@rubytech/create-maxy-code 0.1.44 → 0.1.45

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rubytech/create-maxy-code",
-  "version": "0.1.44",
+  "version": "0.1.45",
   "description": "Install Maxy — AI for Productive People",
   "bin": {
     "create-maxy-code": "./dist/index.js"

package/payload/platform/plugins/admin/hooks/__tests__/turn-completed-graph-write.test.sh

@@ -1,18 +1,18 @@
 #!/usr/bin/env bash
 # Regression test for the Stop-hook gate that fires the database-operator
-# per completed admin-agent turn.
+# per completed admin-agent turn (Task 106 redesign: headless one-shot).
 #
 # Behaviour verified:
 #   1. MAXY_SESSION_ROLE!=admin → exit 0, no POST attempt, no log line.
-#   2. MAXY_HIDDEN_SPAWN=1     → exit 0, no POST attempt, no log line.
+#   2. MAXY_HIDDEN_SPAWN=1     → exit 0, no POST attempt, no log line
+#      (the Stop-hook self-stop path was removed in Task 106; the recorder
+#      now exits when its stdin closes, not via a /<id>/stop POST).
 #   3. Empty stdin            → exit 0 silently.
 #   4. Missing transcript_path → exit 0 silently.
-#   5. Happy path             → POST attempt + `turn-completed-graph-write
-#      fired conversationId=<8> tail-bytes=<n> ms=<n>` log line.
-#
-# POST is observed by binding the hook's MANAGER_PORT to a tiny netcat
-# listener that records the request body. Each case uses a separate port
-# so concurrent execution does not interfere.
+#   5. Happy path             → ONE POST to /spawn whose body contains
+#      `"stdinPayload"`, ZERO POSTs to /<id>/input, and the new
+#      `[recorder] spawn-with-stdin sessionId=<8> bytes=<n> filtered-from-records=<n>`
+#      log line.
 
 set -u
 
@@ -23,7 +23,14 @@ if [[ ! -x "$HOOK" ]]; then
 fi
 
 TMPFILES=()
+LISTENER_PIDS=()
 cleanup_test_state() {
+  for pid in "${LISTENER_PIDS[@]:-}"; do
+    if [[ -n "$pid" ]]; then
+      kill "$pid" 2>/dev/null || true
+      wait "$pid" 2>/dev/null || true
+    fi
+  done
   for f in "${TMPFILES[@]:-}"; do
     [[ -n "$f" ]] && rm -f "$f" 2>/dev/null || true
   done
@@ -35,7 +42,6 @@ FAIL=0
 pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
 fail() { echo "FAIL: $1" >&2; FAIL=$((FAIL + 1)); }
 
-# Helper: run hook with a stdin envelope + env, capture stderr + exit code.
 run_hook() {
   local role="$1"; local hidden="$2"; local stdin_json="$3"
   local stderr_file; stderr_file=$(mktemp); TMPFILES+=("$stderr_file")
@@ -65,11 +71,11 @@ elif [[ -n "$HOOK_STDERR" ]]; then fail "case-1 expected empty stderr, got: $HOO
 else pass "case-1 role=public → no fire (rc=0, stderr empty)"
 fi
 
-# --- Case 2: hidden=1 → no fire ------------------------------------------
+# --- Case 2: hidden=1 → no fire (Task 106 removed self-stop) -----------
 run_hook "admin" "1" "$ENVELOPE"
 if [[ "$HOOK_RC" -ne 0 ]]; then fail "case-2 expected rc=0 got=$HOOK_RC"
-elif [[ -n "$HOOK_STDERR" ]]; then fail "case-2 expected empty stderr, got: $HOOK_STDERR"
-else pass "case-2 hidden=1 → no fire (rc=0, stderr empty)"
+elif [[ -n "$HOOK_STDERR" ]]; then fail "case-2 expected empty stderr (no self-stop POST in Task 106), got: $HOOK_STDERR"
+else pass "case-2 hidden=1 → silent (no self-stop POST)"
 fi
 
 # --- Case 3: empty stdin → silent --------------------------------------
@@ -87,19 +93,115 @@ elif [[ -n "$HOOK_STDERR" ]]; then fail "case-4 expected empty stderr, got: $HOO
 else pass "case-4 missing transcript_path → silent (rc=0)"
 fi
 
