@luuthuong/devboard 0.0.0-stage → 1.0.0

package/server-dist/server/processes.js

@@ -0,0 +1,123 @@
+// Process Manager data: tmux sessions, Claude processes, worktrees.
+// Ports process_manager.rs. Everything is best-effort — a missing tool yields
+// an empty list, not an error.
+import { IS_WINDOWS, log, run } from "./util.js";
+import { listWorktrees } from "./git.js";
+import { psmuxPath } from "./psmux.js";
+import * as tmux from "./tmux.js";
+import path from "node:path";
+/** `--session-id <id>` / `--resume <id>` (also `=`), only on a clean flag boundary. */
+export function extractSessionId(command) {
+    for (const flag of ["--session-id", "--resume"]) {
+        let from = 0;
+        for (;;) {
+            const rel = command.indexOf(flag, from);
+            if (rel < 0)
+                break;
+            const after = command.slice(rel + flag.length);
+            const next = after[0];
+            if (next !== undefined && next !== "=" && next !== " " && next !== "\t") {
+                from = rel + flag.length;
+                continue;
+            }
+            let rest = after.trimStart();
+            if (rest.startsWith("="))
+                rest = rest.slice(1);
+            const token = rest.split(/\s/)[0];
+            if (token)
+                return token;
+            from = rel + flag.length;
+        }
+    }
+    return undefined;
+}
+/** First argv token must be a Claude binary (or node running a claude cli.js). */
+export function isClaudeCommandLine(command) {
+    const argv0 = command.trim().split(/\s+/)[0] ?? "";
+    const exe = path.basename(argv0);
+    if (["claude", "claude.exe", "claude.cmd", "claude.bat"].includes(exe))
+        return true;
+    return (exe === "node" || exe === "node.exe") && command.includes("/claude/") && command.includes("cli.js");
+}
+async function windowsListClaude() {
+    // CIM gives PID + full CommandLine in one shot. The filter is deliberately
+    // narrow so an editor with "claude" in its argv can't be listed (and killed).
+    const script = `
+    Get-CimInstance Win32_Process |
+    Where-Object {
+      $_.Name -match '^claude(\\.exe|\\.cmd|\\.bat)?$' -or
+      ($_.Name -match '^node(\\.exe)?$' -and $_.CommandLine -match '[\\\\\\/]claude[\\\\\\/].*cli\\.js')
+    } |
+    ForEach-Object { "$($_.ProcessId)\`t$($_.CommandLine)" }`;
+    const r = await run("powershell", ["-NoProfile", "-NonInteractive", "-Command", script]);
+    if (!r.ok)
+        return [];
+    const out = [];
+    for (const line of r.stdout.split(/\r?\n/)) {
+        const tab = line.indexOf("\t");
+        if (tab < 0)
+            continue;
+        const pid = Number.parseInt(line.slice(0, tab).trim(), 10);
+        const command = line.slice(tab + 1).trim();
+        if (Number.isNaN(pid) || !command)
+            continue;
+        out.push({ pid, command, sessionId: extractSessionId(command) });
+    }
+    return out;
+}
+async function unixListClaude() {
+    const r = await run("ps", ["-eo", "pid,command"]);
+    if (!r.ok)
+        return [];
+    const out = [];
+    for (const line of r.stdout.split(/\r?\n/)) {
+        const m = line.trimStart().match(/^(\d+)\s+(.*)$/);
+        if (!m)
+            continue;
+        const command = m[2].trim();
+        if (!isClaudeCommandLine(command))
+            continue;
+        out.push({ pid: Number(m[1]), command, sessionId: extractSessionId(command) });
+    }
+    return out;
+}
+export const listClaudeProcesses = () => (IS_WINDOWS ? windowsListClaude() : unixListClaude());
+export async function killClaudeProcess(pid) {
+    if (!Number.isInteger(pid) || pid <= 0)
+        throw new Error("invalid pid");
+    const r = IS_WINDOWS ? await run("taskkill", ["/PID", String(pid), "/F"]) : await run("kill", ["-9", String(pid)]);
+    if (!r.ok)
+        throw new Error(r.stderr.trim() || `kill exited ${r.code}`);
+    log.info("process_manager", `killed claude pid=${pid}`);
+}
+export async function listAllWorktrees(repoRoots) {
+    const rows = [];
+    for (const root of repoRoots) {
+        try {
+            const projectName = path.basename(root.replace(/[\\/]+$/, "")) || root;
+            for (const w of await listWorktrees(root)) {
+                rows.push({ repoRoot: root, projectName, path: w.path, branch: w.branch, isMain: w.isMain });
+            }
+        }
+        catch (e) {
+            log.warn("process_manager", `list_worktrees(${root}) failed: ${e}`);
+        }
+    }
+    return rows;
+}
+export async function getProcessState(repoRoots) {
+    const [tmuxSessions, claudeProcesses, worktrees] = await Promise.all([
+        listAllTmuxSessions(),
+        listClaudeProcesses().catch(() => []),
+        listAllWorktrees(repoRoots),
+    ]);
+    return { tmuxSessions, claudeProcesses, worktrees };
+}
+/** Sessions from every multiplexer in play: psmux when installed, tmux in WSL (or native tmux elsewhere). */
+async function listAllTmuxSessions() {
+    const [psmux, native] = await Promise.all([
+        psmuxPath() ? tmux.listSessions("psmux").catch(() => []) : [],
+        tmux.listSessions("wsl").catch(() => []),
+    ]);
+    return [...psmux, ...native];
+}

package/server-dist/server/psmux.js

@@ -0,0 +1,120 @@
+// psmux (native Windows tmux) discovery + one-click install via winget.
