@rubytech/create-maxy-code 0.1.460 → 0.1.461

package/payload/platform/scripts/__tests__/resume-tunnel.test.sh

@@ -619,6 +619,83 @@ case_refuse_on_invalid_state_json() {
   return 0
 }
 
+# Task 1706 — the rotator's lock must be held across the offset-capture →
+# verification-poll window. logs-rotate.sh truncates cloudflared.log in place
+# when it exceeds 64 MiB; a rotation landing inside this window makes
+# `tail -c "+$LOG_OFFSET"` read past EOF and report a tunnel failure that did
+# not happen.
+case_holds_rotate_lock_during_verify() {
+  local root
+  root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+
+  local log_dir="$root/home/.maxy-code/logs"
+  local marker="$root/lock-was-held"
+
+  # Poll for the lock's existence while the script runs. The verify gate is the
+  # window under test, so a single observation of the lock proves it was held
+  # across it.
+  ( for _ in $(seq 1 60); do
+      [[ -d "$log_dir/.rotate.lock" ]] && { touch "$marker"; break; }
+      sleep 0.05
+    done ) &
+  local watcher=$!
+
+  HOME="$root/home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME" >/dev/null 2>&1
+  local rc=$?
+  wait "$watcher" 2>/dev/null
+
+  local held=0 leaked=0
+  [[ -e "$marker" ]] && held=1
+  [[ -d "$log_dir/.rotate.lock" ]] && leaked=1
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then
+    echo "  expected exit 0, got $rc"; return 1
+  fi
+  if [[ $held -ne 1 ]]; then
+    echo "  rotate lock was never held during the verify window"; return 1
+  fi
+  if [[ $leaked -ne 0 ]]; then
+    echo "  rotate lock not released after the verify window"; return 1
+  fi
+  return 0
+}
+
+# A lock already held (by a live rotator tick) must not stop the tunnel coming
+# up. A false-alarm verify line is a far smaller failure than no tunnel.
+case_busy_rotate_lock_does_not_block_spawn() {
+  local root
+  root=$(mktemp -d /tmp/resume-tunnel-test-XXXXXX)
+  setup "$root" ".maxy-code" "inactive" "yes"
+
+  mkdir -p "$root/home/.maxy-code/logs/.rotate.lock"
+
+  HOME="$root/home" \
+  PATH="$root/bin:$PATH" \
+  MAXY_PLATFORM_ROOT="$root/platform_root" \
+    bash "$RESUME" >/dev/null 2>&1
+  local rc=$?
+
+  local log_content
+  log_content=$(cat "$root/home/.maxy-code/logs/cloudflared.log" 2>/dev/null || echo "")
+  cleanup "$root"
+
+  if [[ $rc -ne 0 ]]; then
+    echo "  expected exit 0, got $rc"; return 1
+  fi
+  if ! echo "$log_content" | grep -q "spawned service=cloudflared-maxy-code.service"; then
+    echo "  a busy rotate lock blocked the tunnel spawn"; echo "$log_content"; return 1
+  fi
+  if ! echo "$log_content" | grep -q "rotate-lock busy"; then
+    echo "  proceeding without the lock was not logged"; echo "$log_content"; return 1
+  fi
+  return 0
+}
+
 run_case "skip when service active" case_skip_when_scope_active
 run_case "spawn succeeds and logs verified" case_spawn_succeeds
 run_case "spawn with no connection logs ERROR exits 0" case_spawn_no_connection
@@ -635,6 +712,8 @@ run_case "reap: skip when active unit's MainPID is unresolved" case_reap_skip_wh
 run_case "token tunnel spawns without --origincert" case_token_tunnel_spawns_without_origincert
 run_case "configured tunnel with no run credential refuses loudly" case_refuse_when_no_run_credential
 run_case "corrupt tunnel.state refuses loudly and exits 0" case_refuse_on_invalid_state_json
+run_case "holds the rotate lock during verify" case_holds_rotate_lock_during_verify
+run_case "busy rotate lock does not block spawn" case_busy_rotate_lock_does_not_block_spawn
 
 echo ""
 echo "Results: $PASS passed, $FAIL failed"

