@openchambery/web 2.0.0-beta.1 → 2.0.0-beta.10

package/server/index.js

@@ -39,6 +39,7 @@ import { resolveOpenCodeEnvConfig } from './lib/opencode/env-config.js';
 import { createHmrStateRuntime } from './lib/opencode/hmr-state-runtime.js';
 import { createOpenCodeNetworkRuntime } from './lib/opencode/network-runtime.js';
 import { createOpenCodeAuthStateRuntime } from './lib/opencode/auth-state-runtime.js';
+import { createSharedOpenCodeService, isSharedServiceEnabled } from './lib/opencode/shared-service.js';
 import { createProjectDirectoryRuntime } from './lib/opencode/project-directory-runtime.js';
 import { createSettingsNormalizationRuntime } from './lib/opencode/settings-normalization-runtime.js';
 import { createSettingsHelpers } from './lib/opencode/settings-helpers.js';
@@ -52,6 +53,11 @@ import {
 } from './lib/opencode/core-routes.js';
 import { registerOpenChamberRoutes } from './lib/opencode/openchamber-routes.js';
 import { createServerUtilsRuntime } from './lib/opencode/server-utils-runtime.js';
+import {
+  configureServerOpenCodeFetchGate,
+  createServerOpenCodeFetch,
+  wrapFetchWithRuntimeContractGate,
+} from './lib/opencode/server-opencode-fetch.js';
 import { createStaticRoutesRuntime } from './lib/opencode/static-routes-runtime.js';
 import { createSettingsRuntime } from './lib/opencode/settings-runtime.js';
 import { createOpenCodeResolutionRuntime } from './lib/opencode/opencode-resolution-runtime.js';
@@ -59,6 +65,7 @@ import { createBootstrapRuntime } from './lib/opencode/bootstrap-runtime.js';
 import { createSessionRuntime } from './lib/opencode/session-runtime.js';
 import { createOpenCodeWatcherRuntime } from './lib/opencode/watcher.js';
 import { createSessionTitleRuntime } from './lib/session-title/runtime.js';
+import { createTitleSessionAccess } from './lib/session-title/session-access.js';
 import { createSessionIndexService } from './lib/session-index/service.js';
 import { createSessionIndexSyncRuntime } from './lib/session-index/sync-runtime.js';
 import { resolveSessionIndexDbPath } from './lib/session-index/resolve-db-path.js';
@@ -68,8 +75,24 @@ import { resolveTranscriptCacheDbPath } from './lib/transcript-cache/resolve-db-
 import { createMessageQueueRuntime } from './lib/message-queue/runtime.js';
 import { resolveMessageQueueDbPath } from './lib/message-queue/resolve-db-path.js';
 import { createOpenChamberEventBroadcaster } from './lib/opencode/feature-routes-runtime.js';
-import { createSessionGoalRuntime } from './lib/session-goal/runtime.js';
+import {
+  createSessionGoalRuntime,
+  withGoalExecutionGeneration,
+} from './lib/session-goal/runtime.js';
 import { createSessionMetadataStore } from './lib/session-metadata/session-metadata-store.js';
+import {
+  createHttpSessionRecordClient,
+  retainOpenCodeSessions,
+  startSideStoreMigration,
+} from './lib/session-metadata/opencode-session-record.js';
+import {
+  createSessionArchiveService,
+  createUpstreamSessionFetcher,
+} from './lib/session-metadata/session-archive.js';
+import {
+  projectSessionLifecyclePayload,
+  projectSessionWithStoredMap,
+} from './lib/session-metadata/session-projection.js';
 import { createScheduledTasksRuntime } from './lib/scheduled-tasks/runtime.js';
 import { createScheduledTaskRunHistoryStore } from './lib/scheduled-tasks/run-history-store.js';
 import { createServerStartupRuntime } from './lib/opencode/server-startup-runtime.js';
@@ -89,6 +112,7 @@ import { createNotificationTemplateRuntime } from './lib/notifications/template-
 import { createPermissionAutoAcceptRuntime } from './lib/permission-auto-accept/runtime.js';
 import { createQuestionAutoDelegateRuntime } from './lib/question-auto-delegate/runtime.js';
 import { createGracefulShutdownRuntime } from './lib/opencode/shutdown-runtime.js';