-# --- Case 5: happy path → POST attempt + log line ---------------------
-# Use a deliberately closed port; curl returns non-zero, which is fine —
-# the hook fires fire-and-forget and ignores curl's exit. We assert on
-# the log line and exit code only.
-MANAGER_PORT=1
+# --- Case 5: happy path → /spawn POST carries stdinPayload, NO /input POST
+# A tiny python HTTP listener records every request body/path. It accepts
+# /spawn and returns a JSON body containing a recorder sessionId. If the
+# hook makes a second POST to /<id>/input the listener records that path
+# too — the test fails if any /input path appears in the request log.
+REQ_LOG=$(mktemp); TMPFILES+=("$REQ_LOG")
+LISTENER_PORT=39406
+python3 - "$LISTENER_PORT" "$REQ_LOG" <<'PY' &
+import sys, http.server, json
+port = int(sys.argv[1])
+log_path = sys.argv[2]
+class H(http.server.BaseHTTPRequestHandler):
+  def log_message(self, *a, **k): pass
+  def do_POST(self):
+    n = int(self.headers.get('Content-Length','0') or 0)
+    body = self.rfile.read(n).decode('utf-8','replace')
+    with open(log_path, 'a', encoding='utf-8') as f:
+      f.write(self.path + '\t' + body + '\n')
+    self.send_response(200)
+    self.send_header('Content-Type','application/json')
+    self.end_headers()
+    self.wfile.write(json.dumps({"sessionId":"rec00001-feedfeed"}).encode('utf-8'))
+http.server.HTTPServer(('127.0.0.1', port), H).serve_forever()
+PY
+LISTENER_PIDS+=("$!")
+
+# Wait up to 2s for the listener to bind.
+for _ in $(seq 1 20); do
+  if curl -sS --max-time 1 -X POST "http://127.0.0.1:${LISTENER_PORT}/ping" -d '{}' >/dev/null 2>&1; then
+    break
+  fi
+  sleep 0.1
+done
+
+# Clear the request log of the ping write.
+: > "$REQ_LOG"
+
+MANAGER_PORT="$LISTENER_PORT"
 run_hook "admin" "0" "$ENVELOPE"
 unset MANAGER_PORT
+
+# Give the listener time to flush.
+sleep 0.1
+
 if [[ "$HOOK_RC" -ne 0 ]]; then
   fail "case-5 expected rc=0 got=$HOOK_RC stderr=$HOOK_STDERR"
-elif ! echo "$HOOK_STDERR" | grep -q "^turn-completed-graph-write fired conversationId=abcd1234 tail-bytes="; then
-  fail "case-5 expected fired log line, got: $HOOK_STDERR"
+fi
+
+# Assert: spawn-with-stdin log line emitted.
+if ! echo "$HOOK_STDERR" | grep -qE '^\[recorder\] spawn-with-stdin sessionId=rec00001 bytes=[0-9]+ filtered-from-records=[0-9]+'; then
+  fail "case-5 expected spawn-with-stdin log line, got: $HOOK_STDERR"
+else
+  pass "case-5a spawn-with-stdin log line emitted"
+fi
+
+# Assert: no legacy input-posted log line.
+if echo "$HOOK_STDERR" | grep -q 'input-posted'; then
+  fail "case-5b legacy [recorder] input-posted line must not be emitted in Task 106"
+else
+  pass "case-5b legacy input-posted log line absent"
+fi
+
+# Assert: listener saw exactly one /spawn POST whose body contains
+# stdinPayload, and ZERO /<id>/input POSTs.
+SPAWN_LINES=$(grep -c '^/spawn	' "$REQ_LOG" || true)
+INPUT_LINES=$(grep -cE '^/[A-Za-z0-9_-]+/input	' "$REQ_LOG" || true)
+STOP_LINES=$(grep -cE '^/[A-Za-z0-9_-]+/stop	' "$REQ_LOG" || true)
+if [[ "$SPAWN_LINES" -ne 1 ]]; then
+  fail "case-5c expected exactly 1 /spawn POST, got $SPAWN_LINES (log: $(cat "$REQ_LOG"))"
+else
+  pass "case-5c exactly one /spawn POST observed"
+fi
+if [[ "$INPUT_LINES" -ne 0 ]]; then
+  fail "case-5d expected ZERO /<id>/input POSTs, got $INPUT_LINES"
+else
+  pass "case-5d zero /<id>/input POSTs"
+fi
+if [[ "$STOP_LINES" -ne 0 ]]; then
+  fail "case-5e expected ZERO /<id>/stop POSTs, got $STOP_LINES"
+else
+  pass "case-5e zero /<id>/stop POSTs"
+fi
+
+# Assert: the /spawn body contains a stdinPayload field with non-empty value.
+SPAWN_BODY=$(grep '^/spawn	' "$REQ_LOG" | head -1 | cut -f2-)
+if [[ -z "$SPAWN_BODY" ]]; then
+  fail "case-5f /spawn body was empty"
+else
+  HAS_STDIN=$(printf '%s' "$SPAWN_BODY" | python3 -c '
+import sys, json
+try:
+  b = json.load(sys.stdin)
+  sp = b.get("stdinPayload")
+  print("yes" if isinstance(sp, str) and len(sp) > 0 else "no")
+except Exception:
+  print("parse-fail")
+' 2>/dev/null)
+  if [[ "$HAS_STDIN" != "yes" ]]; then
+    fail "case-5f /spawn body must carry non-empty stdinPayload, got: $SPAWN_BODY"
+  else
+    pass "case-5f /spawn body carries non-empty stdinPayload"
+  fi
+fi
+
+# Assert: final fired log line still emitted.
+if ! echo "$HOOK_STDERR" | grep -qE '^turn-completed-graph-write fired conversationId=abcd1234 recorderSessionId=rec00001 filtered=[0-9]+ ms=[0-9]+'; then
+  fail "case-5g expected fired summary log line, got: $HOOK_STDERR"
 else
-  pass "case-5 admin foreground → fired log line emitted"
+  pass "case-5g fired summary log line emitted"
 fi
 
