@productbrain/cli 0.1.0-beta.75 → 0.1.0-beta.7503

package/dist/__tests__/session-resume-backstop.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-resume-backstop.test.d.ts.map

package/dist/__tests__/session-resume-backstop.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resume-backstop.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session-resume-backstop.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/session-resume-backstop.test.js

@@ -0,0 +1,107 @@
+/**
+ * pb session start — resume workspace-mismatch backstop. TEN-2189 / WP-456 E2 (codex PR #145).
+ *
+ * The 2h auto-resume reads a closed marker and calls agent.resumeSession with the PREVIOUS
+ * session id. If the binding flipped (pb:preview/pb:real) or the profile switched since close,
+ * the current workspace differs from the marker's workspace and the resume would be a
+ * cross-workspace resume the deployment rejects. runSessionStart must detect the workspace
+ * mismatch, discard the stale marker, and start fresh instead.
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+const mockKernelCall = vi.fn();
+vi.mock('../lib/client.js', () => ({
+    kernelCall: (...a) => mockKernelCall(...a),
+    kernelCallWithSession: vi.fn(),
+}));
+vi.mock('../lib/config.js', () => ({
+    getConfigOrGuide: vi.fn(() => Promise.resolve({ apiKey: 'pb_sk_test', siteUrl: 'https://test.convex.site' })),
+    resolveEffectiveProfile: () => ({ profile: 'product-brain', source: 'local' }),
+    readLocalProjectConfig: () => ({ profile: 'product-brain' }),
+}));
+const mockReadSession = vi.fn(() => null);
+const mockReadClosedMarker = vi.fn(() => null);
+const mockDiscardSession = vi.fn();
+const mockWriteSession = vi.fn();
+vi.mock('../lib/session.js', () => ({
+    readSession: () => mockReadSession(),
+    readClosedMarker: () => mockReadClosedMarker(),
+    discardSession: () => mockDiscardSession(),
+    writeSession: (...a) => mockWriteSession(...a),
+    clearSession: vi.fn(),
+    sessionFileExists: vi.fn(() => false),
+    addCapturedEntry: vi.fn(),
+    // WP-479 E2: commands/session.ts imports the shared 2h resume-window constant from here.
+    RESUME_WINDOW_MS: 2 * 60 * 60 * 1000,
+}));
+vi.mock('../lib/runner.js', () => ({ isJsonMode: () => true }));
+vi.mock('../lib/profiles.js', () => ({ getActiveProfile: () => 'product-brain' }));
+vi.mock('../commands/handshake.js', () => ({ runHandshake: vi.fn(() => Promise.resolve()) }));
+// session.ts now resolves its profile label through the reporting leaf and names its write target
+// (WP-700). Both are mocked here so these tests keep exercising session lifecycle only, without
+// this file's partial `../lib/config.js` mock having to satisfy the leaf's own imports.
+vi.mock('../lib/reportedProfile.js', () => ({
+    resolveReportedProfile: vi.fn(() => ({ profile: 'product-brain', source: 'local' })),
+    isEnvKeyBinding: vi.fn(() => false),
+}));
+vi.mock('../lib/workspaceNotice.js', () => ({ emitEffectiveTenantNotice: vi.fn(async () => { }) }));
+import { runSessionStart } from '../commands/session.js';
+const recentClose = new Date(Date.now() - 60_000).toISOString(); // 1 min ago, inside 2h window
+beforeEach(() => {
+    vi.clearAllMocks();
+    mockReadSession.mockReturnValue(null);
+    mockKernelCall.mockReset();
+});
+describe('runSessionStart resume backstop', () => {
+    it('discards the marker and starts fresh when the current workspace differs (cross-workspace)', async () => {
+        mockReadClosedMarker.mockReturnValue({
+            sessionId: 'preview-sess', closedAt: recentClose,
+            workspaceId: 'ws-PREVIEW', workspaceName: 'Preview',
+        });
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-REAL', keyId: 'key1' });
+            if (method === 'agent.startSession') {
+                return Promise.resolve({ sessionId: 'fresh-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw' });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart();
+            // Backstop fired: stale marker discarded, NO cross-workspace resume attempted, fresh start.
