@hienlh/ppm 0.18.2 → 0.18.3

package/src/server/helpers/range-file-response.ts

@@ -0,0 +1,86 @@
+/**
+ * Serve a local file with HTTP Range support (RFC 9110 §14).
+ *
+ * `<video>`/`<audio>` and pdf.js fetch media in byte ranges: the browser asks for
+ * `Range: bytes=N-` when the user seeks and expects `206 Partial Content` back.
+ * Without `Accept-Ranges` + `Content-Length` on the 200 response the browser cannot
+ * even show the duration, so a `file.stream()` body (chunked, no length) breaks seeking.
+ *
+ * Bun ≥ 1.3.13 handles Range itself when the body is a `BunFile`, but PPM runs on
+ * whatever Bun the user has installed, so the parsing is done here and works on
+ * every version. Multi-range requests (`bytes=0-1,5-9`) fall back to the whole file,
+ * which the spec allows.
+ */
+
+export interface ByteRange {
+  start: number;
+  /** Inclusive last byte. */
+  end: number;
+}
+
+/**
+ * Parse a single-range `Range` header against a resource of `size` bytes.
+ * Returns `null` when there is no usable range (absent header, malformed, multi-range)
+ * — caller should answer 200 with the whole file. Returns `"unsatisfiable"` when the
+ * range lies entirely outside the file — caller should answer 416.
+ */
+export function parseRangeHeader(header: string | null | undefined, size: number): ByteRange | "unsatisfiable" | null {
+  if (!header) return null;
+  const m = /^bytes=(\d*)-(\d*)$/.exec(header.trim());
+  if (!m) return null;
+  const [, rawStart, rawEnd] = m;
+  if (rawStart === "" && rawEnd === "") return null;
+  if (size <= 0) return "unsatisfiable";
+
+  // Suffix range `bytes=-500` → last 500 bytes.
+  if (rawStart === "") {
+    const suffix = Number(rawEnd);
+    if (suffix <= 0) return "unsatisfiable";
+    return { start: Math.max(0, size - suffix), end: size - 1 };
+  }
+
+  const start = Number(rawStart);
+  if (start >= size) return "unsatisfiable";
+  // Open-ended `bytes=1024-` or an end past EOF are both clamped to the last byte.
+  const end = rawEnd === "" ? size - 1 : Math.min(Number(rawEnd), size - 1);
+  if (end < start) return "unsatisfiable";
+  return { start, end };
+}
+
+/**
+ * Build the `Response` for `absPath`, honouring the request's `Range` header.
+ * `extraHeaders` are merged onto every response (Content-Disposition, Cache-Control…).
+ * `contentType` overrides the sniffed MIME type (used for forced downloads).
+ */
+export function rangeFileResponse(
+  absPath: string,
+  req: Request,
+  extraHeaders: Record<string, string> = {},
+  contentType?: string,
+): Response {
+  const file = Bun.file(absPath);
+  const size = file.size;
+  const base: Record<string, string> = {
+    "Accept-Ranges": "bytes",
+    "Content-Type": contentType ?? (file.type || "application/octet-stream"),
+    ...extraHeaders,
+  };
+
+  const range = parseRangeHeader(req.headers.get("range"), size);
+  if (range === null) {
+    // Whole file. Bun derives Content-Length from the BunFile body.
+    return new Response(file, { status: 200, headers: { ...base, "Content-Length": String(size) } });
+  }
+  if (range === "unsatisfiable") {
+    return new Response(null, { status: 416, headers: { ...base, "Content-Range": `bytes */${size}` } });
+  }
+  const { start, end } = range;
+  return new Response(file.slice(start, end + 1), {
+    status: 206,
+    headers: {
+      ...base,
+      "Content-Range": `bytes ${start}-${end}/${size}`,
+      "Content-Length": String(end - start + 1),
+    },
+  });
+}

package/src/server/index.ts

@@ -17,6 +17,7 @@ import { postgresRoutes } from "./routes/postgres.ts";
 import { databaseRoutes } from "./routes/database.ts";
 import { fsBrowseRoutes } from "./routes/fs-browse.ts";
 import { fsOpsRoutes } from "./routes/fs-ops.ts";
+import { fsUploadRoutes } from "./routes/fs-upload.ts";
 import { fsSqliteRoutes } from "./routes/fs-sqlite.ts";
 import { accountsRoutes } from "./routes/accounts.ts";
 import { proxyRoutes } from "./routes/proxy.ts";
@@ -94,6 +95,16 @@ async function setupLogFile() {
   });
 }
 