+import { attachHttpServerConnectionTracker } from './lib/opencode/http-server-connections.js';
 import { createProjectConfigRuntime } from './lib/projects/project-config.js';
 import { createRemoteClientAuthRuntime } from './lib/client-auth/remote-clients.js';
 import { applyRuntimeCorsHeaders } from './lib/request-cors.js';
@@ -447,6 +471,11 @@ let lastOpenCodeError = null;
 let lastOpenCodeLaunchDiagnostics = null;
 let isOpenCodeReady = false;
 let v1Migration = null;
+let openCodeServeVersion = null;
+let openCodeCliVersion = null;
+let runtimeContract = null;
+/** Bumps on start/restart so stale async health cannot re-permit an old instance. */
+let runtimeContractGeneration = 0;
 let openCodeNotReadySince = 0;
 let isExternalOpenCode = false;
 let exitOnShutdown = true;
@@ -551,6 +580,7 @@ const openCodeAuthStateRuntime = createOpenCodeAuthStateRuntime({
 const getOpenCodeAuthHeaders = (...args) => openCodeAuthStateRuntime.getOpenCodeAuthHeaders(...args);
 const isOpenCodeConnectionSecure = (...args) => openCodeAuthStateRuntime.isOpenCodeConnectionSecure(...args);
 const ensureLocalOpenCodeServerPassword = (...args) => openCodeAuthStateRuntime.ensureLocalOpenCodeServerPassword(...args);
+const adoptOpenCodeServerPassword = (...args) => openCodeAuthStateRuntime.adoptOpenCodeServerPassword(...args);
 
 const openCodeNetworkState = {};
 Object.defineProperties(openCodeNetworkState, {
@@ -574,6 +604,15 @@ const buildOpenCodeUrl = (...args) => openCodeNetworkRuntime.buildOpenCodeUrl(..
 const ensureOpenCodeApiPrefix = (...args) => openCodeNetworkRuntime.ensureOpenCodeApiPrefix(...args);
 const scheduleOpenCodeApiDetection = (...args) => openCodeNetworkRuntime.scheduleOpenCodeApiDetection(...args);
 
+// Host OpenCode transport gate (queue/goal/scheduled/assistants + v2-client).
+// Registered before background runtimes so direct OpenCode writes share proxy admission.
+configureServerOpenCodeFetchGate(() => runtimeContract);
+const serverOpenCodeFetch = createServerOpenCodeFetch({
+  buildOpenCodeUrl,
+  getOpenCodeAuthHeaders,
+  getRuntimeContract: () => runtimeContract,
+});
+
 const ENV_CONFIGURED_API_PREFIX = normalizeApiPrefix(
   process.env.OPENCODE_API_PREFIX || process.env.OPENCHAMBER_API_PREFIX || ''
 );
@@ -624,6 +663,7 @@ const searchPathFor = (...args) => openCodeEnvRuntime.searchPathFor(...args);
 const resolveGitBinaryForSpawn = (...args) => openCodeEnvRuntime.resolveGitBinaryForSpawn(...args);
 const resolveManagedOpenCodeLaunchSpec = (...args) => openCodeEnvRuntime.resolveManagedOpenCodeLaunchSpec(...args);
 const clearResolvedOpenCodeBinary = (...args) => openCodeEnvRuntime.clearResolvedOpenCodeBinary(...args);
+const forceResolvedOpenCodeBinary = (...args) => openCodeEnvRuntime.forceResolvedOpenCodeBinary(...args);
 const openCodeResolutionRuntime = createOpenCodeResolutionRuntime({
   path,
   resolveOpencodeCliPath,
@@ -699,6 +739,8 @@ const getSmallModelService = async () => {
     smallModelServiceInstance = createSmallModelService({
       buildOpenCodeUrl,
       getOpenCodeAuthHeaders,
+      persistSessionMetadata: persistSessionMetadataToStore,
+      onSystemSessionPersisted: hideSystemSessionFromIndex,
     });
   }
   return smallModelServiceInstance;
@@ -708,6 +750,19 @@ const sessionTitleRuntime = createSessionTitleRuntime({
   buildOpenCodeUrl,
   getOpenCodeAuthHeaders,
   getSmallModelService,
+  serverOpenCodeFetch,
+  sessionAccess: createTitleSessionAccess({
+    buildOpenCodeUrl,
+    getOpenCodeAuthHeaders,
+    readSessionMetadata: (sessionID) => sessionMetadataStore.get(sessionID),
+    persistSessionMetadata: (sessionID, patch) => persistSessionMetadataToStore(sessionID, patch),
+    publishSession: (session, directory) => {
+      const payload = { type: 'session.updated', properties: { info: session, directory } };