+            expect(mockDiscardSession).toHaveBeenCalled();
+            const methods = mockKernelCall.mock.calls.map((c) => c[0]);
+            expect(methods).not.toContain('agent.resumeSession');
+            expect(methods).toContain('agent.startSession');
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+    it('resumes normally when the marker workspace matches the current binding', async () => {
+        mockReadClosedMarker.mockReturnValue({
+            sessionId: 'same-sess', closedAt: recentClose,
+            workspaceId: 'ws-REAL', workspaceName: 'Real',
+        });
+        mockKernelCall.mockImplementation((method) => {
+            if (method === 'resolveWorkspace')
+                return Promise.resolve({ _id: 'ws-REAL', keyId: 'key1' });
+            if (method === 'agent.resumeSession') {
+                return Promise.resolve({ sessionId: 'resumed-sess', workspaceName: 'Real', initiatedBy: 'x', toolsScope: 'rw' });
+            }
+            return Promise.resolve({});
+        });
+        const writeSpy = vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+        try {
+            await runSessionStart();
+            const methods = mockKernelCall.mock.calls.map((c) => c[0]);
+            expect(methods).toContain('agent.resumeSession');
+            expect(methods).not.toContain('agent.startSession');
+            expect(mockDiscardSession).not.toHaveBeenCalled();
+        }
+        finally {
+            writeSpy.mockRestore();
+        }
+    });
+});
+//# sourceMappingURL=session-resume-backstop.test.js.map

package/dist/__tests__/session-resume-backstop.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-resume-backstop.test.js","sourceRoot":"","sources":["../../src/__tests__/session-resume-backstop.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,MAAM,cAAc,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC/B,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IACrD,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAC3B,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAC/E;IACD,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,sBAAsB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;CAC7D,CAAC,CAAC,CAAC;AAGJ,MAAM,eAAe,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AAC1C,MAAM,oBAAoB,GAAG,EAAE,CAAC,EAAE,CAAC,GAAkB,EAAE,CAAC,IAAI,CAAC,CAAC;AAC9D,MAAM,kBAAkB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACnC,MAAM,gBAAgB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACjC,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;IACpC,gBAAgB,EAAE,GAAG,EAAE,CAAC,oBAAoB,EAAE;IAC9C,cAAc,EAAE,GAAG,EAAE,CAAC,kBAAkB,EAAE;IAC1C,YAAY,EAAE,CAAC,GAAG,CAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IACzD,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,iBAAiB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;IACrC,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;IACzB,yFAAyF;IACzF,gBAAgB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;CACrC,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACnF,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAE9F,kGAAkG;AAClG,gGAAgG;AAChG,wFAAwF;AACxF,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAGnG,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,8BAA8B;AAE/F,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,eAAe,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,cAAc,CAAC,SAAS,EAAE,CAAC;AAC7B,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,oBAAoB,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,WAAW;YAChD,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS;SACpD,CAAC,CAAC;QACH,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACpC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;YACxB,4FAA4F;YAC5F,MAAM,CAAC,kBAAkB,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC9C,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACrD,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,oBAAoB,CAAC,eAAe,CAAC;YACnC,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW;YAC7C,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM;SAC9C,CAAC,CAAC;QACH,cAAc,CAAC,kBAAkB,CAAC,CAAC,MAAc,EAAE,EAAE;YACnD,IAAI,MAAM,KAAK,kBAAkB;gBAAE,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC7F,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAClF,IAAI,CAAC;YACH,MAAM,eAAe,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;YACjD,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;YACpD,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/session-start-key-refresh.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=session-start-key-refresh.test.d.ts.map

package/dist/__tests__/session-start-key-refresh.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start-key-refresh.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/session-start-key-refresh.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/session-start-key-refresh.test.js

@@ -0,0 +1,191 @@
+/**
+ * WP-458 E2 — `pb session start` auto-recovers from a stale preview apiKey.
+ *
+ * After a preview reseed, the locally-bound apiKey is stale and the first kernel call fails with
+ * an opaque INTERNAL. session start must refresh the key from preview.json and retry ONCE; if it
+ * cannot recover it must surface a clean, actionable error (never the opaque INTERNAL); and on the
+ * real Chain (not preview-bound) it must rethrow the original error untouched (never mask).