+/**
+ * WebSocket upgrades carry the session token as `?token=` (no headers on a
+ * browser handshake). When auth is disabled every upgrade is allowed.
+ */
+export function isWsUpgradeAuthorized(url: URL): boolean {
+  const authConfig = configService.get("auth");
+  if (!authConfig.enabled) return true;
+  return url.searchParams.get("token") === authConfig.token;
+}
+
 // Register database adapters at module load time
 initAdapters();
 
@@ -155,6 +166,7 @@ app.route("/api/tunnels", tunnelRegistryRoutes);
 // Filesystem operations (browse, list, read, write) — consolidated in fs-browse route
 app.route("/api/fs", fsBrowseRoutes);
 app.route("/api/fs", fsOpsRoutes);
+app.route("/api/fs", fsUploadRoutes);
 app.route("/api/fs/sqlite", fsSqliteRoutes);
 
 // System resource monitoring (SSE + JSON)
@@ -818,30 +830,23 @@ if (process.argv.includes("__serve__")) {
         return new Response("WebSocket upgrade failed", { status: 400 });
       }
 
+      // Every socket except the health probe is authenticated at upgrade time.
+      // Browsers cannot send headers on a WebSocket handshake, so the session
+      // token travels as `?token=`; the terminal socket in particular hands out
+      // a shell, so an unauthenticated upgrade must never reach the handlers.
+      if (url.pathname.startsWith("/ws/") && !isWsUpgradeAuthorized(url)) {
+        return new Response("Unauthorized", { status: 401 });
+      }
+
       if (url.pathname === "/ws/global") {
         // App-wide event bus: owns file watching + cross-cutting broadcasts, so
-        // they no longer depend on a chat tab being mounted. Same auth as below.
-        const authConfig = configService.get("auth");
-        if (authConfig.enabled) {
-          const token = url.searchParams.get("token");
-          if (token !== authConfig.token) {
-            return new Response("Unauthorized", { status: 401 });
-          }
-        }
+        // they no longer depend on a chat tab being mounted.
         const upgraded = server.upgrade(req, { data: { type: "global" } });
         if (upgraded) return undefined;
         return new Response("WebSocket upgrade failed", { status: 400 });
       }
 
       if (url.pathname === "/ws/extensions") {
-        // Auth check for extension WS
-        const authConfig = configService.get("auth");
-        if (authConfig.enabled) {
-          const token = url.searchParams.get("token");
-          if (token !== authConfig.token) {
-            return new Response("Unauthorized", { status: 401 });
-          }
-        }
         const upgraded = server.upgrade(req, { data: { type: "extensions" } });
         if (upgraded) return undefined;
         return new Response("WebSocket upgrade failed", { status: 400 });
@@ -854,8 +859,10 @@ if (process.argv.includes("__serve__")) {
         const id = parts[5] ?? "";
 
         if (wsType === "terminal") {
+          // Optional start directory (explorer "Open in Terminal"); validated in the handler.
+          const cwd = url.searchParams.get("cwd") ?? undefined;
           const upgraded = server.upgrade(req, {
-            data: { type: "terminal", id, projectName },
+            data: { type: "terminal", id, projectName, cwd },
           });
           if (upgraded) return undefined;
           return new Response("WebSocket upgrade failed", { status: 400 });

package/src/server/middleware/auth.ts

@@ -26,10 +26,11 @@ export async function authMiddleware(c: Context, next: Next) {
   }
 
   // Fallback: ?token= query param for SSE/EventSource & iframe embeds (can't set custom headers)
-  // Scoped to /stream and /files/raw paths to avoid leaking token on all GET routes
+  // Scoped to /stream, /files/raw, /files/transcode (<video src> cannot set headers) to avoid leaking token on all GET routes
   if (c.req.method === "GET") {
     const p = c.req.path;
-    if (p.endsWith("/stream") || p.endsWith("/files/raw") || p === "/api/fs/raw" || p.endsWith("/image")) {
+    const isMediaPath = p.endsWith("/files/raw") || p.endsWith("/files/transcode") || p === "/api/fs/raw" || p === "/api/fs/transcode";
+    if (p.endsWith("/stream") || isMediaPath || p.endsWith("/image")) {
       const queryToken = c.req.query("token");
       if (queryToken && queryToken === authConfig.token) {
         return next();