+//
+// The installer is deliberately not parameterised: the client can only say
+// "install", never choose a package or flags, so the endpoint can't be used to
+// run arbitrary commands.
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+import { emit } from "./events.js";
+import { IS_WINDOWS, errorMessage, findOnPath, log, run } from "./util.js";
+const WINGET_ID = "marlocarlo.psmux";
+let cachedPath = null;
+let installing = false;
+/** winget edits the user PATH, which a running server never sees — look where it puts the binary. */
+function wingetCandidates() {
+    const local = process.env.LOCALAPPDATA;
+    if (!local)
+        return [];
+    const out = [path.join(local, "Microsoft", "WinGet", "Links", "psmux.exe")];
+    const pkgs = path.join(local, "Microsoft", "WinGet", "Packages");
+    try {
+        for (const d of fs.readdirSync(pkgs)) {
+            if (d.toLowerCase().startsWith("marlocarlo.psmux_"))
+                out.push(path.join(pkgs, d, "psmux.exe"));
+        }
+    }
+    catch {
+        // winget never ran
+    }
+    return out;
+}
+const isFile = (p) => {
+    try {
+        return fs.statSync(p).isFile();
+    }
+    catch {
+        return false;
+    }
+};
+/** Absolute path of psmux.exe, or null. */
+export function psmuxPath() {
+    if (!IS_WINDOWS)
+        return null;
+    if (cachedPath && isFile(cachedPath))
+        return cachedPath;
+    cachedPath = findOnPath("psmux") ?? wingetCandidates().find(isFile) ?? null;
+    return cachedPath;
+}
+export async function psmuxStatus() {
+    if (!IS_WINDOWS)
+        return { supported: false, available: false, canInstall: false, installing: false };
+    const p = psmuxPath();
+    let version;
+    if (p) {
+        const r = await run(p, ["-V"], { timeoutMs: 5_000 });
+        if (r.ok)
+            version = r.stdout
+                .split(/\r?\n/)
+                .find((l) => l.trim())
+                ?.trim();
+    }
+    return {
+        supported: true,
+        available: !!p && !!version,
+        version,
+        path: p ?? undefined,
+        canInstall: await wingetAvailable(),
+        installing,
+    };
+}
+/** winget redraws its spinner with \r and backspaces; keep only readable lines. */
+function cleanLines(chunk) {
+    return chunk
+        .replace(/\x1b\[[0-9;?]*[A-Za-z]/g, "")
+        .split(/[\r\n]+/)
+        .map((l) => l.replace(/[\b]/g, "").trim())
+        .filter((l) => l && !/^[-\\|/]$/.test(l));
+}
+/** Install psmux with winget, streaming `psmux-install-progress` events. One install at a time. */
+export async function installPsmux() {
+    if (!IS_WINDOWS)
+        throw new Error("psmux is only available on Windows");
+    if (installing)
+        throw new Error("psmux install already in progress");
+    if (!(await wingetAvailable())) {
+        throw new Error("winget was not found — install psmux manually: winget install psmux");
+    }
+    installing = true;
+    const progress = (line) => emit("psmux-install-progress", { line });
+    try {
+        log.info("psmux", "installing via winget");
+        const code = await new Promise((resolve, reject) => {
+            const child = spawn("winget", ["install", "--id", WINGET_ID, "-e", "--silent", "--accept-source-agreements", "--accept-package-agreements"], { windowsHide: true, stdio: ["ignore", "pipe", "pipe"] });
+            const onData = (d) => cleanLines(d.toString("utf8")).forEach(progress);
+            child.stdout?.on("data", onData);
+            child.stderr?.on("data", onData);
+            child.on("error", reject);
+            child.on("close", resolve);
+        });
+        cachedPath = null;
+        const status = await psmuxStatus();
+        // winget exits non-zero when the package is already installed; trust the binary instead.