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { CLIError, ErrorCode } from '../lib/errors.js';
+const kernelCall = vi.fn();
+vi.mock('../lib/client.js', () => ({
+    kernelCall: (...args) => kernelCall(...args),
+    kernelCallWithSession: vi.fn(),
+}));
+const refreshPreviewApiKeyFromDisk = vi.fn();
+const readLocalProjectConfig = vi.fn();
+vi.mock('../lib/config.js', () => ({
+    getConfigOrGuide: vi.fn(() => Promise.resolve({ apiKey: 'pb_sk_test', siteUrl: 'https://test.convex.site' })),
+    readLocalProjectConfig: () => readLocalProjectConfig(),
+    resolveEffectiveProfile: () => ({ profile: 'product-brain', source: 'local' }),
+    refreshPreviewApiKeyFromDisk: () => refreshPreviewApiKeyFromDisk(),
+}));
+const readSession = vi.fn(() => null);
+vi.mock('../lib/session.js', () => ({
+    readSession: () => readSession(),
+    writeSession: vi.fn(),
+    clearSession: vi.fn(),
+    discardSession: vi.fn(),
+    sessionFileExists: () => false,
+    readClosedMarker: () => null,
+}));
+vi.mock('../lib/runner.js', () => ({ isJsonMode: () => true }));
+vi.mock('../lib/prompts.js', () => ({ confirm: vi.fn(), isInteractive: () => false }));
+vi.mock('../lib/profiles.js', () => ({ getActiveProfile: () => 'product-brain' }));
+vi.mock('../formatters/session.js', () => ({
+    formatSessionStart: () => '',
+    formatSessionClose: () => '',
+    FEEDBACK_SUBMIT_HINT: 'hint',
+}));
+// session.ts now resolves its profile label through the reporting leaf and names its write target
+// (WP-700). Both are mocked here so these tests keep exercising session lifecycle only, without
+// this file's partial `../lib/config.js` mock having to satisfy the leaf's own imports.
+vi.mock('../lib/reportedProfile.js', () => ({
+    resolveReportedProfile: vi.fn(() => ({ profile: 'product-brain', source: 'local' })),
+    isEnvKeyBinding: vi.fn(() => false),
+}));
+vi.mock('../lib/workspaceNotice.js', () => ({ emitEffectiveTenantNotice: vi.fn(async () => { }) }));
+const PREVIEW_BOUND = { preview: true, apiKey: 'pb_sk_stale', siteUrl: 'https://test.convex.site' };
+const REAL_BOUND = { profile: 'product-brain' };
+function opaqueInternal() {
+    return new CLIError('boom', { code: ErrorCode.INTERNAL, category: 'internal' });
+}
+let runSessionStart;
+beforeEach(async () => {
+    vi.clearAllMocks();
+    kernelCall.mockReset();
+    refreshPreviewApiKeyFromDisk.mockReset();
+    readLocalProjectConfig.mockReset();
+    readSession.mockReset();
+    readSession.mockReturnValue(null);
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true);
+    ({ runSessionStart } = await import('../commands/session.js'));
+});
+describe('runSessionStart preview-key auto-refresh', () => {
+    it('RESTARTS rather than re-stamping when a reseed refreshes the key (Codex P1 r10)', async () => {
+        // A reseed can mint a REPLACEMENT workspace, not just a new key for the same one, so blessing
+        // the existing marker would hand the write guard a session belonging to the orphaned one.
+        readSession.mockReturnValue({
+            sessionId: 's-old', workspaceId: 'w-old', workspaceName: 'Old',
+            startedAt: '2026-01-01T00:00:00Z', entriesCaptured: [], profile: 'product-brain',
+            bindingFingerprint: 'oldfingerprint00',
+        });
+        readLocalProjectConfig.mockReturnValue({ preview: true });
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        kernelCall.mockImplementation(async (fn) => {
+            if (fn === 'resolveWorkspace')
+                return { _id: 'w-new', keyId: 'k1' };
+            if (fn === 'agent.startSession')
+                return { sessionId: 's-new', workspaceName: 'New', initiatedBy: 'cli', toolsScope: 'rw' };
+            return {};
+        });
+        await runSessionStart({ json: true });
+        // A fresh session was opened against the CURRENT workspace, not the old marker reused.
+        expect(kernelCall).toHaveBeenCalledWith('agent.startSession', expect.anything());
+    });
+    it('refreshes from preview.json and retries once on a stale-key INTERNAL', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        let n = 0;
+        kernelCall.mockImplementation(async (fn) => {
+            n++;
+            if (n === 1)
+                throw opaqueInternal(); // first kernel call with the stale key
+            if (fn === 'resolveWorkspace')
+                return { _id: 'ws1', keyId: 'key1' };
+            if (fn === 'agent.startSession')
+                return { sessionId: 'sess1', workspaceName: 'Preview Workspace' };
+            return {};
+        });
+        await runSessionStart();
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+        // First (failed) call + retry's resolveWorkspace + agent.startSession.