+      broadcastGlobalUiEvent(payload);
+      const changed = sessionIndexServiceRef?.upsertAndReportChange(session);
+      if (changed) sessionIndexSyncRuntimeRef?.publishChange();
+    },
+  }),
 });
 
 // Forward declaration: question auto-delegate is created after the event hub;
@@ -716,11 +771,141 @@ let questionAutoDelegateRuntime = null;
 /** Filled inside main() once the SQLite session index is constructed. */
 let sessionIndexServiceRef = null;
 
-const sessionMetadataStore = createSessionMetadataStore({ dataDir: OPENCHAMBER_DATA_DIR });
+const sessionRecordClient = createHttpSessionRecordClient({
+  buildSessionUrl: (sessionID, directory) => {
+    const url = new URL(buildOpenCodeUrl(`/session/${encodeURIComponent(sessionID)}`));
+    if (directory) url.searchParams.set('directory', directory);
+    return url.toString();
+  },
+  getHeaders: () => getOpenCodeAuthHeaders(),
+  fetchFn: wrapFetchWithRuntimeContractGate(fetch),
+});
+const sessionMetadataStore = createSessionMetadataStore({
+  dataDir: OPENCHAMBER_DATA_DIR,
+  recordReader: (sessionID, directory) => sessionRecordClient.read(sessionID, directory),
+  recordWriter: (sessionID, metadata, directory) => sessionRecordClient.write({
+    sessionID,
+    metadata,
+    directory,
+  }),
+});
+const stopSessionRecordMigration = startSideStoreMigration({
+  load: () => sessionMetadataStore.load(),
+  readSession: (sessionID) => sessionRecordClient.read(sessionID),
+  writeMetadata: async (sessionID, metadata, record) => {
+    const directory = record?.location?.directory || record?.directory || undefined;
+    await sessionRecordClient.write({ sessionID, metadata, directory });
+  },
+});
+/**
+ * load() resolves `{ ok:false }` on read/corrupt failure (does not reject).
+ * Callers must check ok / isLoaded — never treat unresolved as empty success.
+ */
+const ensureSessionMetadataReady = async () => {
+  try {
+    const result = await sessionMetadataStore.load();
+    return result?.ok === true && sessionMetadataStore.isLoaded();
+  } catch (error) {
+    console.warn('[session-metadata] load threw:', error?.message ?? error);
+    return false;
+  }
+};
+// Prime without blocking module init; production gates (hub/SSE/routes) await ready.
+void ensureSessionMetadataReady().then((ok) => {
+  if (!ok) {
+    console.warn(
+      '[session-metadata] initial load not ready:',
+      sessionMetadataStore.getLoadFailureReason?.() || 'unknown',
+    );
+  }
+});
+
+/**
+ * Goal write through the Host metadata store.
+ * Advances executionGeneration on pause/resume/condition changes so late audits
+ * cannot commit against a prior execution permit. Broadcasts only after commit.
+ */
+const persistSessionGoalToStore = async (sessionId, _directory, goal) => {
+  const result = await sessionMetadataStore.mutateSessionMetadata(sessionId, (current) => {
+    const previousGoal = current?.openchamber?.goal && typeof current.openchamber.goal === 'object'
+      ? current.openchamber.goal
+      : null;
+    const nextGoal = withGoalExecutionGeneration(previousGoal, goal);
+    return { ok: true, patch: { openchamber: { goal: nextGoal } } };
+  });
+  if (!result?.committed) {
+    throw new Error(result?.reason || 'session goal persist was rejected');
+  }
+  const metadata = result.metadata;
+  try {
+    broadcastGlobalUiEvent({
+      type: 'openchamber:session-metadata',
+      properties: { sessionID: sessionId, metadata },
+    });
+  } catch (error) {
+    console.warn('[session-metadata] broadcast failed:', error?.message ?? error);
+  }
+  return metadata;
+};
+
+/**
+ * Isolation / Host metadata write. Same store + broadcast seam as goal persist.
+ * Callers pass an RFC 7386 merge patch; the store returns the committed object.