+        if (!status.available)
+            throw new Error(`winget install failed (exit ${code})`);
+        log.info("psmux", `installed ${status.version ?? ""} at ${status.path}`);
+        return status;
+    }
+    catch (e) {
+        log.warn("psmux", `install failed: ${errorMessage(e)}`);
+        throw e;
+    }
+    finally {
+        installing = false;
+        emit("psmux-install-progress", { done: true });
+    }
+}
+/** winget is an app-execution alias (a reparse point), which `statSync` can't see — ask it directly. */
+async function wingetAvailable() {
+    return (await run("winget", ["--version"], { timeoutMs: 10_000 })).ok;
+}

package/server-dist/server/pty.js

@@ -0,0 +1,93 @@
+// Terminal sessions over WebSocket (replaces tauri-pty). One PTY per socket:
+// the browser sends {type:"spawn"} first, then input/resize; the server streams
+// output and reports exit. Closing the socket kills the PTY — durable sessions
+// live in tmux, which the PTY merely attaches to.
+import * as nodePty from "@lydell/node-pty";
+import { log } from "./util.js";
+const clamp = (n, fallback, max) => typeof n === "number" && Number.isFinite(n) ? Math.min(Math.max(Math.floor(n), 1), max) : fallback;
+export function handlePtySocket(ws) {
+    let pty = null;
+    // node-pty on Windows (ConPTY) corrupts the native heap if a PTY is killed
+    // twice or touched after kill(), taking the whole server down. The browser
+    // sends {type:"kill"} and then closes the socket, so kill exactly once.
+    let killed = false;
+    const killPty = () => {
+        if (!pty || killed)
+            return;
+        killed = true;
+        try {
+            pty.kill();
+        }
+        catch {
+            // already gone
+        }
+    };
+    const send = (obj) => {
+        if (ws.readyState === ws.OPEN)
+            ws.send(JSON.stringify(obj));
+    };
+    ws.on("message", (raw) => {
+        let msg;
+        try {
+            msg = JSON.parse(raw.toString());
+        }
+        catch {
+            return;
+        }
+        switch (msg.type) {
+            case "spawn": {
+                if (pty || killed)
+                    return; // one PTY per socket
+                if (typeof msg.file !== "string" || !msg.file) {
+                    send({ type: "error", message: "spawn: missing file" });
+                    return;
+                }
+                try {
+                    pty = nodePty.spawn(msg.file, Array.isArray(msg.args) ? msg.args.map(String) : [], {
+                        name: "xterm-256color",
+                        cols: clamp(msg.cols, 80, 1000),
+                        rows: clamp(msg.rows, 24, 1000),
+                        cwd: msg.cwd || undefined,
+                        env: { ...process.env, TERM: "xterm-256color" },
+                    });
+                }
+                catch (e) {
+                    log.warn("pty", `spawn ${msg.file} failed: ${e}`);
+                    send({ type: "error", message: String(e) });
+                    return;
+                }
+                const p = pty;
+                p.onData((data) => send({ type: "data", data }));
+                p.onExit(({ exitCode, signal }) => {
+                    send({ type: "exit", exitCode, signal });
+                    pty = null;
+                });
+                send({ type: "spawned", pid: p.pid });
+                break;
+            }
+            case "data":
+                if (pty && !killed && typeof msg.data === "string")
+                    pty.write(msg.data);
+                break;
+            case "resize":
+                if (pty && !killed) {
+                    try {
+                        pty.resize(clamp(msg.cols, 80, 1000), clamp(msg.rows, 24, 1000));
+                    }
+                    catch {
+                        // resize after exit
+                    }
+                }
+                break;
+            case "kill":
+                killPty();
+                break;
+        }
+    });
+    const cleanup = () => {
+        killPty();
+        pty = null;
+    };
+    ws.on("close", cleanup);
+    ws.on("error", cleanup);
+}

package/server-dist/server/remote.js

@@ -0,0 +1,216 @@
+// Remote execution: the remote-shell wrapper, SSH status files and the Mutagen
+// sync adapter. Ports remote_shell.rs, remote_status.rs and mutagen.rs.