+        expect(kernelCall).toHaveBeenCalledWith('agent.startSession', expect.anything());
+    });
+    it('surfaces a clean, actionable error (no opaque INTERNAL) when preview.json is unavailable', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('unavailable'); // preview.json missing/malformed
+        kernelCall.mockRejectedValue(opaqueInternal());
+        await expect(runSessionStart()).rejects.toMatchObject({
+            message: expect.stringContaining('preview.json'),
+        });
+        // It must NOT re-attempt with the same key.
+        expect(kernelCall).toHaveBeenCalledTimes(1);
+    });
+    it('rethrows the ORIGINAL error (no relabel) when the bound key is current — not a stale-key failure', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('unchanged'); // the key on disk is not stale
+        kernelCall.mockRejectedValue(opaqueInternal());
+        // The opaque INTERNAL was not a key problem, so the genuine error must surface untouched —
+        // it must NOT be relabelled as a preview-key rejection.
+        await expect(runSessionStart()).rejects.toThrow('boom');
+        expect(kernelCall).toHaveBeenCalledTimes(1);
+    });
+    it('rethrows the original error untouched on the real Chain (not preview-bound)', async () => {
+        readLocalProjectConfig.mockReturnValue(REAL_BOUND);
+        kernelCall.mockRejectedValue(opaqueInternal());
+        await expect(runSessionStart()).rejects.toThrow('boom');
+        expect(refreshPreviewApiKeyFromDisk).not.toHaveBeenCalled();
+    });
+    it('only retries once — a second failure after refresh surfaces a clean error', async () => {
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        kernelCall.mockRejectedValue(opaqueInternal()); // both attempts fail
+        await expect(runSessionStart()).rejects.toMatchObject({
+            message: expect.stringContaining('preview.json'),
+        });
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+    });
+    it('preserves a non-stale-key retry failure after refresh (does not relabel it)', async () => {
+        // The first call fails on the stale key, the refresh succeeds, but the retry fails for a
+        // DIFFERENT reason (backend unreachable). The user must see that real error, not the
+        // preview-key message (Codex P2).
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        let n = 0;
+        kernelCall.mockImplementation(async () => {
+            n++;
+            if (n === 1)
+                throw opaqueInternal(); // stale key
+            throw new Error('backend unreachable'); // retry: not a stale-key-shaped failure
+        });
+        await expect(runSessionStart()).rejects.toThrow('backend unreachable');
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+    });
+    it('keeps the read-only-key guidance when the refreshed key resolves to a read-only scope', async () => {
+        // The refresh succeeded with a different (valid) key, but it has read-only scope, so the retry
+        // hits establishSession's local guard which throws an AUTH_INVALID. Although that is auth-shaped,
+        // it is NOT a rejected preview key — the readwrite-key guidance must surface, not reseed/rebind
+        // (Codex P2: only the opaque INTERNAL is relabelled on the retry path).
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        refreshPreviewApiKeyFromDisk.mockReturnValue('refreshed');
+        let n = 0;
+        kernelCall.mockImplementation(async (fn) => {
+            n++;
+            if (n === 1)
+                throw opaqueInternal(); // first call: stale key
+            if (fn === 'resolveWorkspace')
+                return { _id: 'ws1', keyId: null }; // retry: read-only scope
+            return {};
+        });
+        await expect(runSessionStart()).rejects.toThrow('read-only scope');
+    });
+    it('proactively refreshes a stale preview key when a session is already active (no kernel call)', async () => {
+        // An already-active session returns a status report without any kernel call, so the catch-based
+        // recovery never fires. It must still rebind the fresh key from disk so the next pb write does
+        // not fail with the stale one (Codex P2).