package/src/server/routes/files.ts

@@ -5,6 +5,8 @@ import { fileService, SecurityError, NotFoundError, ValidationError } from "../.
 import { readSystemFileSync } from "../../services/fs-browse.service.ts";
 import { ok, err } from "../../types/api.ts";
 import { errorStatus } from "../helpers/error-status.ts";
+import { rangeFileResponse } from "../helpers/range-file-response.ts";
+import { handleMediaProbe, handleMediaTranscode } from "../helpers/media-route-handlers.ts";
 import mammoth from "mammoth";
 
 type Env = { Variables: { projectPath: string; projectName: string } };
@@ -103,16 +105,47 @@ fileRoutes.get("/raw", (c) => {
     }
     if (!existsSync(absPath)) return c.json(err("File not found"), 404);
 
-    const file = Bun.file(absPath);
     const download = c.req.query("download") === "true";
     const filename = filePath.split("/").pop() ?? "download";
 
-    return new Response(file.stream(), {
-      headers: {
-        "Content-Type": download ? "application/octet-stream" : (file.type || "application/octet-stream"),
-        "Content-Disposition": download ? `attachment; filename="${filename}"` : "inline",
-      },
-    });
+    // Range-aware so <video>/<audio>/pdf.js can seek instead of buffering the whole file.
+    return rangeFileResponse(
+      absPath,
+      c.req.raw,
+      { "Content-Disposition": download ? `attachment; filename="${filename}"` : "inline" },
+      download ? "application/octet-stream" : undefined,
+    );
+  } catch (e) {
+    return c.json(err((e as Error).message), errorStatus(e));
+  }
+});
+
+/** Resolve `?path=` inside the project or return the error response to send. */
+function resolveProjectFile(c: { get(k: "projectPath"): string; req: { query(k: string): string | undefined } }): string | Response {
+  const projectPath = c.get("projectPath");
+  const filePath = c.req.query("path");
+  if (!filePath) return Response.json(err("Missing query parameter: path"), { status: 400 });
+  const absPath = resolve(projectPath, filePath);
+  if (!absPath.startsWith(projectPath)) return Response.json(err("Access denied"), { status: 403 });
+  if (!existsSync(absPath)) return Response.json(err("File not found"), { status: 404 });
+  return absPath;
+}
+
+/** GET /files/probe?path=... — codec/duration facts + whether ffmpeg transcoding is available */
+fileRoutes.get("/probe", async (c) => {
+  try {
+    const abs = resolveProjectFile(c);
+    return abs instanceof Response ? abs : await handleMediaProbe(abs);
+  } catch (e) {
+    return c.json(err((e as Error).message), errorStatus(e));
+  }
+});
+
+/** GET /files/transcode?path=...&start=<sec> — ffmpeg → fragmented MP4 for videos the browser cannot decode */
+fileRoutes.get("/transcode", async (c) => {
+  try {
+    const abs = resolveProjectFile(c);
+    return abs instanceof Response ? abs : await handleMediaTranscode(abs, c.req.raw, c.req.query("start"));
   } catch (e) {
     return c.json(err((e as Error).message), errorStatus(e));
   }

package/src/server/routes/fs-browse.ts

@@ -21,6 +21,8 @@ import { attachmentDisposition } from "../../services/fs-ops/fs-content-disposit
 import { fsErrorBody } from "../../services/fs-ops/fs-error-response.ts";
 import { isImageExtension } from "../../shared/image-extensions.ts";
 import { ok, err } from "../../types/api.ts";
+import { rangeFileResponse } from "../helpers/range-file-response.ts";
+import { handleMediaProbe, handleMediaTranscode } from "../helpers/media-route-handlers.ts";
 import {
   createDownloadToken,
   consumeDownloadToken,
@@ -121,16 +123,52 @@ fsBrowseRoutes.get("/raw", async (c) => {
 
