(abs), { recursive: true });
+      writeFileSync(abs, body);
+    }
+    return { root, cleanup: () => rmSync(root, { recursive: true, force: true }) };
+  }
+
+  it("unlazy's rules take the gate checker and refuse the hook machinery", () => {
+    // The pack is vendored for its gate checker. `install-hooks.mjs` writes a
+    // Stop hook into a settings file — `--global` into the one every session on
+    // the machine reads — so it is excluded at the rule, not discouraged in
+    // prose: a file that reaches the seat can be run whatever its mode says.
+    const t = upstream({
+      "SKILL.md": "---\nname: unlazy\n---\n",
+      "SECURITY.md": "#\n",
+      "LICENSE": "MIT\n",
+      "references/gates.md": "#\n",
+      "templates/PLAN.md": "#\n",
+      "scripts/gate-check.mjs": "//\n",
+      "scripts/lib/gates.mjs": "//\n",
+      "scripts/install-hooks.mjs": "// writes a Stop hook\n",
+      "scripts/stop-hook.mjs": "// the hook body\n",
+    });
+    try {
+      const { pairs, missing } = planPack(findPack("unlazy"), t.root);
+      const took = pairs.map((p) => p.to);
+      assert.deepEqual(missing, []);
+      assert.ok(took.includes("scripts/gate-check.mjs"));
+      assert.ok(took.includes("scripts/lib/gates.mjs"));
+      assert.equal(took.includes("scripts/install-hooks.mjs"), false);
+      assert.equal(took.includes("scripts/stop-hook.mjs"), false);
+    } finally { t.cleanup(); }
+  });
+
+  it("a rule that produced a path its own allow-list rejects is a defect, not a quiet write", () => {
+    const pack = {
+      ...findPack("unlazy"),
+      rules: [{ type: "dir", from: "scripts", to: "../escape", match: /\.mjs$/, recursive: true }],
+    };
+    const t = upstream({ "scripts/x.mjs": "//\n" });
+    try {
+      assert.throws(() => planPack(pack, t.root), /allow-list rejects/);
+    } finally { t.cleanup(); }
+  });
+});

package/scripts/watchdog/memory-watchdog.sh

@@ -16,7 +16,10 @@
 #            auto-expiring ceiling = liveCount-2 that the resource governor
 #            reads to admit fewer sessions. NO kills.
 #   HARD     (sys 80–90% / claude ≥75%) → SIGTERM the youngest/biggest
-#            subagents, sparing the oldest "main" session (MIN_AGE_SECONDS).
+#            subagents, sparing the oldest "main" session (MIN_AGE_SECONDS)
+#            and — audit F16 — NEVER the seat's interactive main session
+#            (`--name <first>-main`) or its feed (scripts/session/feed.mjs),
+#            whatever their age or size. See is_protected_cmdline.
 #   CRITICAL (sys ≥90%, sustained 2 consecutive runs) → clean daemon RESTART
 #            via `launchctl kickstart -k` (the daemon re-reads state/queues +
 #            cooldowns + sweeps stale claims). NOT a halt. Only after 3 failed
@@ -156,6 +159,34 @@ count_claude_processes() {
 
 # --- Identification ----------------------------------------------------------
 
+# Audit F16. The oldest-process heuristic below is not enough: after a relaunch
+# the seat's interactive main session is the YOUNGEST claude process, and the
+# HARD tier killed it. The main session is identified by its command line, not
+# its age: `claude --name <first>-main …` (the supervisor launches it so) and
+# the feed running inside it (`node scripts/session/feed.mjs`). Pure: takes the
+# command line, exits 0 when the process must never be signalled.
+is_protected_cmdline() {
+  local cmdline="${1:-}"
+  [ -z "$cmdline" ] && return 1
+  # `--name <token>-main` as a WHOLE token (not -mainline, not -main-2).
+  if printf '%s\n' "$cmdline" | grep -Eq -- '(^|[[:space:]])--name[[:space:]]+[A-Za-z0-9_.-]+-main([[:space:]]|$)'; then
+    return 0
+  fi
+  case "$cmdline" in
+    *scripts/session/feed.mjs*) return 0 ;;
+  esac
+  return 1
+}
+
+# Full command line of a pid ("" when the process is gone). `-ww` = unlimited
+# width: without it macOS ps clips `command=` to the terminal width when
+# stdout is a tty (an operator's --check / --dry-run), and a long claude argv
+# can lose its `--name <first>-main` token — which would un-protect the main
+# session exactly when a human is watching.
+cmdline_of() {
+  /bin/ps -ww -o command= -p "$1" 2>/dev/null || true
+}
+
 identify_main_session() {
   # The oldest claude process is treated as the "main" session and spared by
   # HARD-tier kills. (longest-running heuristic)
@@ -201,6 +232,11 @@ kill_youngest_biggest_subagents() {
       log_event "info" "skip_young" "PID $pid age ${age}s < ${MIN_AGE_SECONDS}s minimum"
       continue
     fi
+    # Audit F16: the interactive main session and its feed are never candidates.
+    if is_protected_cmdline "$(cmdline_of "$pid")"; then
+      log_event "info" "skip_protected" "PID $pid is the main session / feed — never signalled"
+      continue
+    fi
     if [ "$killed" -ge "$target_count" ]; then
       break
     fi