+ */
+const persistSessionMetadataToStore = async (sessionId, patch) => {
+  const metadata = await sessionMetadataStore.setSessionMetadata(sessionId, patch);
+  try {
+    broadcastGlobalUiEvent({
+      type: 'openchamber:session-metadata',
+      properties: { sessionID: sessionId, metadata },
+    });
+  } catch (error) {
+    console.warn('[session-metadata] broadcast failed:', error?.message ?? error);
+  }
+  return metadata;
+};
+
+/**
+ * After Host isolation metadata is committed, drop the session from the
+ * sidebar index immediately. Do not wait for the next directory list sync.
+ * Reads refs at call time — scheduled-task runtime is constructed before main().
+ */
+const hideSystemSessionFromIndex = ({ sessionID, directory, metadata } = {}) => {
+  if (!sessionIndexServiceRef || typeof sessionID !== 'string' || !sessionID) return;
+  const changed = sessionIndexServiceRef.upsertAndReportChange({
+    id: sessionID,
+    directory: directory || '',
+    metadata,
+  });
+  if (changed) {
+    sessionIndexSyncRuntimeRef?.publishChange();
+  }
+};
+
+/** Filled in main() once the session index + broadcast sinks exist. */
+let sessionArchiveServiceRef = null;
+let sessionIndexSyncRuntimeRef = null;
+
+const readHostMetadataForSession = (sessionID) => {
+  const snap = sessionMetadataStore.getSnapshotSync();
+  if (!snap || typeof sessionID !== 'string') return null;
+  const host = snap[sessionID];
+  return host && typeof host === 'object' && !Array.isArray(host) ? host : null;
+};
+
+const projectHostSessionPayload = (payload) => {
+  const ready = sessionMetadataStore.isLoaded();
+  return projectSessionLifecyclePayload(
+    payload,
+    readHostMetadataForSession,
+    { hostReady: ready },
+  );
+};
 
 const sessionGoalRuntime = createSessionGoalRuntime({
   buildOpenCodeUrl,
   getOpenCodeAuthHeaders,
+  serverOpenCodeFetch,
   getSmallModelService,
   shouldKeepGoalActiveForQuestion: (sessionId) => (
     questionAutoDelegateRuntime?.isAutoHandling(sessionId) === true
@@ -732,21 +917,26 @@ const sessionGoalRuntime = createSessionGoalRuntime({
     questionAutoDelegateRuntime?.pauseForSessionTree?.(sessionId, directory)
   ),
   readSessionMetadata: (sessionId) => sessionMetadataStore.get(sessionId),
-  persistSessionGoal: async (sessionId, _directory, goal) => {
-    const metadata = await sessionMetadataStore.setSessionMetadata(sessionId, {
-      openchamber: { goal },
-    });
-    // Broadcast only. Feeding this write back into processPayload would re-arm
-    // the loop the runtime is already inside.
-    try {
-      broadcastGlobalUiEvent({
-        type: 'openchamber:session-metadata',
-        properties: { sessionID: sessionId, metadata },
-      });
-    } catch (error) {
-      console.warn('[session-metadata] broadcast failed:', error?.message ?? error);
+  // Conditional commit on the store's exclusive serial boundary (generation +
+  // status preconditions share the lock with persist). Broadcast-only on
+  // success — do not feed progress writes back into processPayload.