 # --- Summary ------------------------------------------------------------

package/payload/platform/plugins/admin/hooks/turn-completed-graph-write.sh

@@ -1,27 +1,23 @@
 #!/usr/bin/env bash
 # Stop hook — fires on every completed admin-agent turn and dispatches one
-# background PTY against `specialists:database-operator`. The hidden PTY is
-# the only writer to the Neo4j graph; the admin agent stays focused on the
-# operator's request.
+# headless one-shot PTY against `specialists:database-operator`. The hidden
+# PTY is the only writer to the Neo4j graph; the admin agent stays focused on
+# the operator's request.
 #
-# Pipeline (Task 094 redesign):
-#   1. /spawn (no stdinPayload) — manager awaits its watcher's PID-file
-#      event before returning. Response carries the recorder's intrinsic
-#      sessionId.
-#   2. POST /<recorder-sessionId>/input — body is the database-operator
-#      prompt followed by the filtered JSONL tail of the just-completed
-#      turn (user / assistant / tool-call records only; queue-operation,
-#      auto_mode, deferred_tools_delta, hook_*, last-prompt, skill_listing,
-#      mcp_instructions_delta, permission-mode are dropped).
-#   3. When the recorder's Stop hook fires, this hook runs again INSIDE
-#      the recorder PTY; the MAXY_HIDDEN_SPAWN gate exits early so no
-#      recursion. The recorder's PTY exits naturally; its Stop is then
-#      driven by POST /<sessionId>/stop from the same hook invocation
-#      that posted /input.
+# Pipeline (Task 106 redesign):
+#   1. /spawn with `stdinPayload` — manager appends `--print` to argv when
+#      hidden=true && specialist is set, then writes the payload + EOT to the
+#      PTY's stdin immediately after spawn. Claude consumes the turn, writes
+#      to the graph via MCP tools, prints to stdout, and exits.
+#   2. The fs-watcher observes the PID-file delete the moment claude exits
+#      and archives the row — no follow-up /input POST, no Stop hook signal,
+#      no 120s reaper safety-net catch.
 #
 # Gating:
 #   - MAXY_SESSION_ROLE must equal "admin"
-#   - MAXY_HIDDEN_SPAWN must equal "0" (skip recursive fires)
+#   - MAXY_HIDDEN_SPAWN must equal "0" (skip recursive fires — the recorder
+#     runs with MAXY_HIDDEN_SPAWN=1 and `--print`, so it never invokes Stop
+#     hooks itself, but the guard stays as a belt-and-braces backstop).
 #
 # Input: Claude Code's Stop hook stdin shape
 #   { "session_id": "<intrinsic>", "transcript_path": "<jsonl path>", ... }
@@ -37,32 +33,10 @@ if [ "${MAXY_SESSION_ROLE:-}" != "admin" ]; then
   exit 0
 fi
 if [ "${MAXY_HIDDEN_SPAWN:-0}" = "1" ]; then
-  # Recorder PTY's own Stop hook. Read its session_id and ask the manager
-  # to SIGTERM the recorder so it does not idle in the active recents list
-  # after its single turn completes. Keep the JSONL — it's the audit trail.
-  if [ -t 0 ]; then
-    exit 0
-  fi
-  REC_INPUT=$(cat)
-  if [ -z "$REC_INPUT" ]; then
-    exit 0
-  fi
-  REC_SESSION_ID=$(printf '%s' "$REC_INPUT" | python3 -c '
-import sys, json
-try:
-  d = json.load(sys.stdin)
-  print(d.get("session_id", "") or "")
-except Exception:
-  print("")
-' 2>/dev/null)
-  if [ -z "$REC_SESSION_ID" ]; then
-    exit 0
-  fi
-  REC_PORT="${CLAUDE_SESSION_MANAGER_PORT:-19400}"
-  curl -sS -X POST \
-    --max-time 5 \
-    "http://127.0.0.1:${REC_PORT}/${REC_SESSION_ID}/stop" >/dev/null 2>&1
-  echo "[recorder] self-stop sessionId=${REC_SESSION_ID:0:8}" >&2
+  # Recorder PTY's own Stop hook would land here if claude --print ever
+  # emitted one. The lifecycle is now stdin-close → process-exit, so no
+  # self-stop POST is needed; exit silently to prevent accidental recursion
+  # into the admin branch below.
   exit 0
 fi
 