     const download = c.req.query("download") === "true";
     const filename = basename(resolved) || "download";
-    const file = Bun.file(resolved);
-    return new Response(file.stream(), {
-      headers: {
-        "Content-Type": download ? "application/octet-stream" : (file.type || "application/octet-stream"),
+    // Range-aware so <video>/<audio>/pdf.js can seek instead of buffering the whole file.
+    return rangeFileResponse(
+      resolved,
+      c.req.raw,
+      {
         "Content-Disposition": download ? attachmentDisposition(filename) : "inline",
         // A download is a one-shot transfer of a file the user may edit right
         // after; caching it would hand out stale bytes on the next download.
         "Cache-Control": download ? "no-store" : "private, max-age=3600",
       },
-    });
+      download ? "application/octet-stream" : undefined,
+    );
+  } catch (e) {
+    const { body, status } = fail(e);
+    return c.json(body, status);
+  }
+});
+
+/** Resolve `?path=` for media routes: allowlisted, not inside ~/.ppm, and existing. */
+async function resolveMediaPath(raw: string | undefined): Promise<string | Response> {
+  if (!raw) return Response.json(err("path is required"), { status: 400 });
+  const resolved = resolvePath(raw);
+  assertAllowed(resolved);
+  assertNotPpmDir(resolved);
+  assertNotPpmDir(await realPathOrSelf(resolved));
+  const info = await stat(resolved).catch(() => null);
+  if (!info?.isFile()) return Response.json(err("File not found"), { status: 404 });
+  return resolved;
+}
+
+/** GET /api/fs/probe?path=/some/video — codec/duration facts + whether ffmpeg transcoding is available */
+fsBrowseRoutes.get("/probe", async (c) => {
+  try {
+    const abs = await resolveMediaPath(c.req.query("path"));
+    return abs instanceof Response ? abs : await handleMediaProbe(abs);
+  } catch (e) {
+    const { body, status } = fail(e);
+    return c.json(body, status);
+  }
+});
+
+/** GET /api/fs/transcode?path=/some/video&start=<sec> — ffmpeg → fragmented MP4 */
+fsBrowseRoutes.get("/transcode", async (c) => {
+  try {
+    const abs = await resolveMediaPath(c.req.query("path"));
+    return abs instanceof Response ? abs : await handleMediaTranscode(abs, c.req.raw, c.req.query("start"));
   } catch (e) {
     const { body, status } = fail(e);
     return c.json(body, status);

package/src/server/routes/fs-upload.ts

@@ -0,0 +1,32 @@
+import { Hono, type Context } from "hono";
+import { err } from "../../types/api.ts";
+import { fsErrorBody } from "../../services/fs-ops/fs-error-response.ts";
+import { uploadFile } from "../../services/fs-ops/fs-ops-upload.service.ts";
+
+/**
+ * Streaming upload door, mounted on the same `/api/fs` prefix as the browse/mutate routes.
+ * Split out of `fs-ops.ts` because a request body stream is a very different shape of
+ * handler than the JSON in/JSON out routes there.
+ */
+export const fsUploadRoutes = new Hono();
+
+/**
+ * PUT /api/fs/upload?path=<absolute file path>&overwrite=0|1
+ *
+ * Body: the raw file bytes. Streamed straight to disk (see the service) — never buffered —
+ * so there is no per-file size limit here; the host disk is the only bound. Answers 409
+ * `EEXIST` when the target exists and `overwrite` was not set, matching every other
+ * `/api/fs` mutation's collision contract.
+ */
+fsUploadRoutes.put("/upload", async (c: Context) => {
+  try {
+    const path = c.req.query("path");
+    if (!path) return c.json(err("path is required"), 400);
+    const overwrite = c.req.query("overwrite") === "1";
+    const result = await uploadFile(path, c.req.raw.body, overwrite);
+    return c.json({ ok: true, data: result }, 201);
+  } catch (e) {
+    const { body, status } = fsErrorBody(e);
+    return c.json(body, status);
+  }
+});

package/src/server/routes/teams.ts

@@ -25,6 +25,40 @@ teamRoutes.get("/:name", async (c) => {
   return c.json(ok(detail));
 });
 
