@rubytech/create-maxy-code 0.1.382 → 0.1.384

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -319,22 +319,6 @@ export function tailIsOpenTurn(jsonlPath) {
 /** Resolve any of the 4 keys to the canonical (sessionId, row) pair.
  *  Tries: intrinsic sessionId, bridgeSessionId, bridgeSuffix, numeric pid.
  *  Returns undefined when nothing matches. */
-/** Task 1324 — resolve the on-disk project slug for a supplied `accountId`,
- *  mirroring the /rc-spawn account derivation (`accountsRoot =
- *  dirname(platformRoot)/data/accounts`) and config.ts's
- *  `accountIdFromSessionCwd` invariant that an account's spawn cwd is
- *  `<accountsRoot>/<accountId>`. Returns null when the accountId names no
- *  account dir in the registry, so the caller can 400 the mismatch instead of
- *  scanning a slug that cannot exist. The caller is responsible for
- *  shape-validating `accountId` (UUID) BEFORE calling — the value is joined
- *  into a filesystem path here, so an unvalidated caller would open a path
- *  traversal. */
-function accountSlugForId(platformRoot, accountId) {
-    const accountDir = join(dirname(platformRoot), 'data', 'accounts', accountId);
-    if (!existsSync(join(accountDir, 'account.json')))
-        return null;
-    return projectSlugForCwd(accountDir);
-}
 function resolveRow(watcher, id) {
     const direct = watcher.getBySessionId(id);
     if (direct)
@@ -841,7 +825,7 @@ export function buildHttpApp(deps) {
         let model = null;
         let enrichedStartedAt = null;
         if (hasJsonl) {
-            const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, LIST_TAIL_BYTES, deps.logger, deps.userTitleStore);
+            const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, LIST_TAIL_BYTES, deps.logger, deps.titleStores.forSessionCwd(row.cwd));
             if (enriched) {
                 displayName = enriched.displayName;
                 titleSource = enriched.titleSource;
@@ -854,14 +838,14 @@ export function buildHttpApp(deps) {
             }
         }
         else {
-            const userTitle = deps.userTitleStore.get(row.sessionId)?.title;
+            const userTitle = deps.titleStores.forSessionCwd(row.cwd).get(row.sessionId)?.title;
             if (userTitle) {
                 displayName = userTitle;
                 titleSource = 'user';
             }
         }
         // Task 624 — standing reconciliation. A LIVE role=public row whose title did
-        // not resolve from the user-override tier means the /spawn userTitleStore.set
+        // not resolve from the user-override tier means the /spawn titleStores.set
         // silently failed or was evicted. Fires on the next list read while the
         // session is live, so a missing write is caught without a live repro. Gated
         // to live rows so pre-Task-624 public sessions (no title, forward-only — the
@@ -1118,7 +1102,7 @@ export function buildHttpApp(deps) {
         // field so a dropped name is visible without reproducing.
         if (role === 'public') {
             if (publicTitle) {
-                deps.userTitleStore.set(result.session.sessionId, publicTitle);
+                deps.titleStores.forSessionCwd(deps.spawnCwd).set(result.session.sessionId, publicTitle);
                 deps.logger(`[spawn] role=public senderId=${senderId} sessionId=${result.session.sessionId.slice(0, 8)} title="${publicTitle}"`);
             }
             else {
@@ -1163,7 +1147,7 @@ export function buildHttpApp(deps) {
             let titleSource = null;
             const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
             if (existsSync(jsonlPath)) {
-                const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, LIST_TAIL_BYTES, deps.logger, deps.userTitleStore);
+                const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, LIST_TAIL_BYTES, deps.logger, deps.titleStores.forSessionCwd(row.cwd));
                 if (enriched) {
                     firstPrompt = enriched.displayName;
                     titleSource = enriched.titleSource;
@@ -1171,7 +1155,7 @@ export function buildHttpApp(deps) {
             }
             else {
                 // Pre-jsonl / post-purge: only the user-title store can answer.
-                const userTitle = deps.userTitleStore.get(row.sessionId)?.title;
+                const userTitle = deps.titleStores.forSessionCwd(row.cwd).get(row.sessionId)?.title;
                 if (userTitle) {
                     firstPrompt = userTitle;
                     titleSource = 'user';
@@ -1337,7 +1321,7 @@ export function buildHttpApp(deps) {
             // /events handler re-emits the row so every browser tab sees the new
             // label without re-fetching the sidebar route. The row lookup goes through the
             // watcher (canonical row index); rowToPayload then re-reads the user
-            // title from `deps.userTitleStore`, picking up the freshly-set value.