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { IS_WINDOWS, findOnPath, devboardDataDir, run } from "./util.js";
+const here = path.dirname(fileURLToPath(import.meta.url));
+/** Git-for-Windows bash: PATH first, then the two installer locations. */
+export function findBash() {
+    const onPath = findOnPath("bash");
+    if (onPath)
+        return onPath;
+    if (!IS_WINDOWS)
+        return null;
+    return ([String.raw `C:\Program Files\Git\bin\bash.exe`, String.raw `C:\Program Files (x86)\Git\bin\bash.exe`].find((p) => fs.existsSync(p)) ?? null);
+}
+export const findMutagen = () => findOnPath("mutagen");
+export function prereqs() {
+    const mutagenPath = findMutagen();
+    const bashPath = findBash();
+    return {
+        mutagenAvailable: !!mutagenPath,
+        bashAvailable: !!bashPath,
+        sshAvailable: !!findOnPath("ssh"),
+        mutagenPath: mutagenPath ?? undefined,
+        bashPath: bashPath ?? undefined,
+    };
+}
+// ── Remote shell wrapper ─────────────────────────────────────────────────────
+const remoteDir = () => path.join(devboardDataDir(), "remote");
+/** `C:\Users\foo` → `/c/Users/foo` (Git-for-Windows bash form). */
+export function toPosixPath(win) {
+    const n = win.replaceAll("\\", "/");
+    return /^[A-Za-z]:/.test(n) ? `/${n[0].toLowerCase()}${n.slice(2)}` : n;
+}
+function renderScript() {
+    const template = fs.readFileSync(path.join(here, "assets", "remote-shell.sh"), "utf8");
+    return template
+        .replace("@@CONFIG_FILE@@", toPosixPath(path.join(devboardDataDir(), "settings.json")))
+        .replace("@@STATUS_DIR@@", toPosixPath(remoteDir()));
+}
+/** Write the wrapper plus same-content `bash`/`zsh` copies (assistants that
+ *  hardcode either shell name pick up the wrapper). Idempotent. */
+export async function deployRemoteShell() {
+    const dir = remoteDir();
+    await fs.promises.mkdir(dir, { recursive: true });
+    const script = renderScript();
+    for (const name of ["remote-shell.sh", "bash", "zsh"]) {
+        await fs.promises.writeFile(path.join(dir, name), script, { mode: 0o755 });
+    }
+}
+/** Polls `remote/status-<host>.json` files written by the wrapper script. */
+export class RemoteStatusWatcher {
+    stateDir = remoteDir();
+    known = new Map();
+    /** Changes since the last poll. First sight of an offline host counts. */
+    async poll() {
+        let names;
+        try {
+            names = await fs.promises.readdir(this.stateDir);
+        }
+        catch {
+            return [];
+        }
+        const changes = [];
+        for (const name of names) {
+            if (!name.startsWith("status-") || !name.endsWith(".json"))
+                continue;
+            const host = name.slice("status-".length, -".json".length);
+            if (!host)
+                continue;
+            let json;
+            try {
+                json = JSON.parse(await fs.promises.readFile(path.join(this.stateDir, name), "utf8"));
+            }
+            catch {
+                continue;
+            }
+            const status = json?.status;
+            if (typeof status !== "string")
+                continue;
+            const prev = this.known.get(host);
+            this.known.set(host, status);
+            const changed = prev === undefined ? status === "offline" : prev !== status;
+            if (changed) {
+                changes.push({
+                    host,
+                    online: status === "online",
+                    since: typeof json.since === "string" ? json.since : undefined,
+                });
+            }
+        }
+        return changes;
+    }
+}
+// ── Mutagen ──────────────────────────────────────────────────────────────────
+export const defaultIgnores = () => [
+    "node_modules",
+    ".venv",
+    ".cache",
+    "dist",
+    ".next*",
+    "__pycache__",
+    ".pytest_cache",
+    ".mypy_cache",
+    ".turbo",
+    "*.pyc",
+    ".DS_Store",
+    "coverage",
+    ".nyc_output",
+    "target",
+    "build",
+    ".build",
+    ".swiftpm",
+];