+        readLocalProjectConfig.mockReturnValue(PREVIEW_BOUND);
+        readSession.mockReturnValue({
+            sessionId: 'active1',
+            workspaceName: 'Preview Workspace',
+            startedAt: 'now',
+            entriesCaptured: [],
+            profile: 'product-brain',
+        });
+        await runSessionStart();
+        expect(refreshPreviewApiKeyFromDisk).toHaveBeenCalledTimes(1);
+        expect(kernelCall).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=session-start-key-refresh.test.js.map

package/dist/__tests__/session-start-key-refresh.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-start-key-refresh.test.js","sourceRoot":"","sources":["../../src/__tests__/session-start-key-refresh.test.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,UAAU,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC3B,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,UAAU,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACvD,qBAAqB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC/B,CAAC,CAAC,CAAC;AAEJ,MAAM,4BAA4B,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAC7C,MAAM,sBAAsB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AACvC,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;IACjC,gBAAgB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC,CAAC;IAC7G,sBAAsB,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE;IACtD,uBAAuB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9E,4BAA4B,EAAE,GAAG,EAAE,CAAC,4BAA4B,EAAE;CACnE,CAAC,CAAC,CAAC;AAEJ,MAAM,WAAW,GAAG,EAAE,CAAC,EAAE,CAAgB,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACrD,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC;IAClC,WAAW,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE;IAChC,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,YAAY,EAAE,EAAE,CAAC,EAAE,EAAE;IACrB,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;IACvB,iBAAiB,EAAE,GAAG,EAAE,CAAC,KAAK;IAC9B,gBAAgB,EAAE,GAAG,EAAE,CAAC,IAAI;CAC7B,CAAC,CAAC,CAAC;AAEJ,EAAE,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAChE,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;AACvF,EAAE,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACnF,EAAE,CAAC,IAAI,CAAC,0BAA0B,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC5B,kBAAkB,EAAE,GAAG,EAAE,CAAC,EAAE;IAC5B,oBAAoB,EAAE,MAAM;CAC7B,CAAC,CAAC,CAAC;AAEJ,kGAAkG;AAClG,gGAAgG;AAChG,wFAAwF;AACxF,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1C,sBAAsB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACpF,eAAe,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;CACpC,CAAC,CAAC,CAAC;AACJ,EAAE,CAAC,IAAI,CAAC,2BAA2B,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAGnG,MAAM,aAAa,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;AACpG,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;AAEhD,SAAS,cAAc;IACrB,OAAO,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;AAClF,CAAC;AAED,IAAI,eAA2E,CAAC;AAEhF,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,EAAE,CAAC,aAAa,EAAE,CAAC;IACnB,UAAU,CAAC,SAAS,EAAE,CAAC;IACvB,4BAA4B,CAAC,SAAS,EAAE,CAAC;IACzC,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACnC,WAAW,CAAC,SAAS,EAAE,CAAC;IACxB,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;IAClC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACjE,CAAC,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;AACjE,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,8FAA8F;QAC9F,0FAA0F;QAC1F,WAAW,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK;YAC9D,SAAS,EAAE,sBAAsB,EAAE,eAAe,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe;YAChF,kBAAkB,EAAE,kBAAkB;SACvC,CAAC,CAAC;QACH,sBAAsB,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjD,IAAI,EAAE,KAAK,kBAAkB;gBAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACpE,IAAI,EAAE,KAAK,oBAAoB;gBAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;YAC3H,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtC,uFAAuF;QACvF,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC,CAAC,uCAAuC;YAC5E,IAAI,EAAE,KAAK,kBAAkB;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YACpE,IAAI,EAAE,KAAK,oBAAoB;gBAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,CAAC;YACnG,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9D,uEAAuE;QACvE,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CAAC,oBAAoB,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC,CAAC,iCAAiC;QAC9F,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACjD,CAAC,CAAC;QACH,4CAA4C;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kGAAkG,EAAE,KAAK,IAAI,EAAE;QAChH,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,+BAA+B;QAC1F,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE/C,2FAA2F;QAC3F,wDAAwD;QACxD,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,sBAAsB,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;QACnD,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC;QAE/C,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,CAAC,4BAA4B,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,UAAU,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,qBAAqB;QAErE,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACpD,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,yFAAyF;QACzF,qFAAqF;QACrF,kCAAkC;QAClC,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,UAAU,CAAC,kBAAkB,CAAC,KAAK,IAAI,EAAE;YACvC,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC,CAAW,YAAY;YAC3D,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAQ,wCAAwC;QACzF,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACvE,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,+FAA+F;QAC/F,kGAAkG;QAClG,gGAAgG;QAChG,wEAAwE;QACxE,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,4BAA4B,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,UAAU,CAAC,kBAAkB,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;YACjD,CAAC,EAAE,CAAC;YACJ,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,cAAc,EAAE,CAAC,CAAiB,wBAAwB;YAC7E,IAAI,EAAE,KAAK,kBAAkB;gBAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,yBAAyB;YAC5F,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC3G,gGAAgG;QAChG,+FAA+F;QAC/F,0CAA0C;QAC1C,sBAAsB,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QACtD,WAAW,CAAC,eAAe,CAAC;YAC1B,SAAS,EAAE,SAAS;YACpB,aAAa,EAAE,mBAAmB;YAClC,SAAS,EAAE,KAAK;YAChB,eAAe,EAAE,EAAE;YACnB,OAAO,EAAE,eAAe;SACzB,CAAC,CAAC;QAEH,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,4BAA4B,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/session-state-machine.test.js

@@ -13,24 +13,48 @@
  *   4. clearSession() on active session writes a closed marker (atomic tmp→rename)
  *   5. clearSession() on an existing marker deletes the file (no timestamp refresh)
  */
-import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 // ---------------------------------------------------------------------------
 // Virtual filesystem state — controlled per test
+//
+// WP-479 E2: extended to also virtualize `.productbrain/sessions/<conversationId>.json` — one
+// entry per conversation marker, keyed by filename (e.g. "conv-a.json"). Legacy `session.json`
+// handling is UNCHANGED (same branches, same behavior) — the sessions-dir branches are additive.