+            // title from `deps.titleStores`, picking up the freshly-set value.
             const renameListener = (sessionId) => {
                 if (!active)
                     return;
@@ -1395,7 +1379,7 @@ export function buildHttpApp(deps) {
             ? jsonlPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true })
             : jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
         if (existsSync(candidatePath)) {
-            const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, deps.jsonlReadMaxBytes, deps.logger, deps.userTitleStore);
+            const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, deps.jsonlReadMaxBytes, deps.logger, deps.titleStores.forSessionCwd(row.cwd));
             if (enriched) {
                 payload = {
                     ...payload,
@@ -1539,7 +1523,7 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', `/${id}/rename`, 400, Date.now() - start);
             return c.json({ error: 'invalid-title', reason: result.reason }, 400);
         }
-        const entry = deps.userTitleStore.set(sessionId, result.title);
+        const entry = deps.titleStores.forSessionCwd(row?.cwd ?? null).set(sessionId, result.title);
         // Title content is never logged — operator names may contain customer
         // data. Byte count is enough for forensic recovery of bulk-rename surges.
         const titleBytes = Buffer.byteLength(entry.title, 'utf-8');
@@ -1589,44 +1573,28 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', `/${id}/stop`, 400, Date.now() - start);
             return c.json({ error: 'invalid-session-id' }, 400);
         }
-        const accountId = c.req.query('accountId') || undefined;
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
-        // Task 1324 — account-scoped resolution for the `!row` branch. On a
-        // multi-account install the watcher is armed only on the house slug, so a
-        // cross-account session has no row. When the admin UI forwards the caller's
-        // canonical accountId, resolve the session from `sessionId + accountId`
-        // instead of the watcher, so a false 404 no longer swallows the stop. The
-        // token to actually terminate a scope unit that survived a manager restart
-        // comes from the on-disk scope record (keyed by sessionId, account-agnostic)
-        // — the watcher row is the only other source and it is absent here.
-        let accountScoped = false;
+        // Task 1357 — when there is no watcher row and nothing live under this id,
+        // resolve the session the SAME way the sidebar list does: locate its JSONL
+        // by scanning every slug under projects/ (slugForExistingJsonl checks both
+        // the top level and archive/), plus the on-disk scope record that names a
+        // scope unit surviving a manager restart. If none of these exist, the
+        // session is genuinely gone → 404. This replaces the Task 1324
+        // accountId-derived slug: account scope is a view filter, not a stop gate
+        // (admin access is install-wide), and deriving the slug from the caller's
+        // accountId 404'd any session living under a non-house slug with no row —
+        // a false not-found that silently swallowed the stop.
         let scopeTokenFromRecord = null;
         if (!row && !isLive(id)) {
-            if (accountId) {
-                // Resolve the slug once (UUID gate first — accountId is joined into a
-                // path). A null result means the id names no account in the registry.
-                const slug = UUID_PATTERN.test(accountId) ? accountSlugForId(deps.platformRoot, accountId) : null;
-                if (slug === null) {
-                    deps.logger(`stop-account-mismatch sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
-                    timed(deps.logger, 'POST', `/${id}/stop`, 400, Date.now() - start);
-                    return c.json({ error: 'accountId not in this install registry' }, 400);
-                }
-                const hasTop = existsSync(jsonlPathForSlug(deps.claudeConfigDir, slug, sessionId));
-                const hasArchived = existsSync(jsonlPathForSlug(deps.claudeConfigDir, slug, sessionId, { archived: true }));
-                const rec = readAllScopeRecords(sessionsDir, deps.logger).find((r) => r.sessionId === sessionId);
-                if (!hasTop && !hasArchived && !rec) {
-                    deps.logger(`stop-not-found sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)} reason=file-missing`);
-                    timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
-                    return c.json({ error: 'session-not-found' }, 404);
-                }
-                accountScoped = true;
-                scopeTokenFromRecord = rec?.scopeUnitToken ?? null;
-            }
-            else {
+            const onDisk = slugForExistingJsonl(deps.claudeConfigDir, sessionId) !== null;
+            const rec = readAllScopeRecords(sessionsDir, deps.logger).find((r) => r.sessionId === sessionId);
+            if (!onDisk && !rec) {
+                deps.logger(`stop-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
                 timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
                 return c.json({ error: 'session-not-found' }, 404);
             }
+            scopeTokenFromRecord = rec?.scopeUnitToken ?? null;
         }
         // Task 455 — snapshot the live pid and prior-exited-count BEFORE
         // stopSession runs (the call mutates module state). When prior history
@@ -1658,13 +1626,6 @@ export function buildHttpApp(deps) {
         // formatting (Task 250 contract); this is the single audit line the
         // operator and tests can grep against to confirm which branch ran.
         deps.logger(`[stop-session] path=${outcome.path} outcome=${outcome.scopeOutcome} sessionId=${sessionId.slice(0, 8)} unit=${row?.scopeUnitToken ?? 'none'} pid=${row?.pid ?? 'unknown'}`);
-        // Task 1324 — one diffable audit line whenever the stop resolved from the
-        // caller's accountId rather than a watcher row. Distinct from the unified
-        // line above so a log read can tell the account-scoped path from the
-        // house-account row/liveptys paths.
-        if (accountScoped) {
-            deps.logger(`[stop-session] path=account-scoped outcome=${outcome.scopeOutcome} sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
-        }
         // Task 250 — surface scope-stop failures as 500 so the operator sees
         // the End-click fail when systemd cannot stop the unit. The liveptys
         // happy path keeps its original 204 response (Task 250 contract).