package/payload/platform/scripts/logs-rotate.sh

@@ -0,0 +1,204 @@
+#!/usr/bin/env bash
+# Brand log rotation — Task 1706.
+#
+# WHY THIS EXISTS AND NOT logrotate: server.log, edge.log and cloudflared.log
+# are systemd stdout sinks (`StandardOutput=append:`, see
+# packages/create-maxy-code/src/port-resolution.ts:233 and
+# platform/scripts/resume-tunnel.sh:230). systemd opens the file O_APPEND ONCE
+# at unit start and the process holds that fd for its whole life. logrotate's
+# default rename-then-create would leave every service writing into the rotated
+# inode forever — rotation would look like it worked while the live file stayed
+# empty. So we gzip a COPY and truncate IN PLACE: because the fd is O_APPEND,
+# each write seeks to end-of-file first, so writes resume at offset 0 with no
+# service restart and no sparse hole. Verified against a real systemd unit on
+# 2026-07-17 (laptop 192.168.88.10): NRestarts=0, file 71 -> 0 -> 80 bytes for
+# 10 fresh lines. Never replace `: > "$F"` with a mv.
+#
+# Portability: this runs on Linux (cron) and darwin (launchd StartInterval), so
+# no flock(1) (absent on darwin) and no `date +%N` (GNU-only). The lock is a
+# mkdir, which is atomic on both. find's -mmin/-mtime/-delete and the timestamp
+# format were confirmed identical on both platforms.
+#
+# Usage: logs-rotate.sh [LOGS_DIR]
+set -uo pipefail
+
+ROTATE_SIZE_BYTES=$((64 * 1024 * 1024))
+KEEP=5
+STALE_LOCK_MINUTES=30
+
+# Resolve the logs dir the same way logs-read.sh:52-58 does: convention is
+# configDir = ".${installDir}".
+if [ "$#" -ge 1 ] && [ -n "${1:-}" ]; then
+  LOGS_DIR="$1"
+else
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+  LOGS_DIR="$HOME/.$(basename "$INSTALL_DIR")/logs"
+fi
+
+# Absent logs dir is not an error: the installer creates it, and a rotator tick
+# that lands before the first install completes has nothing to do.
+[ -d "$LOGS_DIR" ] || exit 0
+
+LOCK="$LOGS_DIR/.rotate.lock"
+
+stamp() { date -u +%Y-%m-%dT%H:%M:%SZ; }
+
+# A mkdir lock is NOT released by the kernel when its holder dies, so a crashed
+# rotator would wedge rotation permanently and silently — worse than the race
+# the lock prevents. Reclaim on age: 30 min is two rotator ticks and 90x
+# resume-tunnel.sh's 20s window, so no live holder is mistaken for a dead one.
+#
+# The reclaim moves the stale lock aside with `mv` before recreating it, rather
+# than `rm -rf`-then-mkdir. `mv` is the atomic gate: if two ticks both see the
+# same stale lock, only one can move that inode — the loser's `mv` fails because
+# the source is already gone, and it backs off. rm-then-mkdir had no such gate:
+# the loser would delete the winner's brand-new lock and both would rotate,
+# shifting generations twice for one new .1.gz.
+acquire_lock() {
+  if mkdir "$LOCK" 2>/dev/null; then return 0; fi
+  if [ -d "$LOCK" ] && [ -z "$(find "$LOCK" -maxdepth 0 -mmin -"$STALE_LOCK_MINUTES" 2>/dev/null)" ]; then
+    local stale="$LOCK.stale.$$"
+    mv "$LOCK" "$stale" 2>/dev/null || return 1   # lost the reclaim race
+    rm -rf "$stale" 2>/dev/null
+    echo "$(stamp) [logs-rotate] stale-lock-reclaimed lock=$LOCK age-min=>$STALE_LOCK_MINUTES"
+    mkdir "$LOCK" 2>/dev/null && return 0          # a third tick may have won; then back off
+  fi
+  return 1
+}
+
+if ! acquire_lock; then
+  # Another rotator tick, or a resume-tunnel.sh verification window, is live.
+  # Exit 0: the next tick is 15 min away and the bound is not tight enough for
+  # a skipped tick to matter.
+  echo "$(stamp) [logs-rotate] skipped reason=lock-held lock=$LOCK"
+  exit 0
+fi
+trap 'rmdir "$LOCK" 2>/dev/null || true' EXIT
+
+size_of() { wc -c < "$1" 2>/dev/null | awk '{print $1+0}'; }
+
+# Size-rotate one file: gzip a copy to a temp, shift older generations, move the
+# temp into .1.gz, truncate in place, then mark the truncation so the file is
+# never mistaken for one that simply starts there.
+#
+# ORDER IS LOAD-BEARING: gzip FIRST, shift only once it succeeded. The shift used
+# to run first, so a gzip failure moved .4->.5 ... .1->.2 and wrote nothing to
+# .1 — dropping the oldest generation and leaving a hole, on every tick. The
+# trigger is ENOSPC, i.e. precisely the condition rotation exists to prevent: 75
+# minutes of a full disk destroyed 4 of the 5 retained generations while
+# correctly refusing to truncate. Never hoist the shift above the gzip.
+rotate_file() {
+  local f="$1" base size i prev
+  [ -f "$f" ] || return 0
+  size="$(size_of "$f")"
+  [ "$size" -gt "$ROTATE_SIZE_BYTES" ] || return 0
+  base="$(basename "$f")"
+
+  # gzip to a temp first, so a failure (or a tick killed mid-compress) costs
+  # nothing: no generation has moved and the live file is untouched.
+  #
+  # gzip's stderr is CAPTURED, not discarded, and relayed verbatim on failure —