 // ---------------------------------------------------------------------------
-const fsState = { sessionJson: null };
+const fsState = {
+    sessionJson: null,
+    sessionsDir: {},
+};
+function sessionsDirEntryName(p) {
+    return String(p).split('/sessions/')[1].replace(/\.tmp$/, '');
+}
 vi.mock('fs', async (importOriginal) => {
     const actual = await importOriginal();
     return {
         ...actual,
         existsSync: (p) => {
-            if (String(p).endsWith('session.json'))
+            const s = String(p);
+            // Check the conversation-marker directory FIRST — a conversationId could itself end in
+            // "session" (e.g. "b-session"), which must never false-match the legacy branch below.
+            if (s.includes('/sessions/'))
+                return sessionsDirEntryName(s) in fsState.sessionsDir;
+            if (s.endsWith('/sessions'))
+                return true; // the dir itself — always "exists" for the mock
+            if (s.endsWith('session.json'))
                 return fsState.sessionJson !== null;
-            if (String(p).endsWith('session.json.tmp'))
+            if (s.endsWith('session.json.tmp'))
                 return false;
             return actual.existsSync(p);
         },
         readFileSync: (p, enc) => {
-            if (String(p).endsWith('session.json') && enc === 'utf8') {
+            const s = String(p);
+            if (s.includes('/sessions/') && enc === 'utf8') {
+                const name = sessionsDirEntryName(s);
+                if (!(name in fsState.sessionsDir))
+                    throw new Error('ENOENT');
+                return fsState.sessionsDir[name];
+            }
+            if (s.endsWith('session.json') && enc === 'utf8') {
                 if (fsState.sessionJson === null)
                     throw new Error('ENOENT');
                 return fsState.sessionJson;
@@ -38,29 +62,58 @@ vi.mock('fs', async (importOriginal) => {
             return actual.readFileSync(p, enc);
         },
         writeFileSync: (p, data, enc) => {
-            if (String(p).endsWith('session.json') || String(p).endsWith('session.json.tmp')) {
+            const s = String(p);
+            if (s.includes('/sessions/')) {
+                fsState.sessionsDir[sessionsDirEntryName(s)] = String(data);
+                return;
+            }
+            if (s.endsWith('session.json') || s.endsWith('session.json.tmp')) {
                 fsState.sessionJson = String(data);
                 return;
             }
             return actual.writeFileSync(p, data, enc);
         },
         renameSync: (src, dst) => {
-            // tmp → session.json: already written to fsState.sessionJson in writeFileSync above
-            if (String(src).endsWith('session.json.tmp') && String(dst).endsWith('session.json'))
+            // tmp → session.json: already written to fsState.sessionJson / sessionsDir in writeFileSync above
+            if (String(src).endsWith('.tmp'))
                 return;
             return actual.renameSync(src, dst);
         },
         unlinkSync: (p) => {
-            if (String(p).endsWith('session.json')) {
+            const s = String(p);
+            if (s.includes('/sessions/')) {
+                delete fsState.sessionsDir[sessionsDirEntryName(s)];
+                return;
+            }
+            if (s.endsWith('session.json')) {
                 fsState.sessionJson = null;
                 return;
             }
             return actual.unlinkSync(p);
         },
         mkdirSync: vi.fn(), // always succeeds
+        readdirSync: (p) => {
+            if (String(p).endsWith('/sessions'))
+                return Object.keys(fsState.sessionsDir);
+            return actual.readdirSync(p);
+        },
     };
 });
-import { readSession, clearSession, readClosedMarker, } from '../lib/session.js';
+import { readSession, writeSession, clearSession, readClosedMarker, discardSession, sessionFileExists, } from '../lib/session.js';
+// ---------------------------------------------------------------------------
+// Conversation-identity env helper — WP-479 E2. Real lib/conversation.js is NOT mocked (it is
+// pure env feature-detection), so isolation tests set/restore the relevant env var directly.