@@ -1718,7 +1679,6 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'DELETE', `/${id}`, 400, Date.now() - start);
             return c.json({ error: 'invalid-session-id' }, 400);
         }
-        const accountId = c.req.query('accountId') || undefined;
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
         if (isLive(sessionId)) {
@@ -1726,50 +1686,29 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'DELETE', `/${id}`, 409, Date.now() - start);
             return c.json({ error: 'pty-still-alive', detail: 'stop the session before deleting' }, 409);
         }
-        // Task 260 — purge from BOTH locations: a row may have its JSONL
-        // at the top level (live or just-ended) or under archive/ (archived).
-        // Task 1324 — when the admin UI forwards the caller's canonical accountId,
-        // derive the slug from it and gate ONLY on file existence, bypassing the
-        // watcher row (which is single-account-scoped and absent for any session
-        // outside the manager's house account). When accountId is absent, keep the
-        // Task 1298 watcher-row path unchanged for back-compat, but log the
-        // degraded fallback so the account-less path is visible in the log.
-        let resolvedSlug;
-        if (accountId) {
-            // Resolve the slug once (UUID gate first — accountId is joined into a
-            // path). A null result means the id names no account in the registry.
-            const acctSlug = UUID_PATTERN.test(accountId) ? accountSlugForId(deps.platformRoot, accountId) : null;
-            if (acctSlug === null) {
-                deps.logger(`delete-account-mismatch sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)}`);
-                timed(deps.logger, 'DELETE', `/${id}`, 400, Date.now() - start);
-                return c.json({ error: 'accountId not in this install registry' }, 400);
-            }
-            resolvedSlug = acctSlug;
-        }
-        else {
-            deps.logger(`delete-fallback sessionId=${sessionId.slice(0, 8)} reason=no-accountId-supplied`);
-            // Task 1298 — resolve the slug that actually holds the JSONL; the list
-            // (sidebar-sessions.ts) walks every slug, so delete must too. Fall back
-            // to spawnCwd's slug only when nothing is found anywhere.
-            resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
-        }
+        // Task 260 — purge from BOTH locations: a row may have its JSONL at the top
+        // level (live or just-ended) or under archive/ (archived).
+        // Task 1357 — resolve the holding slug the SAME way the sidebar list does:
+        // locate `<sessionId>.jsonl` by scanning every slug under projects/
+        // (slugForExistingJsonl mirrors enumerateJsonls in sidebar-sessions.ts, and
+        // checks archive/ too). The list narrows resolution by nothing, so delete
+        // must not either — a session the list shows must be deletable. Gate on file
+        // existence alone. This removes the Task 1324 accountId-derived slug and the
+        // Task 1298 `!row` term, both of which narrowed resolution below what the
+        // list enumerates: a session under a non-house slug with no watcher row
+        // (e.g. a legacy `-home-admin` session on a single-account install) was
+        // listed yet un-deletable. Account scope is a view filter, not a delete gate
+        // — admin access is install-wide. Fall back to spawnCwd's slug only when the
+        // JSONL exists nowhere, so a genuinely-absent id still 404s.
+        const resolvedSlug = slugForExistingJsonl(deps.claudeConfigDir, sessionId) ?? projectSlugForCwd(deps.spawnCwd);
         const topJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
         const archivedJsonl = jsonlPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const topSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId);
         const archivedSidecar = sidecarPathForSlug(deps.claudeConfigDir, resolvedSlug, sessionId, { archived: true });
         const hasTop = existsSync(topJsonl);
         const hasArchived = existsSync(archivedJsonl);
-        // Account-scoped path gates on file existence alone (the row is expected to
-        // be absent). Fallback path keeps the `!row` term so a bare id with no row
-        // still 404s as `not-found-anywhere` (Task 1298 contract).
-        const notFound = accountId ? (!hasTop && !hasArchived) : (!row || (!hasTop && !hasArchived));
-        if (notFound) {
-            if (accountId) {
-                deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} accountId=${accountId.slice(0, 8)} reason=file-missing`);
-            }
-            else {
-                deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
-            }
+        if (!hasTop && !hasArchived) {
+            deps.logger(`delete-not-found sessionId=${sessionId.slice(0, 8)} reason=not-found-anywhere`);
             timed(deps.logger, 'DELETE', `/${id}`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }
@@ -1803,7 +1742,11 @@ export function buildHttpApp(deps) {
         // session-titles.json doesn't accrete orphans. Best-effort; the store
         // logs its own failure and reads still serve from the in-memory map
         // until next boot.
-        deps.userTitleStore.remove(sessionId);
+        // Task 1354 — remove from the SESSION's account file, not the boot file.
+        // Resolve the account from the row's spawn cwd; an absent/cwd-less row
+        // (legacy non-account-scoped session) falls back to the boot store, which
+        // is where such a session's title would have been written anyway.
+        deps.titleStores.forSessionCwd(row?.cwd ?? null).remove(sessionId);
         // Task 683 — drop the channel binding too so wa-channel-bindings.json
         // doesn't accrete orphans and a recreated session can't inherit a stale
         // binding. Best-effort; the store logs its own failure.