+  mutateSessionMetadata: async (sessionId, decide) => {
+    const result = await sessionMetadataStore.mutateSessionMetadata(sessionId, decide);
+    if (result?.committed) {
+      try {
+        broadcastGlobalUiEvent({
+          type: 'openchamber:session-metadata',
+          properties: { sessionID: sessionId, metadata: result.metadata },
+        });
+      } catch (error) {
+        console.warn('[session-metadata] broadcast failed:', error?.message ?? error);
+      }
     }
-    return goal;
+    return result;
+  },
+  persistSessionGoal: async (sessionId, directory, goal) => {
+    const metadata = await persistSessionGoalToStore(sessionId, directory, goal);
+    return metadata?.openchamber?.goal ?? goal;
   },
   emitGoalNotification: async ({ sessionId, directory, status, goal }) => {
     // The goal settle notification replaces the per-turn ready notifications
@@ -788,6 +978,7 @@ const globalMessageStreamHub = createGlobalMessageStreamHub({
   buildOpenCodeUrl,
   getOpenCodeAuthHeaders,
   upstreamStallTimeoutMs: getUpstreamStallTimeoutMs,
+  projectOutboundSessionPayload: projectHostSessionPayload,
 });
 
 const permissionAutoAcceptRuntime = createPermissionAutoAcceptRuntime({
@@ -930,6 +1121,9 @@ const serverUtilsRuntime = createServerUtilsRuntime({
     openCodeNotReadySince,
     isOpenCodeReady,
     isRestartingOpenCode,
+    v1Migration,
+    runtimeContract,
+    openCodeServeVersion,
   }),
   getOpenCodeAuthHeaders,
   buildOpenCodeUrl,
@@ -957,6 +1151,12 @@ const serverUtilsRuntime = createServerUtilsRuntime({
     return snapshot.PATH;
   },
   getStoredSessionMetadata: () => sessionMetadataStore.getAll(),
+  getStoredSessionMetadataSync: () => sessionMetadataStore.getSnapshotSync(),
+  ensureSessionMetadataReady,
+  onSessionDeleted: (sessionID) => {
+    if (!sessionArchiveServiceRef) return sessionMetadataStore.removeSession(sessionID);
+    return sessionArchiveServiceRef.forgetSession(sessionID);
+  },
 });
 
 const setOpenCodePort = (...args) => serverUtilsRuntime.setOpenCodePort(...args);
@@ -1027,6 +1227,13 @@ Object.defineProperties(openCodeLifecycleState, {
   lastOpenCodeLaunchDiagnostics: { get: () => lastOpenCodeLaunchDiagnostics, set: (value) => { lastOpenCodeLaunchDiagnostics = value; } },
   isOpenCodeReady: { get: () => isOpenCodeReady, set: (value) => { isOpenCodeReady = value; } },
   v1Migration: { get: () => v1Migration, set: (value) => { v1Migration = value; } },
+  openCodeServeVersion: { get: () => openCodeServeVersion, set: (value) => { openCodeServeVersion = value; } },
+  openCodeCliVersion: { get: () => openCodeCliVersion, set: (value) => { openCodeCliVersion = value; } },
+  runtimeContract: { get: () => runtimeContract, set: (value) => { runtimeContract = value; } },
+  runtimeContractGeneration: {
+    get: () => runtimeContractGeneration,
+    set: (value) => { runtimeContractGeneration = value; },
+  },
   openCodeNotReadySince: { get: () => openCodeNotReadySince, set: (value) => { openCodeNotReadySince = value; } },
   isExternalOpenCode: { get: () => isExternalOpenCode, set: (value) => { isExternalOpenCode = value; } },
   isShuttingDown: { get: () => isShuttingDown, set: (value) => { isShuttingDown = value; } },
@@ -1073,6 +1280,8 @@ const openCodeLifecycleRuntime = createOpenCodeLifecycleRuntime({
   ensureOpencodeCliEnv,
   ensurePinnedOpenCode2CliEnv,
   ensureLocalOpenCodeServerPassword,
+  adoptOpenCodeServerPassword,
+  sharedService: isSharedServiceEnabled() ? createSharedOpenCodeService() : null,
   resolveManagedOpenCodeLaunchSpec,
   setOpenCodePort,
   setDetectedOpenCodeApiPrefix,
@@ -1128,20 +1337,9 @@ const scheduledTasksRuntime = createScheduledTasksRuntime({
   runHistoryStore: scheduledTaskRunHistoryStore,
   // Same Host store seam as session-goal / manual UI metadata writes.
   readSessionMetadata: (sessionId) => sessionMetadataStore.get(sessionId),
-  persistSessionGoal: async (sessionId, _directory, goal) => {
-    const metadata = await sessionMetadataStore.setSessionMetadata(sessionId, {
-      openchamber: { goal },
-    });
-    try {
-      broadcastGlobalUiEvent({
-        type: 'openchamber:session-metadata',
-        properties: { sessionID: sessionId, metadata },
-      });
-    } catch (error) {
-      console.warn('[session-metadata] broadcast failed:', error?.message ?? error);
-    }
-    return metadata;
-  },
+  persistSessionMetadata: persistSessionMetadataToStore,
+  onSystemSessionPersisted: hideSystemSessionFromIndex,
+  persistSessionGoal: persistSessionGoalToStore,
   // Arm the goal loop after first persist only — do not feed progress writes
   // back through processPayload (session-goal runtime already broadcasts those).
   onGoalPersisted: ({ sessionID, directory, metadata }) => {
@@ -1183,7 +1381,19 @@ const ensureGlobalWatcherStarted = async () => {
     return globalWatcherStartPromise;
   }
 
-  globalWatcherStartPromise = openCodeWatcherRuntime.start().catch((error) => {
+  // Await Host metadata ready before the internal hub attaches upstream SSE so
+  // session lifecycle frames are projected (not dropped) from the first event.