+// ---------------------------------------------------------------------------
+const CONV_ENV_KEYS = [
+    'PB_CONVERSATION_ID',
+    'CLAUDE_CODE_SESSION_ID',
+    'CURSOR_CONVERSATION_ID',
+    'CODEX_TUI_SESSION_LOG_PATH',
+];
+const savedConvEnv = {};
+function withConversationId(id) {
+    process.env.PB_CONVERSATION_ID = id;
+}
 const ACTIVE_SESSION = {
     sessionId: 'rd79aaa',
     workspaceId: 'ws-1',
@@ -74,8 +127,25 @@ const CLOSED_MARKER = {
 };
 beforeEach(() => {
     fsState.sessionJson = null;
+    fsState.sessionsDir = {};
+    // Guard every test (existing + new) against ambient identity env vars — e.g. this suite may
+    // itself run inside a Claude Code shell, where CLAUDE_CODE_SESSION_ID is genuinely set. Existing
+    // tests below assume the legacy no-identity path; clearing here makes that assumption hold
+    // regardless of the ambient shell (WP-479 E2 zero-config invariant, defense in depth).
+    for (const key of CONV_ENV_KEYS) {
+        savedConvEnv[key] = process.env[key];
+        delete process.env[key];
+    }
     vi.clearAllMocks();
 });
+afterEach(() => {
+    for (const key of CONV_ENV_KEYS) {
+        if (savedConvEnv[key] === undefined)
+            delete process.env[key];
+        else
+            process.env[key] = savedConvEnv[key];
+    }
+});
 describe('readSession()', () => {
     it('returns null when no file exists', () => {
         expect(readSession()).toBeNull();
@@ -151,4 +221,159 @@ describe('2h resume window boundary', () => {
         expect(elapsed).toBeGreaterThan(2 * 60 * 60 * 1000);
     });
 });
+describe('discardSession()', () => {
+    it('removes session.json outright (no closed marker)', () => {
+        writeSession({
+            sessionId: 's1', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [], profile: 'p1',
+        });
+        discardSession();
+        expect(readSession()).toBeNull();
+        expect(readClosedMarker()).toBeNull(); // unlinked, NOT a marker
+    });
+    it('is a no-op when no session file exists', () => {
+        expect(() => discardSession()).not.toThrow();
+    });
+    it('removes a closed marker too, not just an active session', () => {
+        fsState.sessionJson = JSON.stringify(CLOSED_MARKER);
+        discardSession();
+        expect(sessionFileExists()).toBe(false);
+    });
+});
+describe('sessionFileExists()', () => {
+    it('is true for an active session and for a closed marker', () => {
+        writeSession({
+            sessionId: 's1', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        expect(sessionFileExists()).toBe(true); // active
+        clearSession(); // writes a closed marker
+        expect(readSession()).toBeNull(); // marker is not an active session…
+        expect(sessionFileExists()).toBe(true); // …but the file still exists
+    });
+    it('is false when there is no session file', () => {
+        discardSession();
+        expect(sessionFileExists()).toBe(false);
+    });
+});
+describe('SessionState.profile round-trips', () => {
+    it('persists the profile field', () => {
+        writeSession({
+            sessionId: 's2', workspaceId: 'w2', workspaceName: 'WS2',
+            startedAt: new Date().toISOString(), entriesCaptured: [], profile: 'product-brain',
+        });
+        expect(readSession()?.profile).toBe('product-brain');
+    });
+});
+// ---------------------------------------------------------------------------
+// WP-479 E2 — conversation-aware marker layout
+// ---------------------------------------------------------------------------
+describe('legacy path stays byte-identical when no conversation identity resolves', () => {
+    it('with no env signal, writeSession/readSession target session.json — sessionsDir untouched', () => {
+        writeSession({
+            sessionId: 'legacy-1', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        expect(fsState.sessionJson).not.toBeNull();
+        expect(Object.keys(fsState.sessionsDir)).toHaveLength(0);
+        expect(readSession()?.sessionId).toBe('legacy-1');
+        // The written state stamps conversationId as undefined, not a stray value.