package/scripts/watchdog/memory-watchdog.test.mjs

@@ -0,0 +1,64 @@
+/**
+ * memory-watchdog.test.mjs — audit F16: the HARD tier could SIGTERM the
+ * seat's long-lived interactive main session (it only spared the OLDEST
+ * claude process, and a freshly relaunched main session is not the oldest).
+ *
+ * The rule under test is a pure shell function, `is_protected_cmdline`,
+ * extracted from the script and run under bash: a command line carrying
+ * `--name <anything>-main` or `scripts/session/feed.mjs` is never a kill
+ * candidate. The kill loop is also checked textually for the call site, so
+ * the function cannot be defined and then not used.
+ */
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const SCRIPT = join(dirname(fileURLToPath(import.meta.url)), "memory-watchdog.sh");
+
+/** Extract `is_protected_cmdline` from the script and evaluate it on one command line. Exit 0 = protected. */
+function isProtected(cmdline) {
+  const src = readFileSync(SCRIPT, "utf8");
+  const m = src.match(/\nis_protected_cmdline\(\) \{[\s\S]*?\n\}\n/);
+  assert.ok(m, "memory-watchdog.sh defines is_protected_cmdline()");
+  const r = spawnSync("/bin/bash", ["-c", `${m[0]}\nis_protected_cmdline "$1"`, "_", cmdline], { encoding: "utf8" });
+  return r.status === 0;
+}
+
+test("the main session (`--name <first>-main`) is protected, whatever the first name", () => {
+  assert.equal(isProtected("claude --name alex-main --resume 1234 --dangerously-skip-permissions"), true);
+  assert.equal(isProtected("/opt/homebrew/bin/claude --dangerously-skip-permissions --name marc-main"), true);
+  assert.equal(isProtected("node /Users/x/.npm-global/lib/node_modules/@anthropic-ai/claude-code/cli.js --name olivia-main"), true);
+});
+
+test("the session feed (scripts/session/feed.mjs) is protected", () => {
+  assert.equal(isProtected("node /Users/alex/alex-ai/scripts/session/feed.mjs"), true);
+  assert.equal(isProtected("/usr/local/bin/node scripts/session/feed.mjs --agent-root /x"), true);
+});
+
+test("sub-sessions, peers and print spawns are NOT protected", () => {
+  assert.equal(isProtected("claude --print --output-format json --dangerously-skip-permissions prompt"), false);
+  assert.equal(isProtected("claude --name alex-research --dangerously-skip-permissions"), false);
+  assert.equal(isProtected("claude --name alex-mainline"), false, "-main must be a whole token");
+  assert.equal(isProtected("claude --name alex-main-2"), false);
+  assert.equal(isProtected("node scripts/daemon/maestro-daemon.mjs"), false);
+  assert.equal(isProtected(""), false);
+});
+
+test("the HARD-tier kill loop consults is_protected_cmdline before SIGTERM and logs the skip", () => {
+  const src = readFileSync(SCRIPT, "utf8");
+  const loop = src.slice(src.indexOf("kill_youngest_biggest_subagents() {"), src.indexOf('done <<< "$(get_claude_processes)"'));
+  assert.match(loop, /is_protected_cmdline/, "the kill loop calls the guard");
+  assert.match(loop, /skip_protected/, "a protected skip is logged");
+  assert.ok(loop.indexOf("is_protected_cmdline") < loop.indexOf('kill -TERM "$pid"'), "the guard runs before the signal");
+});
+
+test("cmdline_of reads the FULL command line (ps -ww) so a long argv is never cut before --name <first>-main on a narrow tty", () => {
+  const src = readFileSync(SCRIPT, "utf8");
+  const m = src.match(/\ncmdline_of\(\) \{[\s\S]*?\n\}\n/);
+  assert.ok(m, "memory-watchdog.sh defines cmdline_of()");
+  assert.match(m[0], /\/bin\/ps -ww /, "ps must be given -ww (unlimited width) — macOS truncates `-o command=` to the terminal width otherwise");
+});