+const LABEL = "devboard=true";
+const SESSION_NAME = "devboard-sync";
+export const disabledStatus = () => ({ kind: "disabled", conflictCount: 0 });
+async function mutagen(args) {
+    const bin = findMutagen();
+    if (!bin)
+        throw new Error("mutagen not on PATH");
+    return run(bin, args);
+}
+export async function ensureDaemon() {
+    const bin = findMutagen();
+    if (bin)
+        await run(bin, ["daemon", "start"]);
+}
+export async function startSync(localPath, host, remotePath, ignores) {
+    const list = await mutagen(["sync", "list", "--label-selector", LABEL]).catch(() => null);
+    if (list?.ok && list.stdout.includes("Name:")) {
+        await flushSync().catch(() => { });
+        return;
+    }
+    const args = [
+        "sync",
+        "create",
+        localPath,
+        `${host}:${remotePath}`,
+        "--name",
+        SESSION_NAME,
+        "--label",
+        LABEL,
+        "--sync-mode",
+        "two-way-resolved",
+        "--default-file-mode-beta",
+        "0644",
+        "--default-directory-mode-beta",
+        "0755",
+        ...ignores.flatMap((p) => ["--ignore", p]),
+    ];
+    const r = await mutagen(args);
+    if (!r.ok)
+        throw new Error(`mutagen sync create failed: ${r.stderr}`);
+}
+export async function stopSync() {
+    const r = await mutagen(["sync", "terminate", "--label-selector", LABEL]);
+    if (!r.ok)
+        throw new Error(`mutagen sync terminate failed: ${r.stderr}`);
+}
+export async function resetSync() {
+    await mutagen(["sync", "pause", "--label-selector", LABEL]).catch(() => { });
+    const r = await mutagen(["sync", "resume", "--label-selector", LABEL]);
+    if (!r.ok)
+        throw new Error(`mutagen sync resume failed: ${r.stderr}`);
+}
+export async function flushSync() {
+    const r = await mutagen(["sync", "flush", "--label-selector", LABEL]);
+    if (!r.ok)
+        throw new Error(`mutagen sync flush failed: ${r.stderr}`);
+}
+export async function syncStatus() {
+    if (!findMutagen())
+        return disabledStatus();
+    const template = "{{range .}}{{.Name}}|{{.Status}}|{{len .Conflicts}}|{{.Paused}}\n{{end}}";
+    const r = await mutagen(["sync", "list", "--label-selector", LABEL, "--template", template]).catch(() => null);
+    if (!r?.ok || !r.stdout.trim())
+        return disabledStatus();
+    for (const line of r.stdout.split(/\r?\n/)) {
+        const parts = line.split("|");
+        if (parts.length < 4)
+            continue;
+        const [name, statusRaw, conflictsRaw, pausedRaw] = [
+            parts[0],
+            parts[1].toLowerCase(),
+            parts[2],
+            parts.slice(3).join("|"),
+        ];
+        const conflicts = Number.parseInt(conflictsRaw, 10) || 0;
+        let kind;
+        if (pausedRaw.trim() === "true")
+            kind = "paused";
+        else if (conflicts > 0)
+            kind = "conflicts";
+        else if (statusRaw === "watching")
+            kind = "watching";
+        else if (statusRaw === "scanning")
+            kind = "scanning";
+        else if (["staging", "transitioning", "reconciling", "saving"].includes(statusRaw))
+            kind = "staging";
+        else if (statusRaw === "halted")
+            kind = "paused";
+        else
+            kind = "error";
+        return { kind, sessionName: name, conflictCount: conflicts, message: statusRaw };
+    }
+    return disabledStatus();
+}
+export async function rawSyncStatus() {
+    const r = await mutagen(["sync", "list", "-l"]);
+    const out = r.stdout.trim();
+    if (!r.ok && !out)
+        throw new Error(`mutagen sync list failed: ${r.stderr}`);
+    return out || "No sync sessions running.";
+}

package/server-dist/server/sessionReaper.js

@@ -0,0 +1,101 @@
+// Housekeeping for durable terminal sessions (psmux / tmux). Cards leave a
+// `devboard-<cardId>` session behind when their drawer closes; this closes the
+// ones nobody is using, per the user's Settings → Terminal sessions limits.
+//
+// A session is never touched while a client is attached or Claude is working.