+/**
+ * Live per-member activity. Separate from `/:name` because it is polled while the
+ * panel is open, and because its source is the agent transcripts rather than the
+ * team inboxes — the inboxes cannot say who is working right now.
+ */
+teamRoutes.get("/:name/activity", async (c) => {
+  const name = c.req.param("name");
+  if (!VALID_TEAM_NAME.test(name)) return c.json(err("Invalid team name"), 400);
+  const { readTeamMemberActivity, readTeamOutboundMessages } = await import(
+    "../../services/team-member-activity/member-activity.service.ts"
+  );
+  const projectPath = c.req.query("projectPath") ?? null;
+  const [members, outbound] = await Promise.all([
+    readTeamMemberActivity(name, projectPath),
+    readTeamOutboundMessages(name, projectPath),
+  ]);
+  return c.json(ok({ members, outbound }));
+});
+
+/** Full transcript of one teammate's work session, for the member window. */
+teamRoutes.get("/:name/members/:member/transcript", async (c) => {
+  const name = c.req.param("name");
+  const member = c.req.param("member");
+  if (!VALID_TEAM_NAME.test(name)) return c.json(err("Invalid team name"), 400);
+  if (!VALID_TEAM_NAME.test(member)) return c.json(err("Invalid member name"), 400);
+  const { resolveMemberTranscript } = await import(
+    "../../services/team-member-activity/member-activity.service.ts"
+  );
+  const path = resolveMemberTranscript(name, member, c.req.query("projectPath") ?? null);
+  if (!path) return c.json(err("Member transcript not found"), 404);
+  const { parseAgentTranscript } = await import("../../services/subagent-transcript-merger.ts");
+  return c.json(ok({ member, events: parseAgentTranscript(path) }));
+});
+
 teamRoutes.delete("/:name", async (c) => {
   const name = c.req.param("name");
   if (!VALID_TEAM_NAME.test(name)) {

package/src/server/ws/chat.ts

@@ -14,6 +14,7 @@ import { backgroundShellRegistry } from "../../services/background-shell-registr
 import { basename } from "node:path";
 import { configService } from "../../services/config.service.ts";
 import { formatTurnUsageLog } from "../../shared/turn-usage.ts";
+import { isTerminalAgentStatus } from "../../shared/background-agent-status.ts";
 import { cacheReleaseDelayMs, selectWarmIdleEvictions } from "../../services/subprocess-retention.ts";
 
 /** Resolve the SESSION's provider config — not the global default provider's.
@@ -86,6 +87,8 @@ interface SessionEntry {
   teamNames: Set<string>;
   /** toolUseId of a pending TeamCreate call */
   pendingTeamCreate?: string;
+  /** Throttle marker for the filesystem probe that finds implicitly-created teams */
+  lastImplicitTeamProbe?: number;
   /** Compact indicator state — sticky until turn ends or boundary received, synced on reconnect */
   compactStatus?: "compacting" | null;
   /** toolUseIds of Bash calls launched with run_in_background — spy is kept alive for these */
@@ -268,6 +271,47 @@ function bufferAndBroadcast(sessionId: string, event: unknown): void {
   broadcast(sessionId, event);
 }
 