+  globalWatcherStartPromise = (async () => {
+    const ready = await ensureSessionMetadataReady();
+    if (!ready) {
+      const reason = sessionMetadataStore.getLoadFailureReason?.() || 'not ready';
+      const error = new Error(`session metadata unavailable before global watcher start: ${reason}`);
+      error.code = 'session_metadata_unavailable';
+      error.retryable = true;
+      throw error;
+    }
+    return openCodeWatcherRuntime.start();
+  })().catch((error) => {
     globalWatcherStartPromise = null;
     throw error;
   });
@@ -1193,15 +1403,30 @@ const ensureGlobalWatcherStarted = async () => {
 
 const completeOpenCodeStartup = () => {
   scheduleOpenCodeApiDetection();
-  if (openCodeLifecycleState.openCodeProcess && !openCodeLifecycleState.isExternalOpenCode) {
+  if (
+    (openCodeLifecycleState.openCodeProcess && !openCodeLifecycleState.isExternalOpenCode)
+    || openCodeLifecycleRuntime.isSharedOpenCodeService()
+  ) {
     startHealthMonitoring();
   }
   // The global watcher used to start only for desktop notifications; session-title
   // and session-goal also ride its event hub, so it now starts unconditionally
-  // once OpenCode is up.
-  void ensureGlobalWatcherStarted().catch((error) => {
-    console.warn(`Global event watcher startup failed: ${error?.message || error}`);
-  });
+  // once OpenCode is up. Controlled retry when metadata is not yet ready.
+  const startWatcherWithRetry = (attempt = 0) => {
+    void ensureGlobalWatcherStarted().catch((error) => {
+      const retryable = error?.retryable === true || error?.code === 'session_metadata_unavailable';
+      const delays = [500, 1_500, 3_000, 6_000, 12_000];
+      if (retryable && attempt < delays.length) {
+        console.warn(
+          `Global event watcher deferred (metadata): ${error?.message || error}; retry ${attempt + 1}/${delays.length}`,
+        );
+        setTimeout(() => startWatcherWithRetry(attempt + 1), delays[attempt]);
+        return;
+      }
+      console.warn(`Global event watcher startup failed: ${error?.message || error}`);
+    });
+  };
+  startWatcherWithRetry();
 };
 
 const bootstrapOpenCodeAtStartup = async (...args) => {
@@ -1213,7 +1438,6 @@ const retryOpenCodeStartup = async (...args) => {
   await openCodeLifecycleRuntime.retryOpenCodeStartup(...args);
   completeOpenCodeStartup();
 };
-const killProcessOnPort = (...args) => openCodeLifecycleRuntime.killProcessOnPort(...args);
 const waitForPortRelease = (...args) => openCodeLifecycleRuntime.waitForPortRelease(...args);
 
 const fetchAgentsSnapshot = (...args) => serverUtilsRuntime.fetchAgentsSnapshot(...args);
@@ -1250,7 +1474,6 @@ const gracefulShutdownRuntime = createGracefulShutdownRuntime({
   setOpenCodeProcess: (value) => {
     openCodeProcess = value;
   },
-  killProcessOnPort,
   waitForPortRelease,
   getServer: () => server,
   getUiAuthController: () => uiAuthController,
@@ -1425,6 +1648,15 @@ async function main(options = {}) {
     buildOpenCodeUrl,
     getOpenCodeAuthHeaders,
     waitForOpenCodeReady,
+    projectSessions: (sessions) => {
+      const snap = sessionMetadataStore.getSnapshotSync();
+      // Not ready / unavailable — throw so sync keeps prior directory rows.
+      // A missing side-store row must not drop a session OpenCode still has.