@@ -111,9 +85,6 @@ def keep(rec):
   return False
 
 path = sys.argv[1]
-# Read whole file; admin transcripts are bounded by Claude Code's own
-# compaction so the read cost is reasonable. Take the last 200 records
-# from the kept set so a long transcript doesn't blow the prompt budget.
 out = []
 try:
   with open(path, 'r', encoding='utf-8') as f:
@@ -135,19 +106,36 @@ FILTERED_COUNT=$(printf '%s' "$FILTERED_TAIL" | python3 -c 'import sys,json; d=j
 MANAGER_PORT="${CLAUDE_SESSION_MANAGER_PORT:-19400}"
 MANAGER_BASE="http://127.0.0.1:${MANAGER_PORT}"
 
-# Spawn the recorder PTY. Manager blocks on its watcher's PID-file event
-# and returns the recorder's intrinsic sessionId in the response body.
+# Compose the recorder prompt + bundle it into the /spawn body's
+# `stdinPayload`. The manager appends `--print` to the claude argv and
+# writes (payload + EOT) to the PTY's stdin; claude consumes one turn and
+# exits, the fs-watcher archives the row.
 SPAWN_BODY=$(python3 -c '
-import json, sys
+import sys, json
+sid = sys.argv[1]
+tail_json = sys.argv[2]
+prompt = (
+  "You are the database-operator specialist. Record the following completed turn "
+  "into the Neo4j graph. The transcript is a JSON array of filtered records "
+  "from the admin agent (user prompts, assistant responses, tool calls). "
+  f"Conversation id: {sid}.\n\nTranscript:\n{tail_json}\n"
+)
 body = {
   "senderId": "turn-recorder",
   "role": "admin",
   "channel": "browser",
   "hidden": True,
   "specialist": "database-operator",
+  "stdinPayload": prompt,
 }
 print(json.dumps(body))
-')
+' "$ADMIN_SESSION_ID" "$FILTERED_TAIL" 2>/dev/null)
+
+if [ -z "$SPAWN_BODY" ]; then
+  exit 0
+fi
+
+PAYLOAD_BYTES=$(printf '%s' "$SPAWN_BODY" | python3 -c 'import sys,json; b=json.load(sys.stdin); print(len(b.get("stdinPayload","").encode("utf-8")))' 2>/dev/null || echo 0)
 