package/scripts/setup/boot-claude-session.sh

@@ -1,94 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# boot-claude-session.sh — Launch interactive Claude Code session on boot
-# =============================================================================
-#
-# Opens Terminal.app with a Claude Code interactive session in the agent's
-# working directory. Called via launchd at login.
-#
-# This is separate from the maestro daemon (which runs headless as a Node.js
-# process for polling/dispatching). This script provides a visible, interactive
-# Claude Code session that the operator can observe and interact with.
-#
-# Usage:
-#   ./scripts/setup/boot-claude-session.sh <agent-dir>
-#
-# =============================================================================
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-MAESTRO_DIR="$(cd "$SCRIPT_DIR/../.." && pwd)"
-
-# Agent directory required as first argument (e.g. ~/<firstname>-ai).
-AGENT_DIR="${1:?Agent directory required as first argument (e.g. ~/<firstname>-ai)}"
-if [ ! -d "$AGENT_DIR" ]; then
-  echo "ERROR: Agent directory does not exist: $AGENT_DIR" >&2
-  exit 1
-fi
-
-AGENT_NAME=$(basename "$AGENT_DIR")
-# Resolve the agent's display name from config/agent.json (SOT), falling
-# back to the directory basename. Used for the Terminal window banner.
-AGENT_DISPLAY="$AGENT_NAME"
-if [ -f "$AGENT_DIR/config/agent.json" ]; then
-  if command -v jq >/dev/null 2>&1; then
-    fn=$(jq -r '.fullName // empty' "$AGENT_DIR/config/agent.json")
-    [ -n "$fn" ] && AGENT_DISPLAY="$fn"
-  fi
-fi
-LOG_FILE="$MAESTRO_DIR/logs/watchdog/$(date +%Y-%m-%d)-boot-session.log"
-mkdir -p "$(dirname "$LOG_FILE")"
-
-log() {
-  echo "[$(date -u +"%Y-%m-%dT%H:%M:%SZ")] $1" | tee -a "$LOG_FILE"
-}
-
-# Wait for the system to settle after login (network, services, etc.)
-log "Waiting 15s for system to settle..."
-sleep 15
-
-# Check for emergency stop
-if [ -f "$AGENT_DIR/.emergency-stop" ]; then
-  log "Emergency stop active — not starting Claude session"
-  exit 0
-fi
-
-if [ -f "$MAESTRO_DIR/.emergency-stop" ]; then
-  log "Emergency stop active in maestro — not starting Claude session"
-  exit 0
-fi
-
-# Check if claude CLI is available
-if ! command -v claude &>/dev/null; then
-  # Try common paths
-  CLAUDE_PATH=""
-  for p in "$HOME/.local/bin/claude" "/opt/homebrew/bin/claude" "/usr/local/bin/claude"; do
-    if [ -x "$p" ]; then
-      CLAUDE_PATH="$p"
-      break
-    fi
-  done
-
-  if [ -z "$CLAUDE_PATH" ]; then
-    log "ERROR: claude CLI not found"
-    exit 1
-  fi
-else
-  CLAUDE_PATH=$(which claude)
-fi
-
-log "Starting Claude Code session in $AGENT_DIR (claude: $CLAUDE_PATH)"
-
-# Open Terminal.app with Claude Code running in the agent directory
-osascript <<APPLESCRIPT
-tell application "Terminal"
-    activate
-    -- Open a new window with claude running in the agent directory
-    do script "cd '$AGENT_DIR' && clear && echo '╔══════════════════════════════════════════════════════════╗' && echo '║  $AGENT_DISPLAY — Boot Session ($(date +%Y-%m-%d))' && echo '╠══════════════════════════════════════════════════════════╣' && echo '║  Agent dir: $AGENT_DIR' && echo '║  Claude:    $CLAUDE_PATH' && echo '╚══════════════════════════════════════════════════════════╝' && echo '' && '$CLAUDE_PATH'"
-    -- Set the window title
-    set custom title of front window to "$AGENT_NAME — Claude Code"
-end tell
-APPLESCRIPT
-
-log "Terminal window opened with Claude Code session"