+  # it is the only thing that distinguishes ENOSPC from EACCES from a missing
+  # binary. `2>&1 >file` sends stderr to the command substitution and stdout to
+  # the temp; the order matters.
+  #
+  # A live log grows while gzip reads it, so gzip emits "file size changed while
+  # zipping" on nearly every real rotation. That is a WARNING and gzip still
+  # exits 0 (verified on the laptop against a file being appended to during the
+  # read), so it takes the success path and the noise is never logged. Only a
+  # genuine non-zero exit reaches the branch below.
+  local gzerr
+  gzerr="$(gzip -c "$f" 2>&1 >"$f.1.gz.tmp")"
+  if [ $? -ne 0 ]; then
+    rm -f "$f.1.gz.tmp"
+    echo "$(stamp) [logs-rotate] ERROR file=$base reason=gzip-failed bytes=$size err=$(printf '%s' "$gzerr" | tr '\n' ' ') — not truncated, generations intact"
+    return 1
+  fi
+
+  # Shift down from the oldest so nothing is overwritten before it moves. The
+  # KEEP-th generation is overwritten by the (KEEP-1)-th, which is how the
+  # oldest falls off.
+  i="$KEEP"
+  while [ "$i" -gt 1 ]; do
+    prev=$((i - 1))
+    [ -f "$f.$prev.gz" ] && mv -f "$f.$prev.gz" "$f.$i.gz"
+    i="$prev"
+  done
+  mv -f "$f.1.gz.tmp" "$f.1.gz"
+
+  # THE load-bearing line. Truncate in place; do not mv. See the header.
+  #
+  # Lines written between gzip reaching EOF and this truncate are LOST. gzip
+  # reads to the CURRENT end of file, so the window is the shift plus two mvs —
+  # milliseconds, not the seconds the gzip itself takes. Inherent to
+  # copy-truncate, which the O_APPEND fd leaves no way around.
+  #
+  # `size` was sampled BEFORE gzip ran, so on a live log the archive legitimately
+  # holds slightly MORE than prev-bytes reports. prev-bytes locates the seam
+  # approximately, not exactly. See .docs/brand-log-retention.md.
+  : > "$f"
+  echo "$(stamp) [logs-rotate] rotated file=$base prev-bytes=$size prev-file=$base.1.gz keep=$KEEP" >> "$f"
+}
+
+PURGE_DAYS=7
+
+for f in server.log edge.log cloudflared.log check-due-events.log; do
+  rotate_file "$LOGS_DIR/$f"
+done
+
+# Globbed size targets. nullglob so a brand with none of these yet does not try
+# to rotate a literal '*' path.
+#
+# mcp-*-stderr-*.log: the tee holds a live write stream, so this is the ONLY
+# bound it gets here — see the purge note below for why it is never age-purged.
+#
+# rc-child-*.log: its 16 MiB writer cap does NOT hold. `written`
+# (rc-child-log.ts:33) is in-memory per manager process, so a manager restart
+# resumes appending to the same path with a fresh counter. Observed at 54 MB on
+# sitedesk-code, 3.25x the cap. A long-lived session's file also has a fresh
+# mtime forever, so the age purge below never reaches it — without size rotation
+# it is genuinely unbounded.
+shopt -s nullglob
+for f in "$LOGS_DIR"/mcp-*-stderr-*.log "$LOGS_DIR"/rc-child-*.log; do
+  rotate_file "$f"
+done
+shopt -u nullglob
+
+# Age purge — rc-child only.
+#
+# rc-child-*.log is one file per session and the set grows without bound (100 on
+# sitedesk-code). Purging it is SAFE because rc-child-log.ts:51 writes with
+# appendFileSync: no fd is held, so a purged file is simply recreated on the
+# next write.
+#
+# mcp-*-stderr-*.log is deliberately NOT purged, though an earlier draft did.
+# The tee (mcp-stderr-tee/src/index.ts:88) opens a createWriteStream at process
+# start and holds it for the process's whole life, writing only when the server
+# emits stderr — which a healthy server does not do for days. So a LIVE file's
+# mtime DOES go stale, and deleting it would send every later stderr write to an
+# unlinked inode: invisible exactly when the fault you are chasing finally
+# appears, and its disk unreclaimed until the process exits. Bounding these by
+# age needs live-vs-dead discrimination, which needs the writer to stop pinning
+# its date at boot — that is Task 1721. Size rotation above is safe regardless,
+# because truncate-in-place is precisely what a held fd tolerates.
+#
+# The pattern is `.log*` so a purged session's rotated .gz generations go too.
+# `find` matches each path by its own mtime — there is no sibling relationship —
+# so a LIVE rc-child's generations also age out at 7 days. That is intended:
+# retention for rc-child is min(KEEP, 7 days), and 7 days of a session's spawn
+# output is the stated bound.
+# One traversal, and the count is what was actually deleted rather than what a
+# separate counting pass saw a moment earlier. `-print` before `-delete` prints
+# each path as it goes.
+purge_old() {
+  local pattern="$1" n
+  n="$(find "$LOGS_DIR" -maxdepth 1 -name "$pattern" -type f -mtime +"$PURGE_DAYS" -print -delete 2>/dev/null | wc -l | awk '{print $1+0}')"
+  [ "$n" -gt 0 ] || return 0
+  echo "$(stamp) [logs-rotate] purged pattern=$pattern files=$n older-than-days=$PURGE_DAYS"
+}
+
+purge_old 'rc-child-*.log*'
+
+exit 0