+      if (!snap) {
+        throw new Error('session metadata is unavailable: Host store not ready');
+      }
+      return retainOpenCodeSessions(sessions, snap);
+    },
     onRevisionTip: (tip) => {
       broadcastOpenChamberEvent({
         type: 'openchamber:session-index-changed',
@@ -1432,8 +1664,43 @@ async function main(options = {}) {
       });
     },
   });
+  sessionIndexSyncRuntimeRef = sessionIndexSyncRuntime;
+
+  sessionArchiveServiceRef = createSessionArchiveService({
+    sessionMetadataStore,
+    fetchUpstreamSession: createUpstreamSessionFetcher({
+      buildOpenCodeUrl,
+      getOpenCodeAuthHeaders,
+    }),
+    sessionIndexService,
+    broadcastSessionEvent: (payload, options = {}) => {
+      try {
+        broadcastGlobalUiEvent(payload, options);
+      } catch (error) {
+        console.warn('[session-archive] global UI broadcast failed:', error?.message ?? error);
+      }
+      try {
+        broadcastOpenChamberEvent(payload);
+      } catch (error) {
+        console.warn('[session-archive] openchamber event broadcast failed:', error?.message ?? error);
+      }
+    },
+    onIndexChanged: () => {
+      sessionIndexSyncRuntimeRef?.publishChange();
+    },
+  });
+
   const unsubscribeSessionIndexEvents = globalMessageStreamHub.subscribeEvent((event) => {
-    if (applySessionIndexEvent(sessionIndexService, event)) {
+    if (applySessionIndexEvent(sessionIndexService, event, Date.now(), {
+      isHostReady: () => sessionMetadataStore.isLoaded(),
+      projectSession: (session) => {
+        if (!sessionMetadataStore.isLoaded()) return null;
+        const snap = sessionMetadataStore.getSnapshotSync();
+        if (!snap) return null;
+        return projectSessionWithStoredMap(session, snap);
+      },
+      onSessionDeleted: (sessionID) => sessionArchiveServiceRef?.forgetSession(sessionID),
+    })) {
       sessionIndexSyncRuntime?.publishChange();
     }
   });
@@ -1499,6 +1766,9 @@ async function main(options = {}) {
   }));
   expressApp = app;
   server = http.createServer(app);
+  // Track server-owned sockets so forceCloseConnections can destroy upgraded
+  // WS/SSE leftovers that closeAllConnections does not release.
+  attachHttpServerConnectionTracker(server);
   let realtimeProxyRuntime = { stop: () => {} };
 
   // The relay service is constructed further below (it depends on the active
@@ -1526,6 +1796,9 @@ async function main(options = {}) {
         openCodeApiPrefixDetected: true,
         isOpenCodeReady,
         v1Migration,
+        openCodeServeVersion,
+        openCodeCliVersion,
+        runtimeContract,
         lastOpenCodeError,
         lastOpenCodeLaunchDiagnostics,
         opencodeBinaryResolved: resolvedOpencodeBinary || null,
@@ -1636,6 +1909,8 @@ async function main(options = {}) {
     setAutoAcceptSession,
     sessionIndexService,
     sessionIndexSyncRuntime,
+    // Production snapshot/lookup filter: committed Host archive authority.
+    getCommittedHostMetadata: async () => sessionMetadataStore.getAll(),
     transcriptCacheService,
   });
   uiAuthController = bootstrapResult.uiAuthController;
@@ -1731,24 +2006,45 @@ async function main(options = {}) {
     buildOpenCodeUrl,
     getOpenCodeAuthHeaders,
     getIsExternalOpenCode: () => isExternalOpenCode,
+    getIsSharedOpenCodeService: () => openCodeLifecycleRuntime.isSharedOpenCodeService(),
+    forceResolvedOpenCodeBinary,
+    restartOpenCode,
+    waitForOpenCodeReady,
+    getRuntimeContract: () => runtimeContract,
+    getOpenCodeServeVersion: () => openCodeServeVersion,
+    getOpenCodeCliVersion: () => openCodeCliVersion,
+    getResolvedOpenCodeBinary: () => resolvedOpencodeBinary,
+    getResolvedOpenCodeBinarySource: () => resolvedOpencodeBinarySource,
+    getActiveSessionCount,
     sessionMetadataStore,
+    sessionArchiveService: {
+      setArchive: (...args) => {
+        if (!sessionArchiveServiceRef) {
+          const error = new Error('session archive is not configured');
+          error.status = 503;
+          throw error;
+        }
+        return sessionArchiveServiceRef.setArchive(...args);
+      },
+      archiveSession: (...args) => {
+        if (!sessionArchiveServiceRef) {
+          const error = new Error('session archive is not configured');
+          error.status = 503;
+          throw error;
+        }
+        return sessionArchiveServiceRef.archiveSession(...args);
+      },
+    },
     // Same store seam as sessionGoalRuntime / scheduledTasksRuntime.
     readSessionMetadata: (sessionId) => sessionMetadataStore.get(sessionId),
-    persistSessionGoal: async (sessionId, _directory, goal) => {
-      const metadata = await sessionMetadataStore.setSessionMetadata(sessionId, {
-        openchamber: { goal },
-      });
-      try {
-        broadcastGlobalUiEvent({
-          type: 'openchamber:session-metadata',
-          properties: { sessionID: sessionId, metadata },
-        });
-      } catch (error) {
-        console.warn('[session-metadata] broadcast failed:', error?.message ?? error);
-      }
-      return metadata;
-    },
+    persistSessionMetadata: persistSessionMetadataToStore,
+    onSystemSessionPersisted: hideSystemSessionFromIndex,
+    persistSessionGoal: persistSessionGoalToStore,
     onSessionMetadataWritten: ({ sessionID, directory, metadata }) => {
+      sessionTitleRuntime.processPayload({
+        type: 'openchamber:session-metadata',
+        properties: { sessionID, directory, metadata },
+      }, directory || '');
       sessionGoalRuntime.processPayload({
         type: 'session.updated',
         properties: {
@@ -1811,6 +2107,8 @@ async function main(options = {}) {
     getOpenCodeAuthHeaders,
     globalEventHub: globalMessageStreamHub,
     processForwardedEventPayload,
+    projectOutboundSessionPayload: projectHostSessionPayload,
+    ensureSessionMetadataReady,
     messageStreamWsClients: uiNotificationWsClients,
     upstreamStallTimeoutMs: getUpstreamStallTimeoutMs,
     terminalHeartbeatIntervalMs: TERMINAL_INPUT_WS_HEARTBEAT_INTERVAL_MS,
@@ -1880,12 +2178,9 @@ async function main(options = {}) {
     restartOpenCode: () => restartOpenCode(),
     getOpenCodeProcessInfo: () => {
       const managed = Boolean((openCodeProcess || openCodePort) && !ENV_SKIP_OPENCODE_START && !isExternalOpenCode);
-      // Only ever expose pid/port for a server WE manage. The Electron-side
-      // killer kills by port (lsof + kill -KILL), so returning a port we don't
-      // own — e.g. an external/desktop OpenCode on 4096 we attached to — would
-      // let a single miscomputed `managed` flag take down the user's separate
-      // server. Structurally withhold what isn't ours so the killer has no
-      // target, instead of relying on the flag check alone.
+      // Only ever expose pid/port for a server WE manage. Desktop no longer runs a
+      // post-stop detached killer of a pre-captured pid; still withhold non-owned
+      // process identity so diagnostics cannot imply we may kill an external serve.
       return {
         managed,
         pid: managed && typeof openCodeProcess?.pid === 'number' ? openCodeProcess.pid : null,
@@ -1899,6 +2194,8 @@ async function main(options = {}) {
         unsubscribeScheduledTaskEvents();
         sessionIndexSyncRuntime?.stop();
         sessionIndexService?.close();
+        sessionArchiveServiceRef?.stop?.();
+        stopSessionRecordMigration();
       } catch {
         // The index is a local cache; a failed close must not block shutdown.
       }
@@ -1926,11 +2223,10 @@ async function main(options = {}) {
         // best-effort shutdown of the dictation worker
       }
       try {
-        if (smallModelServiceInstance?.stop) {
-          await smallModelServiceInstance.stop();
-        }
+        const { stopLlmTempDirectory } = await import('./lib/llm/temp-directory.js');
+        await stopLlmTempDirectory();
       } catch {
-        // best-effort cleanup of the small-model temp OpenCode directory
+        // best-effort cleanup of the LLM generator temp OpenCode directory
       }
       return gracefulShutdown({
         exitProcess: shutdownOptions.exitProcess ?? false,