@rubytech/create-maxy-code 0.1.376 → 0.1.378

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -33,7 +33,7 @@ import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
 import { runConnectorAuthLogin } from './connector-auth.js';
 import { isEffortLevel, isNewSessionEffortLevel, isPermissionMode, SONNET_MODEL } from '../../../lib/models/dist/index.js';
 import { spawnClaudeSession, stopSession, writeInterruptToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, classifyLiveness, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
-import { writeScopeRecord, removeScopeRecord } from './scope-record.js';
+import { writeScopeRecord, removeScopeRecord, readAllScopeRecords } from './scope-record.js';
 import { writeReseatMarker, resolveReseatChain, clearReseatMarker } from './reseat-ledger.js';
 import { getScopeMainPid, defaultProcessSignals, defaultSystemctlRunner } from './systemd-scope.js';
 import { readSidecar, updateSidecar, appendBridgeId, writeSidecar } from './session-sidecar.js';
@@ -319,6 +319,22 @@ export function tailIsOpenTurn(jsonlPath) {
 /** Resolve any of the 4 keys to the canonical (sessionId, row) pair.
  *  Tries: intrinsic sessionId, bridgeSessionId, bridgeSuffix, numeric pid.
  *  Returns undefined when nothing matches. */
+/** Task 1324 — resolve the on-disk project slug for a supplied `accountId`,
+ *  mirroring the /rc-spawn account derivation (`accountsRoot =
+ *  dirname(platformRoot)/data/accounts`) and config.ts's
+ *  `accountIdFromSessionCwd` invariant that an account's spawn cwd is
+ *  `<accountsRoot>/<accountId>`. Returns null when the accountId names no
+ *  account dir in the registry, so the caller can 400 the mismatch instead of
+ *  scanning a slug that cannot exist. The caller is responsible for
+ *  shape-validating `accountId` (UUID) BEFORE calling — the value is joined
+ *  into a filesystem path here, so an unvalidated caller would open a path
+ *  traversal. */
+function accountSlugForId(platformRoot, accountId) {
+    const accountDir = join(dirname(platformRoot), 'data', 'accounts', accountId);
+    if (!existsSync(join(accountDir, 'account.json')))
+        return null;
+    return projectSlugForCwd(accountDir);
+}
 function resolveRow(watcher, id) {
     const direct = watcher.getBySessionId(id);
     if (direct)
@@ -1573,12 +1589,45 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', `/${id}/stop`, 400, Date.now() - start);
             return c.json({ error: 'invalid-session-id' }, 400);
         }
+        const accountId = c.req.query('accountId') || undefined;
         const row = resolveRow(deps.watcher, id);
+        const sessionId = row?.sessionId ?? id;
+        // Task 1324 — account-scoped resolution for the `!row` branch. On a
+        // multi-account install the watcher is armed only on the house slug, so a
+        // cross-account session has no row. When the admin UI forwards the caller's
+        // canonical accountId, resolve the session from `sessionId + accountId`
+        // instead of the watcher, so a false 404 no longer swallows the stop. The
+        // token to actually terminate a scope unit that survived a manager restart
+        // comes from the on-disk scope record (keyed by sessionId, account-agnostic)
+        // — the watcher row is the only other source and it is absent here.
+        let accountScoped = false;
+        let scopeTokenFromRecord = null;
         if (!row && !isLive(id)) {
-            timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
-            return c.json({ error: 'session-not-found' }, 404);
+            if (accountId) {
+                // Resolve the slug once (UUID gate first — accountId is joined into a
+                // path). A null result means the id names no account in the registry.
+                const slug = UUID_PATTERN.test(accountId) ? accountSlugForId(deps.platformRoot, accountId) : null;
+                if (slug === null) {
+                    deps.logger(`stop-account-mismatch sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
+                    timed(deps.logger, 'POST', `/${id}/stop`, 400, Date.now() - start);
+                    return c.json({ error: 'accountId not in this install registry' }, 400);
+                }
+                const hasTop = existsSync(jsonlPathForSlug(deps.claudeConfigDir, slug, sessionId));
+                const hasArchived = existsSync(jsonlPathForSlug(deps.claudeConfigDir, slug, sessionId, { archived: true }));
+                const rec = readAllScopeRecords(sessionsDir, deps.logger).find((r) => r.sessionId === sessionId);
+                if (!hasTop && !hasArchived && !rec) {
+                    deps.logger(`stop-not-found sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)} reason=file-missing`);
+                    timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
+                    return c.json({ error: 'session-not-found' }, 404);
+                }
+                accountScoped = true;
+                scopeTokenFromRecord = rec?.scopeUnitToken ?? null;
+            }
+            else {
+                timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
+                return c.json({ error: 'session-not-found' }, 404);
+            }
         }
-        const sessionId = row?.sessionId ?? id;
         // Task 455 — snapshot the live pid and prior-exited-count BEFORE
         // stopSession runs (the call mutates module state). When prior history
         // exists, emit a single observability line naming the pid the lookup
@@ -1597,7 +1646,9 @@ export function buildHttpApp(deps) {
             // Task 427 — when the row was reattached after a manager restart,
             // `livePtys` has no entry but `row.scopeUnitToken` is set; pass it
             // so stopSession can take the row-scope fallback path.