package/payload/platform/scripts/resume-tunnel.sh

@@ -194,6 +194,24 @@ log "Resuming tunnel $TUNNEL_ID for $DOMAIN..."
 # Capture log byte offset before spawning so the verification poll only
 # matches lines written by THIS invocation, not lines from a prior run.
 mkdir -p "$LOG_DIR"
+
+# Task 1706 — hold the log rotator's lock across offset-capture → verify-poll.
+# logs-rotate.sh truncates cloudflared.log in place when it exceeds 64 MiB; a
+# rotation landing inside this window makes `tail -c "+$LOG_OFFSET"` read past
+# EOF and report a tunnel failure that did not happen. Same mkdir primitive as
+# the rotator (no flock(1) on darwin, and a lock is only a lock if both ends
+# agree). Best-effort: if the lock cannot be taken we proceed anyway rather than
+# refuse to bring the tunnel up — a false-alarm log line is a far smaller
+# failure than a tunnel that never starts.
+ROTATE_LOCK="$LOG_DIR/.rotate.lock"
+ROTATE_LOCK_HELD=0
+if mkdir "$ROTATE_LOCK" 2>/dev/null; then
+  ROTATE_LOCK_HELD=1
+  trap 'rmdir "$ROTATE_LOCK" 2>/dev/null || true' EXIT
+else
+  log "rotate-lock busy — proceeding without it; a concurrent rotation may skew the verify gate"
+fi
+
 LOG_OFFSET=$(wc -c < "$LOG_FILE" 2>/dev/null | awk '{print $1+0}' || echo 0)
 
 # Spawn into a SUPERVISED transient service under cloudflared.slice (Task 757).
@@ -264,6 +282,15 @@ else
   log "ERROR: tunnel service started but no edge connection within ${VERIFY_DEADLINE}s — service=$SERVICE_UNIT"
 fi
 
+# Task 1706 — release the rotator's lock. The verify gate above is the only
+# offset-sensitive window, so holding it past here would make a rotator tick
+# skip for no reason.
+if [ "$ROTATE_LOCK_HELD" -eq 1 ]; then
+  rmdir "$ROTATE_LOCK" 2>/dev/null || true
+  ROTATE_LOCK_HELD=0
+  trap - EXIT
+fi
+
 # Update state file: keep pid/startedAt for observability, add serviceUnit as control signal.
 NEW_STATE=$(echo "$STATE" | jq \
   --arg unit "$SERVICE_UNIT" \