+        expect(readSession()?.conversationId).toBeUndefined();
+    });
+});
+describe('per-conversation marker isolation', () => {
+    it('two distinct conversationIds write to two distinct marker files, no cross-talk', () => {
+        withConversationId('conv-a');
+        writeSession({
+            sessionId: 'sess-a', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        withConversationId('conv-b');
+        writeSession({
+            sessionId: 'sess-b', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        expect(Object.keys(fsState.sessionsDir).sort()).toEqual(['conv-a.json', 'conv-b.json']);
+        expect(fsState.sessionJson).toBeNull(); // legacy path never touched
+        withConversationId('conv-a');
+        expect(readSession()?.sessionId).toBe('sess-a');
+        withConversationId('conv-b');
+        expect(readSession()?.sessionId).toBe('sess-b');
+    });
+    it('stamps the resolved conversationId onto the written state', () => {
+        withConversationId('conv-c');
+        writeSession({
+            sessionId: 'sess-c', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        expect(readSession()?.conversationId).toBe('conv-c');
+    });
+    it('clearSession on one conversation marker does not affect a sibling conversation', () => {
+        withConversationId('conv-x');
+        writeSession({
+            sessionId: 'sess-x', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        withConversationId('conv-y');
+        writeSession({
+            sessionId: 'sess-y', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        withConversationId('conv-x');
+        clearSession(); // closes conv-x only
+        expect(readSession()).toBeNull(); // conv-x now closed
+        withConversationId('conv-y');
+        expect(readSession()?.sessionId).toBe('sess-y'); // conv-y untouched
+    });
+    it('a long/unsafe-charset conversationId env value normalizes to the same hashed filename on every call', () => {
+        process.env.PB_CONVERSATION_ID = '../weird path/with spaces';
+        writeSession({
+            sessionId: 'sess-hashed', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: new Date().toISOString(), entriesCaptured: [],
+        });
+        const files = Object.keys(fsState.sessionsDir);
+        expect(files).toHaveLength(1);
+        // Filename is a safe sha256 hex digest, not the raw unsafe string.
+        expect(files[0]).toMatch(/^[0-9a-f]{64}\.json$/);
+        expect(readSession()?.sessionId).toBe('sess-hashed');
+    });
+});
+describe('GC of expired closed conversation markers', () => {
+    it('deletes a closed marker whose closedAt is older than the 2h resume window', () => {
+        const stale = {
+            sessionId: 'sess-stale', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: '2026-01-01T00:00:00.000Z', entriesCaptured: [],
+            closedAt: new Date(Date.now() - 3 * 60 * 60 * 1000).toISOString(), // 3h ago
+            conversationId: 'conv-stale',
+        };
+        fsState.sessionsDir['conv-stale.json'] = JSON.stringify(stale);
+        // Any call that touches the sessions dir triggers GC.
+        withConversationId('conv-unrelated');
+        readSession();
+        expect(fsState.sessionsDir['conv-stale.json']).toBeUndefined();
+    });
+    it('keeps a closed marker still within the 2h resume window', () => {
+        const recent = {
+            sessionId: 'sess-recent', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: '2026-01-01T00:00:00.000Z', entriesCaptured: [],
+            closedAt: new Date(Date.now() - 30 * 60 * 1000).toISOString(), // 30 min ago
+            conversationId: 'conv-recent',
+        };
+        fsState.sessionsDir['conv-recent.json'] = JSON.stringify(recent);
+        withConversationId('conv-unrelated');
+        readSession();
+        expect(fsState.sessionsDir['conv-recent.json']).toBeDefined();
+    });
+    it('never GCs an ACTIVE (no closedAt) conversation marker regardless of age', () => {
+        const activeOld = {
+            sessionId: 'sess-active-old', workspaceId: 'w1', workspaceName: 'WS',
+            startedAt: '2020-01-01T00:00:00.000Z', entriesCaptured: [],
+            conversationId: 'conv-active-old',
+        };
+        fsState.sessionsDir['conv-active-old.json'] = JSON.stringify(activeOld);
+        withConversationId('conv-unrelated');
+        readSession();
+        expect(fsState.sessionsDir['conv-active-old.json']).toBeDefined();
+    });
+});
 //# sourceMappingURL=session-state-machine.test.js.map