+/** How often a session may stat ~/.claude/teams looking for an implicit team. */
+const IMPLICIT_TEAM_PROBE_INTERVAL_MS = 3_000;
+
+/** Watch a team's inboxes and announce it to the session's clients. Idempotent. */
+async function attachTeamWatcher(sessionId: string, teamName: string): Promise<void> {
+  const entry = activeSessions.get(sessionId);
+  if (!entry || entry.teamNames.has(teamName)) return;
+  entry.teamNames.add(teamName);
+  const { startTeamInboxWatcher } = await import("./team-inbox-watcher.ts");
+  const watcher = await startTeamInboxWatcher(teamName, {
+    onInboxUpdate: (tn, agent, msgs) => broadcast(sessionId, {
+      type: "team_inbox", teamName: tn, agent, messages: msgs,
+    }),
+    onConfigUpdate: (tn, config) => broadcast(sessionId, {
+      type: "team_updated", teamName: tn, team: config,
+    }),
+  });
+  // The session may have been torn down while the watcher was starting.
+  const live = activeSessions.get(sessionId);
+  if (!live) { watcher.cleanup(); return; }
+  live.teamWatchers.set(teamName, watcher);
+  bufferAndBroadcast(sessionId, { type: "team_detected", teamName });
+  console.log(`[chat] session=${sessionId} team detected: ${teamName}`);
+}
+
+/** Attach to the team Claude Code creates implicitly for this session.
+ *  Current releases no longer expose a TeamCreate tool — a team materialises as
+ *  ~/.claude/teams/<sessionId>/inboxes/ with no tool call to hook and no
+ *  config.json, so the directory itself is the only reliable signal. */
+async function detectImplicitTeam(sessionId: string): Promise<void> {
+  const entry = activeSessions.get(sessionId);
+  if (!entry || entry.teamNames.has(sessionId)) return;
+  const now = Date.now();
+  if (entry.lastImplicitTeamProbe && now - entry.lastImplicitTeamProbe < IMPLICIT_TEAM_PROBE_INTERVAL_MS) return;
+  entry.lastImplicitTeamProbe = now;
+  try {
+    const { teamExists } = await import("./team-inbox-watcher.ts");
+    if (await teamExists(sessionId)) await attachTeamWatcher(sessionId, sessionId);
+  } catch { /* teams dir unreadable — nothing to attach */ }
+}
+
 /** Transition session phase — guards same-phase, broadcasts phase_changed */
 function setPhase(sessionId: string, phase: SessionPhase, elapsed?: number): void {
   const entry = activeSessions.get(sessionId);
@@ -435,6 +479,12 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
           const taskStatus = (ev as any).taskStatus as string | undefined;
           const taskToolUseId = (ev as any).taskToolUseId as string | undefined;
           const outputFile = (ev as any).outputFile as string | undefined;
+          // A backgrounded Agent reports its outcome only here — its tool_result was a
+          // launch ack the card must not read as "finished". Forward the terminal state so
+          // the card can settle. Harmless for background bash tasks: no card matches them.
+          if (sub === "task_notification" && taskToolUseId && isTerminalAgentStatus(taskStatus)) {
+            broadcast(sessionId, { type: "subagent_status", toolUseId: taskToolUseId, status: taskStatus });
+          }
           if (taskId) {
             // Ensure the shell is registered even if the spy missed the file (fallback).
             if (!backgroundShellRegistry.get(sessionId, taskId) && outputFile) {
@@ -555,27 +605,17 @@ async function startSessionConsumer(sessionId: string, providerId: string, conte
         if (ev.toolUseId && !entry.backgroundToolUseIds?.has(ev.toolUseId)) {
           bashOutputSpy.stopSpy(ev.toolUseId);
         }
-        // Detect team creation from TeamCreate tool_result
+        // Detect team creation from TeamCreate tool_result (legacy explicit teams)
         if (entry.pendingTeamCreate && entry.pendingTeamCreate === ev.toolUseId) {
-          const { extractTeamName, startTeamInboxWatcher } = await import("./team-inbox-watcher.ts");
+          const { extractTeamName } = await import("./team-inbox-watcher.ts");
           const teamName = extractTeamName(ev.output ?? "");
           console.log(`[chat] session=${sessionId} TeamCreate result matched, extracted teamName=${teamName}`);
-          if (teamName && !entry.teamNames.has(teamName)) {
-            entry.teamNames.add(teamName);
-            const watcher = startTeamInboxWatcher(teamName, {
-              onInboxUpdate: (tn, agent, msgs) => broadcast(sessionId, {
-                type: "team_inbox", teamName: tn, agent, messages: msgs,
-              }),
-              onConfigUpdate: (tn, config) => broadcast(sessionId, {
-                type: "team_updated", teamName: tn, team: config,
-              }),
-            });
-            entry.teamWatchers.set(teamName, watcher);
-            bufferAndBroadcast(sessionId, { type: "team_detected", teamName });
-            console.log(`[chat] session=${sessionId} team detected: ${teamName}`);
-          }
+          if (teamName) await attachTeamWatcher(sessionId, teamName);
           entry.pendingTeamCreate = undefined;
         }
+        // Implicit teams have no tool result to key off — the session's own team
+        // directory can appear after any Agent/SendMessage call, so poll (throttled).
+        void detectImplicitTeam(sessionId);
       } else if (evType === "error") {
         const errorDetail = ev.message ?? JSON.stringify(ev).slice(0, 500);
         console.error(`[chat] session=${sessionId} error: ${errorDetail}`);
@@ -787,6 +827,10 @@ export const chatWebSocket = {
       existing.clients.add(ws);
       setupClientPing(existing, ws);
 
+      // A team created in an earlier turn (or before a server restart) leaves no
+      // live event to replay — re-attach from disk so the UI comes back.
+      void detectImplicitTeam(sessionId);
+
       // Async: resolve title from SDK if in-memory title is generic (DB title takes priority)
       if (!session?.title || session.title === "Chat" || session.title === "Resumed Chat") {
         sdkListSessions({ dir: projectPath, limit: 50 }).then((sessions) => {
@@ -821,6 +865,10 @@ export const chatWebSocket = {
     activeSessions.set(sessionId, newEntry);
     setupClientPing(newEntry, ws);
 
+    // Resuming a session whose team already exists on disk (server restart, or a
+    // team created many turns ago) — re-attach the watcher.
+    void detectImplicitTeam(sessionId);
+
     ws.send(JSON.stringify({
       type: "session_state",
       sessionId,