 SPAWN_RES=$(curl -sS -X POST \
   -H 'Content-Type: application/json' \
@@ -169,33 +157,7 @@ if [ -z "$RECORDER_SESSION_ID" ]; then
   exit 0
 fi
 
-# Compose the input message: prompt prefix + filtered transcript JSON.
-INPUT_BODY=$(python3 -c '
-import sys, json
-sid = sys.argv[1]
-tail_json = sys.argv[2]
-prompt = (
-  "You are the database-operator specialist. Record the following completed turn "
-  "into the Neo4j graph. The transcript is a JSON array of filtered records "
-  "from the admin agent (user prompts, assistant responses, tool calls). "
-  f"Conversation id: {sid}.\n\nTranscript:\n{tail_json}\n"
-)
-print(json.dumps({"text": prompt}))
-' "$ADMIN_SESSION_ID" "$FILTERED_TAIL" 2>/dev/null)
-
-if [ -z "$INPUT_BODY" ]; then
-  exit 0
-fi
-
-INPUT_BYTES=$(printf '%s' "$INPUT_BODY" | wc -c | tr -d ' ')
-
-curl -sS -X POST \
-  -H 'Content-Type: application/json' \
-  --max-time 5 \
-  --data "$INPUT_BODY" \
-  "${MANAGER_BASE}/${RECORDER_SESSION_ID}/input" >/dev/null 2>&1
-
-echo "[recorder] input-posted sessionId=${RECORDER_SESSION_ID:0:8} bytes=${INPUT_BYTES} filtered-from-records=${FILTERED_COUNT}" >&2
+echo "[recorder] spawn-with-stdin sessionId=${RECORDER_SESSION_ID:0:8} bytes=${PAYLOAD_BYTES} filtered-from-records=${FILTERED_COUNT}" >&2
 
 END_MS=$(python3 -c 'import time; print(int(time.time()*1000))')
 ELAPSED=$((END_MS - START_MS))

package/payload/platform/plugins/docs/references/platform.md

@@ -52,7 +52,7 @@ Roles are installed during setup and listed when {{productName}} introduces itse
 
 {{productName}} maintains a graph database (Neo4j) of everything you've told it. People, conversations, preferences, and context are stored as connected nodes. When you ask {{productName}} something, it searches this graph to retrieve relevant context before responding.
 
-**The recording loop.** A background recorder watches every completed admin-agent turn. Once your turn finishes and the reply is on screen, a Stop hook fires the `database-operator` specialist as a hidden Claude Code session with the just-completed turn as input. The recorder decides what's worth keeping and writes through the wrapped graph writers; the admin agent itself does not write to the graph. The recorder runs on a cheap fast model so the recording adds nothing to your perceived latency, and its session never appears in the sidebar or anywhere on the operator UI. To disable it for an account, remove the `Stop` hook entry from that account's `~/.<brand>/.claude/settings.json`; there is no toggle.
+**The recording loop.** A background recorder watches every completed admin-agent turn. Once your turn finishes and the reply is on screen, a Stop hook fires the `database-operator` specialist as a single-shot headless Claude Code session: the filtered transcript is written to the recorder's stdin and stdin is closed, so claude processes one turn, writes through the wrapped graph writers, and exits. The row archives the moment claude exits — no long-lived hidden PTY. The admin agent itself does not write to the graph. The recorder runs on a cheap fast model so the recording adds nothing to your perceived latency, and its session never appears in the sidebar or anywhere on the operator UI. To disable it for an account, remove the `Stop` hook entry from that account's `~/.<brand>/.claude/settings.json`; there is no toggle.
 
 The memory graph is stored on your Pi. It never leaves your network.
 
@@ -74,18 +74,20 @@ The admin interface is a three-pane layout: a sidebar on the left with navigatio
 
 Page titles are brand-aware: the browser tab shows your product name (e.g. `Real Agent` instead of `Maxy`) on every shell — chat, graph, and data — so a non-default brand never leaks the default name in tab strips or browser history.
 
-**Session lifecycle and reconcile model.** The sidebar Sessions list is driven by a single Server-Sent Events feed at `/api/admin/claude-sessions/events`. The session manager watches the two directories Claude Code writes (`${CLAUDE_CONFIG_DIR}/sessions/<pid>.json` for live state, `${CLAUDE_CONFIG_DIR}/projects/<slug>/<sid>.jsonl` for transcripts) and emits `row-created`, `row-updated`, `row-archived`, or `row-removed` deltas to every connected browser tab. On connect the manager replays the current row index so a freshly-opened tab catches up without polling, then streams deltas as files change on disk. Two open tabs see the same list within ~300ms of any spawn, status flip, or exit; no refresh button required for state to be current. The legacy `/list` fetch and `useAdminSessions` hook stay mounted to serve the ConversationsModal and the post-action reconcile path in `session-actions`, but the sidebar's visible rows come from the row store, not from `/list`. Each EventSource open emits `[admin-events] client-connected ip=<…> seeded-rows=<n>` server-side and `[admin-ui] session-row-store connected events-received=<n>` in the browser console; transport drops log `[admin-ui] session-row-store reconnect trigger=<auto|manual> attempt=<n> delay-ms=<n>` until the EventSource reattaches. The small dot at the right edge of the Active/Archived/All segmented control is the live-updates indicator: sage when the SSE feed is connected, grey when the feed has dropped. The grey state is an actionable button — clicking it cancels any pending backoff and re-opens the feed immediately, with the click logged as `trigger=manual` so manual retries are distinguishable from automatic ones in the console.
+**Session lifecycle and reconcile model.** The sidebar Sessions list is driven by a single Server-Sent Events feed at `/api/admin/claude-sessions/events`. The session manager watches the two directories Claude Code writes (`${CLAUDE_CONFIG_DIR}/sessions/<pid>.json` for live state, `${CLAUDE_CONFIG_DIR}/projects/<slug>/<sid>.jsonl` for transcripts) and emits `row-created`, `row-updated`, `row-archived`, or `row-removed` deltas to every connected browser tab. Three real delete shapes map to deltas — there is no fourth: PID file gone with JSONL surviving demotes the row to `row-archived`; PID file gone with no JSONL ever written (the per-turn recorder case) emits `row-removed` against the unindexed sessionId; a JSONL deletion against an already-unindexed row also emits `row-removed`. The recorder branch is what reconciles transient hidden spawns — without it, ghost rows persist after the recorder exits. On connect the manager replays the current row index so a freshly-opened tab catches up without polling, then streams deltas as files change on disk. Two open tabs see the same list within ~300ms of any spawn, status flip, or exit; no refresh button required for state to be current. The legacy `/list` fetch and `useAdminSessions` hook stay mounted to serve the ConversationsModal and the post-action reconcile path in `session-actions`, but the sidebar's visible rows come from the row store, not from `/list`. Each EventSource open emits `[admin-events] client-connected ip=<…> seeded-rows=<n>` server-side and `[admin-ui] session-row-store connected events-received=<n>` in the browser console; transport drops log `[admin-ui] session-row-store reconnect trigger=<auto|manual> attempt=<n> delay-ms=<n>` until the EventSource reattaches. The small dot at the right edge of the Active/Archived/All segmented control is the live-updates indicator: sage when the SSE feed is connected, grey when the feed has dropped. The grey state is an actionable button — clicking it cancels any pending backoff and re-opens the feed immediately, with the click logged as `trigger=manual` so manual retries are distinguishable from automatic ones in the console.
 
 The row feed sits behind `requireAdminSession` like every other admin route, so the URL must carry `?session_key=<cacheKey>` — `EventSource` cannot send custom headers, so the query string is the only viable transport. Every admin URL (fetch and EventSource alike) routes through the shared `appendAdminSessionKey(url, cacheKey)` helper exported from `app/lib/useAdminFetch.ts`, which is the single source of truth for the convention; no caller constructs the query string by hand. On a 4xx rejection the browser-side store probes the same URL once per reconnect (suppressed after a successful `open`, capped at one fetch per attempt) and logs `[admin-ui] session-row-store sse-error status=<n> code=<code> attempt=<n>`. The `code` field uses the closed `AdminSessionRejectCode` taxonomy (`session-missing | session-not-registered | session-expired-age | grant-expired`, plus a default `unknown` bucket) that mirrors the server-side rejection emitted by `requireAdminSession`, so a single grep correlates client and server timelines on the same code.
 
 The trade-off is a longer-lived connection per tab: the manager's per-process subscriber count rises with open tabs, and the SSE channel must survive proxy idle timeouts. The manager emits a 25-second keep-alive comment line on every connection (ignored by EventSource consumers, refreshes the proxy clock) and the browser-side store force-closes-and-reconnects on transport errors with exponential backoff capped at 30s.
 
-**Spawn lifecycle: PID-file driven.** Clicking "+ New session" spawns the PTY and waits for Claude Code's PID file to appear at `${CLAUDE_CONFIG_DIR}/sessions/<pid>.json`. The PID file lands at process init (for `entrypoint: cli` spawns) and carries the intrinsic `sessionId`, `bridgeSessionId`, `agent`, and `status` directly. The manager's filesystem watcher reports the create event; the spawn response includes the canonical `sessionId` from that file. URL capture still runs in parallel to populate the operator-facing iframe URL, but it no longer gates readiness. The JSONL transcript is written on the first operator turn (true on 2.1.143 and 2.1.128); the watcher fires a separate event for that, and `/list`, `/meta`, `/log` resolve any of four ids — `sessionId`, `bridgeSessionId`, `bridgeSuffix`, or numeric `pid` — to the same row.
+**Spawn lifecycle: PID-file driven.** Clicking "+ New session" spawns the PTY and waits for Claude Code's PID file to appear at `${CLAUDE_CONFIG_DIR}/sessions/<pid>.json`. The PID file lands at process init (for `entrypoint: cli` spawns) and carries the intrinsic `sessionId`, `bridgeSessionId`, `agent`, and `status` directly. The manager's filesystem watcher reports the create event; the spawn response includes the canonical `sessionId` from that file. URL capture still runs in parallel to populate the operator-facing iframe URL, but it no longer gates readiness. The JSONL transcript is written on the first operator turn (true on 2.1.143 and 2.1.128); the watcher fires a separate event for that, and `/list`, `/meta`, `/log` resolve any of four ids — `sessionId`, `bridgeSessionId`, `bridgeSuffix`, or numeric `pid` — to the same row. Every fresh spawn also injects a first user turn so the agent has the stimulus the CLI needs to emit its first reply: the Sidebar's POST body carries `initialMessage` set to the current ISO-8601 UTC timestamp (e.g. `2026-05-18T13:15:45.398Z`), computed at click-time on the client. The server forwards it as `POST /<id>/input { text }` immediately after the spawn returns. The timestamp is the minimum-information opener — it has no instructional meaning, so the agent reads it as "begin", not as a directive to do something. Resume flows are unaffected (the prior transcript is the stimulus). Out of scope here: the *content* of the agent's reply, which is owned by the orchestrator's greeting rules.
 
 **Stop vs. delete.** `POST /<id>/stop` sends SIGTERM, leaves the JSONL on disk for audit, and is idempotent against an already-dead row. `DELETE /<id>` removes the JSONL + sidecar + per-session subdir and returns 409 if the PTY is still alive (stop first). Any unknown id returns 404; nothing returns a silent 204 against an id the manager does not know.
 
 The metadata pane subscribes to the same /list projection. When an operator clicks End on an alive row, the DELETE returns 200 and the post-mutation refetch decides what happens next: a session that wrote a JSONL surfaces as a dehydrated `status: 'ended'` row (the pane swaps `End session` for `Purge JSONL` plus `Resume`), and a session that never wrote a JSONL (`Turns: 0`) leaves the list entirely (the pane shows a `Session ended without a transcript. Close this pane.` banner with a Close button and no destructive action). The manager's `/list` and `/meta` are the only authorities on post-End state; the client does not pre-empt either response with an optimistic mutation.
 
+**Admin URL hygiene: `?sessionId=<id>` is retained only while `/meta` returns 200.** The shell hydrates `selectedSessionId` from the query-string on mount so a banner-click redirect can re-open a session. The first `/meta 404` (the session has been deleted out from under the slug) strips the query-string via `history.replaceState`, clears the selection, and emits `[admin-ui] stale-session-slug-stripped sessionId=<8-prefix> trigger=meta-404`. A reload from the dead URL therefore starts at base instead of re-resolving a 404.
+
 The Data search panel ranks results by combining vector similarity with keyword (BM25) matching. Each row shows a one-line score breakdown — `vector 0.NN · bm25 0.NN · combined 0.NN` — so you can tell whether a row surfaced because of meaning, exact-keyword match, or both. A bm25 column of `0.00` across every row means your search term wasn't in the keyword index, so ranking fell back to pure vector similarity (this can produce surprising results — the breakdown tells you when to interpret with caution). Above the result list, a chip row shows the unique types in your current results — click one to filter, click again to clear. Click any row to jump straight to that node's neighbourhood in the Graph; from the artefact pane the graph opens alongside chat, from the standalone Data page it opens in place.
 
 ## Software Update and Cloudflare Setup

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAA0E,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAIzH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AA8E3D,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACvF,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;CAC/B;AA0DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CA0tBjD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAI3B,OAAO,KAAK,EAAE,YAAY,EAAiB,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAA0E,KAAK,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAIzH,OAAO,KAAK,EAAE,SAAS,EAAc,MAAM,iBAAiB,CAAA;AAE5D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AA8E3D,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,OAAO,GAAG,gBAAgB,GAAG,SAAS,CAAC;IACvF,KAAK,EAAE,YAAY,CAAA;IACnB,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;CAC/B;AA0DD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,CA4uBjD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -265,6 +265,9 @@ export function buildHttpApp(deps) {
         const specialist = typeof body.specialist === 'string' && /^[A-Za-z0-9_-]{1,64}$/.test(body.specialist)
             ? body.specialist
             : undefined;
+        const stdinPayload = typeof body.stdinPayload === 'string' && body.stdinPayload.length > 0
+            ? body.stdinPayload
+            : undefined;
         const aboutOwnerShape = body.aboutOwner == null ? 'absent' : (typeof body.aboutOwner === 'object' ? 'object' : typeof body.aboutOwner);
         const dormantPluginsShape = Array.isArray(body.dormantPlugins)
             ? `array(${body.dormantPlugins.length})`
@@ -316,6 +319,7 @@ export function buildHttpApp(deps) {
             specialistDomains,
             hidden,
             specialist,
+            stdinPayload,
         });
         if (!result.ok) {
             if ('rejected' in result) {
@@ -399,8 +403,10 @@ export function buildHttpApp(deps) {
             // the four SSE event kinds. Mapping:
             //   create  → row-created
             //   modify  → row-updated   (state may have flipped — see archive)
-            //   delete  → row-removed when the row is fully gone, row-archived
-            //             when the PID file went away but the JSONL survives.
+            //   delete  → three real cases:
+            //     pid    + row present  → row-archived (PID gone, JSONL survives)
+            //     pid    + row null     → row-removed  (PID gone, no JSONL ever existed)
+            //     jsonl  + row null     → row-removed  (JSONL deleted, row unindexed)
             const unsubscribe = deps.watcher.subscribe((event) => {
                 if (!active)
                     return;
@@ -416,6 +422,16 @@ export function buildHttpApp(deps) {
                     void out.write(`event: row-archived\ndata: ${JSON.stringify(payload)}\n\n`);
                     return;
                 }
+                // Recorder case: PID file disappeared before any JSONL was ever
+                // written. Row is unindexed at the manager. Without this branch
+                // the row falls through `if (!event.row) return` below and the
+                // client sidebar keeps showing a session that no longer exists.
+                if (event.kind === 'delete' && event.source === 'pid' && !event.row) {
+                    subscribersCount += 1;
+                    deps.logger(`[admin-events] emit event=row-removed sessionId=${event.sessionId} subscribers=1`);
+                    void out.write(`event: row-removed\ndata: ${JSON.stringify({ sessionId: event.sessionId })}\n\n`);
+                    return;
+                }
                 if (event.kind === 'delete' && event.source === 'jsonl' && !event.row) {
                     subscribersCount += 1;
                     deps.logger(`[admin-events] emit event=row-removed sessionId=${event.sessionId} subscribers=1`);