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAkCzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAgBN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA0+FpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAkCzB,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AAEvE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAGvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CAgBN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA+gGpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -3306,7 +3306,9 @@ export function buildHttpApp(deps) {
         // non-allowlisted channel like whatsapp) prints an interactive prompt
         // ("Loading development channels … ❯ 1. I am using this for local
         // development … Enter to confirm") that a programmatic spawn cannot answer,
-        // hanging the boot until pid-bind-timeout. Detect it once and send Enter to
+        // hanging the boot until the bind wait elapses (a blocked child writes no
+        // pid file, so Task 1716 classifies it `outcome=failed`, and `blocker=` on
+        // op=bind-signal-absent names the screen). Detect it once and send Enter to
         // select option 1. The prompt is laid out with cursor-position escapes and
         // no literal spaces, so match on the ANSI/space-stripped letter stream.
         // Bounded startup keystroke only — inbound message submission stays a
@@ -3359,7 +3361,12 @@ export function buildHttpApp(deps) {
         // by `registerRcSpawnPty`) handles the tracker side — fd release +
         // tracker delete + the `kill … reason=process-exited` log.
         let pidFileSeen = false;
+        // Task 1716 — the second half of the bind verdict's discriminator. Set
+        // first, so a child that has already gone can never be read as still
+        // running by the decision below.
+        let ptyExited = false;
         pty.onExit((e) => {
+            ptyExited = true;
             const ranMs = Date.now() - start;
             if (!pidFileSeen) {
                 deps.logger(`[rc-spawn] op=early-exit unitToken=${unitToken} pid=${pty.pid} ranMs=${ranMs} exitCode=${e.exitCode} signal=${e.signal ?? 'none'}`);
@@ -3490,8 +3497,33 @@ export function buildHttpApp(deps) {
         // through the proxy unchanged so the client decides modal-vs-navigate
         // from one server-supplied value.
         const waitedMs = Date.now() - start;
-        const outcome = bridgeSessionId ? 'bound' : 'timeout';
-        const reason = outcome === 'bound' ? null : 'pid-bind-timeout';
+        // Task 1716 — the bind signal certifies that a remote-control BRIDGE
+        // exists, not that the session is usable. Device evidence 2026-07-17: a
+        // child can attach its channel, drain and serve a full turn while
+        // registering no bridge at all — no stdout banner, and a pid file carrying
+        // every field except `bridgeSessionId`. Both signals then correctly report
+        // "no bridge", so slug-absence alone cannot mean the spawn failed.
+        //
+        // The verdict is therefore derived from the child's real state at decision
+        // time, which is why a "failed" verdict cannot coexist with a healthy
+        // session by construction:
+        //   bound    — a slug arrived on either signal.
+        //   unbound  — no slug, but the child wrote its pid file and is still
+        //              running: usable, simply not navigable from claude.ai/code.
+        //   failed   — no slug and the child never became a running registered
+        //              session (it died, or is stuck on a blocking screen; the
+        //              `blocker=` field on op=bind-signal-absent names which).
+        const outcome = bridgeSessionId
+            ? 'bound'
+            : pidFileSeen && !ptyExited
+                ? 'unbound'
+                : 'failed';
+        // `reason` is the string the client renders in its error modal
+        // (Sidebar.tsx::resolveRcSpawnOutcome). Neither value names a pid bind:
+        // the wait has been on the stdout banner since Task 662, and the old
+        // `pid-bind-timeout` sent every reader to the wrong mechanism. Nor does
+        // `spawn-not-ready` claim an exit — a blocked-but-alive child never exits.
+        const reason = outcome === 'bound' ? null : outcome === 'unbound' ? 'bridge-unregistered' : 'spawn-not-ready';
         // Task 1406 — derive the child's first-turn auth verdict. A bound child
         // authenticated; an unbound child that printed `Not logged in` is the
         // file-healthy-but-child-unauthenticated signature this task closes. Emitted
@@ -3507,8 +3539,12 @@ export function buildHttpApp(deps) {
             // file produced a slug within the bound. This distinct marker names the
             // artifact the manager waited for and the CLI version that produced
             // neither, so a future CLI drift is read from one log line instead of
-            // re-derived by reproduction. `reason=pid-bind-timeout` (below) is kept
-            // unchanged so the client still renders the bind-timeout modal.
+            // re-derived by reproduction.
+            //
+            // Task 1716 — this line fires for BOTH non-bound outcomes, which are not
+            // the same event: `stdoutBytes` + `pidFileSeen` are what separate a dead
+            // child (near-silent, no pid file) from a healthy unbound one (chatty,
+            // pid file present, serving turns). Read them before concluding drift.
             //
             // Task 664 — scan the captured child stdout for the known blocking-screen
             // markers and name the matched one (`blocker=`). `bindBuf` holds the 8 KB