+import { psmuxPath } from "./psmux.js";
+import * as tmux from "./tmux.js";
+import { IS_WINDOWS, log } from "./util.js";
+const PREFIX = "devboard-";
+/** First/last time the reaper saw a session; stands in for "when the user detached". */
+const firstSeen = new Map();
+const lastAttached = new Map();
+const key = (backend, name) => `${backend}:${name}`;
+/** Session names for a card's drawer. */
+export const cardSessionName = (cardId) => `${PREFIX}${cardId}`;
+/** Close a card's terminal session; best-effort so deleting a card never fails on it. */
+export async function killCardSession(ctx, cardId) {
+    const card = ctx.board.cards.find((c) => c.id === cardId);
+    const runtime = card?.link.cardRuntime;
+    const backend = runtime === "windows" ? "psmux" : "wsl";
+    // Don't boot WSL just to find out there's nothing to kill.
+    if (backend === "wsl" && IS_WINDOWS && runtime !== "wsl")
+        return;
+    try {
+        await tmux.killSession(cardSessionName(cardId), backend);
+    }
+    catch (e) {
+        log.warn("sessions", `kill ${cardSessionName(cardId)} failed: ${e}`);
+    }
+}
+async function collect(ctx) {
+    const backends = [];
+    if (psmuxPath())
+        backends.push("psmux");
+    // On Windows only look inside WSL when a card actually uses it.
+    if (!IS_WINDOWS || ctx.board.cards.some((c) => c.link.cardRuntime === "wsl"))
+        backends.push("wsl");
+    const now = Date.now();
+    const cardsById = new Map(ctx.board.cards.map((c) => [c.id, c]));
+    const out = [];
+    for (const backend of backends) {
+        for (const s of await tmux.listSessions(backend).catch(() => [])) {
+            if (!s.name.startsWith(PREFIX))
+                continue; // the user's own sessions are not ours to close
+            const k = key(backend, s.name);
+            if (!firstSeen.has(k))
+                firstSeen.set(k, now);
+            if (s.attached)
+                lastAttached.set(k, now);
+            const card = cardsById.get(s.name.slice(PREFIX.length));
+            const lastActivity = card?.link.lastActivity ? Date.parse(card.link.lastActivity) : 0;
+            out.push({
+                name: s.name,
+                backend,
+                idleSince: Math.max(Number.isNaN(lastActivity) ? 0 : lastActivity, s.createdAt * 1000, lastAttached.get(k) ?? 0, firstSeen.get(k) ?? now),
+                protectedNow: s.attached || card?.activityState === "activelyWorking",
+            });
+        }
+    }
+    // Forget sessions that are gone.
+    const live = new Set(out.map((c) => key(c.backend, c.name)));
+    for (const m of [firstSeen, lastAttached])
+        for (const k of m.keys())
+            if (!live.has(k))
+                m.delete(k);
+    return out;
+}
+export async function reapSessions(ctx) {
+    const cfg = (await ctx.settings.read()).terminalSessions ?? { idleMinutes: 30, maxSessions: 8 };
+    if (cfg.idleMinutes <= 0 && cfg.maxSessions <= 0)
+        return;
+    let sessions = await collect(ctx);
+    const now = Date.now();
+    const kill = async (c, why) => {
+        try {
+            await tmux.killSession(c.name, c.backend);
+            log.info("sessions", `closed ${c.name} (${why})`);
+            firstSeen.delete(key(c.backend, c.name));
+            lastAttached.delete(key(c.backend, c.name));
+            sessions = sessions.filter((s) => s !== c);
+        }
+        catch (e) {
+            log.warn("sessions", `close ${c.name} failed: ${e}`);
+        }
+    };
+    if (cfg.idleMinutes > 0) {
+        for (const c of [...sessions]) {
+            if (!c.protectedNow && now - c.idleSince > cfg.idleMinutes * 60_000) {
+                await kill(c, `idle ${Math.round((now - c.idleSince) / 60_000)} min`);
+            }
+        }
+    }
+    if (cfg.maxSessions > 0 && sessions.length > cfg.maxSessions) {
+        const evictable = sessions.filter((s) => !s.protectedNow).sort((a, b) => a.idleSince - b.idleSince);
+        for (const c of evictable) {
+            if (sessions.length <= cfg.maxSessions)
+                break;
+            await kill(c, `over the ${cfg.maxSessions}-session limit`);
+        }
+    }
+}