-            rowScopeUnitToken: row?.scopeUnitToken ?? null,
+            // Task 1324 — for a cross-account session there is no row; the token
+            // comes from the on-disk scope record instead, resolved above.
+            rowScopeUnitToken: row?.scopeUnitToken ?? scopeTokenFromRecord,
             // Task 451 — paired with rowScopeUnitToken so the row-scope branch
             // can post-flight verify the kill via kill(pid, 0).
             rowPid: row?.pid ?? null,
@@ -1607,6 +1658,13 @@ export function buildHttpApp(deps) {
         // formatting (Task 250 contract); this is the single audit line the
         // operator and tests can grep against to confirm which branch ran.
         deps.logger(`[stop-session] path=${outcome.path} outcome=${outcome.scopeOutcome} sessionId=${sessionId.slice(0, 8)} unit=${row?.scopeUnitToken ?? 'none'} pid=${row?.pid ?? 'unknown'}`);
+        // Task 1324 — one diffable audit line whenever the stop resolved from the
+        // caller's accountId rather than a watcher row. Distinct from the unified
+        // line above so a log read can tell the account-scoped path from the
+        // house-account row/liveptys paths.
+        if (accountScoped) {
+            deps.logger(`[stop-session] path=account-scoped outcome=${outcome.scopeOutcome} sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
+        }
         // Task 250 — surface scope-stop failures as 500 so the operator sees
         // the End-click fail when systemd cannot stop the unit. The liveptys
         // happy path keeps its original 204 response (Task 250 contract).
@@ -1660,6 +1718,7 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'DELETE', `/${id}`, 400, Date.now() - start);
             return c.json({ error: 'invalid-session-id' }, 400);
         }
+        const accountId = c.req.query('accountId') || undefined;
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
         if (isLive(sessionId)) {
@@ -1669,20 +1728,48 @@ export function buildHttpApp(deps) {
         }
         // Task 260 — purge from BOTH locations: a row may have its JSONL
         // at the top level (live or just-ended) or under archive/ (archived).
-        // Task 1298 — resolve the slug that actually holds the JSONL first;
-        // the list (sidebar-sessions.ts) walks every slug, so delete must too.
-        // Fall back to spawnCwd's slug only when nothing is found anywhere —
-        // hasTop/hasArchived will both be false regardless, so the fallback
-        // only affects which (nonexistent) paths appear in the 404 case.
-        const resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
+        // Task 1324 — when the admin UI forwards the caller's canonical accountId,
+        // derive the slug from it and gate ONLY on file existence, bypassing the
+        // watcher row (which is single-account-scoped and absent for any session
+        // outside the manager's house account). When accountId is absent, keep the
+        // Task 1298 watcher-row path unchanged for back-compat, but log the
+        // degraded fallback so the account-less path is visible in the log.
+        let resolvedSlug;
+        if (accountId) {
+            // Resolve the slug once (UUID gate first — accountId is joined into a
+            // path). A null result means the id names no account in the registry.
+            const acctSlug = UUID_PATTERN.test(accountId) ? accountSlugForId(deps.platformRoot, accountId) : null;
+            if (acctSlug === null) {
+                deps.logger(`delete-account-mismatch sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
+                timed(deps.logger, 'DELETE', `/${id}`, 400, Date.now() - start);
+                return c.json({ error: 'accountId not in this install registry' }, 400);
+            }
+            resolvedSlug = acctSlug;
+        }
+        else {
+            deps.logger(`delete-fallback sessionId=${sessionId.slice(0, 8)} reason=no-accountId-supplied`);
+            // Task 1298 — resolve the slug that actually holds the JSONL; the list
+            // (sidebar-sessions.ts) walks every slug, so delete must too. Fall back
+            // to spawnCwd's slug only when nothing is found anywhere.
+            resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
+        }
         const topJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
         const archivedJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const topSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
         const archivedSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const hasTop = existsSync(topJsonl);
         const hasArchived = existsSync(archivedJsonl);
-        if (!row || (!hasTop && !hasArchived)) {
-            deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
+        // Account-scoped path gates on file existence alone (the row is expected to
+        // be absent). Fallback path keeps the `!row` term so a bare id with no row
+        // still 404s as `not-found-anywhere` (Task 1298 contract).
+        const notFound = accountId ? (!hasTop && !hasArchived) : (!row || (!hasTop && !hasArchived));
+        if (notFound) {
+            if (accountId) {
+                deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)} reason=file-missing`);
+            }
+            else {
+                deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
+            }
             timed(deps.logger, 'DELETE', `/${id}`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }