@rubytech/create-maxy-code 0.1.491 → 0.1.493

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-index-push.test.ts

@@ -309,13 +309,85 @@ function generationClient() {
         return []
       }
       if (/DELETE FROM directory\b/i.test(sql)) {
-        const keep = Number(params[1])
-        for (let i = rows.length - 1; i >= 0; i--) {
-          if (rows[i].generation !== keep) rows.splice(i, 1)
+        const g = Number(params[1])
+        // Two DELETE shapes reach this client: the post-flip sweep removes
+        // every OTHER generation (`generation != ?`); the pre-stage clear
+        // (Task 1923) removes exactly THIS generation (`generation = ?`).
+        if (/generation\s*!=\s*\?/i.test(sql)) {
+          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation !== g) rows.splice(i, 1)
+        } else {
+          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation === g) rows.splice(i, 1)
         }
         return []
       }
       if (/SELECT COUNT/i.test(sql)) {
+        // The pre-stage orphan count (Task 1923) filters `generation = ?`; the
+        // verify count joins the pointer. Only the former binds a generation.
+        if (/generation\s*=\s*\?/i.test(sql)) {
+          const g = Number(params[1])
+          return [{ n: rows.filter((r) => r.generation === g).length }]
+        }
+        return [{ n: rows.filter((r) => r.generation === pointer).length }]
+      }
+      return []
+    },
+  }
+}
+
+// The wedge Task 1923 fixes: a stage that half-completed on a D1 500 leaves
+// orphan rows at the NEXT generation while the pointer stays at current. This
+// client models the one property that turns that into a permanent freeze — the
+// D1 UNIQUE(accountId, relPath, generation) constraint — by throwing on a
+// colliding INSERT, exactly as every later cycle's first re-stage did.
+function wedgeableClient(seed: { pointer: number; current?: string[]; orphans: string[] }) {
+  const calls: { sql: string; params: unknown[] }[] = []
+  const rows: { accountId: string; relPath: string; generation: number }[] = []
+  let pointer: number | null = seed.pointer
+  const orphanGen = seed.pointer + 1
+  // The last good tree the pointer names, present in a real wedge alongside the
+  // orphans. Seeding it proves the pre-stage clear scopes to `next` and leaves
+  // the reader-visible current generation untouched.
+  for (const relPath of seed.current ?? []) rows.push({ accountId: 'acc-1', relPath, generation: seed.pointer })
+  for (const relPath of seed.orphans) rows.push({ accountId: 'acc-1', relPath, generation: orphanGen })
+  return {
+    calls,
+    rows,
+    pointerValue: () => pointer,
+    async query(sql: string, params: unknown[] = []) {
+      calls.push({ sql, params })
+      if (/SELECT\s+currentGeneration/i.test(sql)) {
+        return pointer === null ? [] : [{ currentGeneration: pointer }]
+      }
+      if (/INSERT INTO directory_state|UPDATE directory_state/i.test(sql)) {
+        pointer = Number(params[1] ?? params[0])
+        return []
+      }
+      if (/INSERT INTO directory \(/i.test(sql)) {
+        const accountId = String(params[0])
+        const relPath = String(params[1])
+        const generation = Number(params[6])
+        if (rows.some((r) => r.accountId === accountId && r.relPath === relPath && r.generation === generation)) {
+          throw new Error(
+            'd1 query failed: HTTP 500 — UNIQUE constraint failed: directory.accountId, directory.relPath, directory.generation',
+          )
+        }
+        rows.push({ accountId, relPath, generation })
+        return []
+      }
+      if (/DELETE FROM directory\b/i.test(sql)) {
+        const g = Number(params[1])
+        if (/generation\s*!=\s*\?/i.test(sql)) {
+          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation !== g) rows.splice(i, 1)
+        } else {
+          for (let i = rows.length - 1; i >= 0; i--) if (rows[i].generation === g) rows.splice(i, 1)
+        }
+        return []
+      }
+      if (/SELECT COUNT/i.test(sql)) {
+        if (/generation\s*=\s*\?/i.test(sql)) {
+          const g = Number(params[1])
+          return [{ n: rows.filter((r) => r.generation === g).length }]
+        }
         return [{ n: rows.filter((r) => r.generation === pointer).length }]
       }
       return []
@@ -323,6 +395,42 @@ function generationClient() {
   }
 }
 
+describe('a partial stage self-heals (Task 1923)', () => {
+  it('clears orphans at the next generation, flips onto it, and logs stage-clear', async () => {
+    // Pointer at 5 naming the last good tree; three orphan rows already at
+    // generation 6 for relPaths the current walk re-stages ('output' is the
+    // walk's first row, so the current code's first INSERT is the one that
+    // collides). Without the pre-stage clear that INSERT throws on the UNIQUE
+    // constraint and the push fails, which is what froze gls-data for ~6 h on
+    // 2026-07-22.
+    const c = wedgeableClient({
+      pointer: 5,
+      current: ['output', 'output/report.pdf', 'quotes', 'quotes/CR2969'],
+      orphans: ['output', 'output/report.pdf', 'quotes'],
+    })
+    const lines: string[] = []
+    const r = await push(c, { log: (l: string) => lines.push(l) })
+
+    expect(r.rows).toBe(7)
+    expect(c.pointerValue()).toBe(6)
+    // Nothing survives at a generation the pointer does not name.
+    expect(c.rows.every((row) => row.generation === 6)).toBe(true)
+    const clear = lines.find((l) => l.includes('op=stage-clear'))!
+    expect(clear).toContain('account=acc-1')
+    expect(clear).toContain('generation=6')
+    // Exactly the 3 orphans at generation 6, not the 4 current-tree rows the
+    // pointer names: the clear scopes to `next`, never to a reader-visible row.
+    expect(clear).toContain('cleared=3')
+  })
+
+  it('emits no stage-clear line on a clean cycle with no orphans', async () => {
+    const c = wedgeableClient({ pointer: 5, orphans: [] })
+    const lines: string[] = []
+    await push(c, { log: (l: string) => lines.push(l) })
+    expect(lines.some((l) => l.includes('op=stage-clear'))).toBe(false)
+  })
+})
+
 describe('the index replace is atomic', () => {
   it('never issues a delete before the pointer flip', async () => {
     // The delete-then-insert window this replaces was Task 1842: a client

package/payload/platform/plugins/cloudflare/mcp/__tests__/portal-indexed-download.test.ts

@@ -60,6 +60,7 @@ const deadHead = async () => {
   throw new Error('ECONNREFUSED')
 }
 const errHead = async () => ({ ok: false, status: 502 })
+const missingHead = async () => ({ ok: false, status: 404 })
 
 describe('processIndexedDownload', () => {
   it('returns a signed url for an indexed file when the device answers', async () => {
@@ -87,6 +88,18 @@ describe('processIndexedDownload', () => {
     expect(r.payload.error).toBe('device-offline')
   })
 
+  // A live device that answers 404 means the indexed row is stale: the file was
+  // renamed or removed while the index was frozen. That is "refresh the list",
+  // not "the device is down", so it must not collapse into device-offline.
+  it('reports file-missing when a reachable device 404s the path', async () => {
+    const lines: string[] = []
+    const r = await processIndexedDownload('sess-a', PATH, makeEnv(), (l) => lines.push(l), 1000, missingHead as never)
+    expect(r.status).toBe(404)
+    expect(r.payload.error).toBe('file-missing')
+    expect(r.url).toBeUndefined()
+    expect(lines.some((l) => l.includes('result=file-missing'))).toBe(true)
+  })
+
   it('404s a path that is not in the index, without contacting the device', async () => {
     let touched = false
     const spy = async () => {

package/payload/platform/plugins/cloudflare/mcp/__tests__/template-config.test.ts

@@ -55,10 +55,14 @@ describe('schema.sql', () => {
   })
 })
 
-// The broker runs `wrangler pages deploy <dir>` with <dir> = the site root, so
-// the positional directory IS the asset root and pages_build_output_dir is
-// overridden. A nested public/ therefore publishes the site one level too deep
-// and `/` returns 404 — the live failure Task 1774 closes.
+// The template's flat shape and its `pages_build_output_dir = "."` have to agree,
+// because the two together are what puts index.html at the served root. Until
+// Task 1917 the broker handed wrangler the site root as the positional asset
+// directory, which overrode the declared output dir, so a nested public/ served
+// the site one level too deep and `/` returned 404 — the live failure Task 1774
+// closed by flattening. Since 1917 the broker publishes the declared output dir,
+// so a mismatch here no longer 404s; these assertions keep the shipped template
+// on the one shape that is deployed and measured.
 describe('template layout matches what the deploy publishes', () => {
   it('has no public/ level', () => {
     expect(existsSync(join(TEMPLATE, 'public'))).toBe(false)

package/payload/platform/plugins/cloudflare/references/hosting-sites.md

@@ -33,7 +33,7 @@ If the site captures form data, add the `[[d1_databases]]` binding from `d1-data
 
 ## 3. Load the reused deploy token
 
-> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool.
+> **On a multi-tenant install, a client account does not run this step at all.** After the 1631 storage isolation, a client's `cloudflare.env` carries no master, and `cf-token.sh` denies it the `pages` scope (`reason=not-house`) — correctly, since that master is account-wide. A client account publishes with the `storage-pages-deploy` tool, which runs the deploy house-side; the project must already be recorded to the account by the house (`storage-pages-adopt`), because the project-to-folder mapping is not derivable and is never guessed. The rest of this section applies to the **house account and single-tenant installs**, where the master still lives in the account secrets file. If you are a client account and you reached a `not-house` denial here, that is this branch, not a broken token: use the tool. The tool reads `pages_build_output_dir` from the site root's `wrangler.toml` (or `wrangler.json`/`.jsonc`) and publishes that directory as the served root, which is the same asset root step 4 below passes positionally. A declared output dir that is missing fails the deploy naming the path rather than publishing its parent.
 
 A Pages deploy needs **Account · Cloudflare Pages · Edit**. If the site has Pages Functions hitting D1, the token also needs **Account · D1 · Edit** (the single most common breakage — see `d1-data-capture.md`). The `pages` scope resolves the stable `<brand>-pages-d1` token, which carries both. Resolve it with the deterministic helper, which mints it once only if absent and reuses it thereafter. This is the one command; do not source the secrets file and hand the resulting `CLOUDFLARE_API_TOKEN` to `wrangler` — that variable holds the **master**, not the per-scope token, and `wrangler pages` then returns `Authentication error [code: 10000]`:
 

package/payload/platform/plugins/cloudflare/skills/data-portal/SKILL.md

@@ -98,11 +98,11 @@ Copy `template/` to `<accountDir>/sites/<project>/` and fill `wrangler.toml`'s `
 placeholder in the assembled tree.**
 
 `sites/<project>/` is the only location the broker will publish: `resolveSiteDir` resolves
-`<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat because
-the deploy publishes the directory it is handed — `index.html`, `portal.css`, `portal.js`,
+`<accountDir>/sites/<name>` and refuses anything else with `invalid-site`. The tree is flat: `index.html`, `portal.css`, `portal.js`,
 `functions/` and `wrangler.toml` all sit at its root, with no nested asset level, and
-`pages_build_output_dir` reads `"."` to match. A nested asset level publishes the site one level too
-deep, which serves 404 at the domain root.
+`pages_build_output_dir` reads `"."` to match. The deploy publishes whatever
+directory `pages_build_output_dir` declares, so the two must agree; a nested asset level that the
+config does not declare publishes the site one level too deep, which serves 404 at the domain root.
 
 The deploy serves everything in that tree except a fixed ignore list — `functions/`, `_worker.js`,
 `_redirects`, `_headers`, `_routes.json`, `node_modules`, `.git`, `.DS_Store`, `.wrangler` — and

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -171,6 +171,18 @@ export async function processIndexedDownload(
   try {
     const head = await fetchFn(url, { method: 'HEAD' })
     if (!head.ok) {
+      if (head.status === 404) {
+        // The device answered, so it is not down: this row is stale. The file
+        // was renamed or removed while the index was frozen, and the device
+        // returns the same 404 for a path that is missing and one that is not
+        // exposed — so this cannot and must not try to tell those apart. The
+        // client's remedy is "refresh the list", not "wait for the device".
+        log(
+          `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} ` +
+            `status=404 ms=${Date.now() - started} result=file-missing`,
+        )
+        return { status: 404, payload: { ok: false, error: 'file-missing' } }
+      }
       log(
         `[data-portal] op=fetch-through owner=${q(session.ownerId)} path=${q(relPath)} ` +
           `status=${head.status} ms=${Date.now() - started} result=device-error`,

package/payload/platform/plugins/cloudflare/skills/data-portal/template/portal.js

@@ -292,6 +292,14 @@
           say('That file is on the device, which is not reachable right now. Try again shortly.');
           return;
         }
+        /* A reachable device that 404s a stale row sends error:'file-missing'.
+           The message says refresh, not wait. Keyed on the string, so the
+           edge's own not-found 404s (not-granted, absent, is-directory) carry
+           error:'not found' and keep the generic message below. */
+        if (res.d && res.d.error === 'file-missing') {
+          say('That file is no longer available under this name. Refresh the list and try again.');
+          return;
+        }
         if (!res.d.ok || !res.d.url) {
           say('That file could not be opened.');
           return;

package/payload/platform/scripts/lib/provision-account-dir.sh

@@ -128,6 +128,12 @@ provision_account_dir() {
           { "type": "command", "command": "bash $HOOKS_PATH/post-tool-use-agent.sh" }
         ]
       },
+      {
+        "matcher": "mcp__plugin_browser_browser__browser-pdf-save",
+        "hooks": [
+          { "type": "command", "command": "bash $HOOKS_PATH/quote-render-pdf-conformance.sh" }
+        ]
+      },
       {
         "matcher": "mcp__.*__.*-(export|import)-parse$",
         "hooks": [

package/payload/platform/services/claude-session-manager/dist/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAoBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAoBxD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CA2lGpD"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../src/http-server.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAgB3B,OAAO,EAkBL,KAAK,SAAS,EAEf,MAAM,kBAAkB,CAAA;AAoBzB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAA;AAoBxD,OAAO,KAAK,EAAE,SAAS,EAAyB,MAAM,iBAAiB,CAAA;AACvE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAA;AAE3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAyFlE,eAAO,MAAM,kBAAkB,QAA2B,CAAA;AAS1D,eAAO,MAAM,4BAA4B,QAAS,CAAA;AAIlD,MAAM,WAAW,QAAS,SAAQ,IAAI,CAAC,SAAS,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAC7E;;qEAEiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,SAAS,CAAA;IAClB;;oEAEgE;IAChE,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C,WAAW,EAAE,MAAM,CAAA;IACnB,iBAAiB,EAAE,MAAM,CAAA;IACzB,kBAAkB,EAAE,WAAW,CAAA;IAC/B,eAAe,EAAE,aAAa,CAAA;IAC9B;kFAC8E;IAC9E,WAAW,EAAE,kBAAkB,CAAA;IAC/B;;gFAE4E;IAC5E,cAAc,EAAE,cAAc,CAAA;IAC9B;;;6BAGyB;IACzB,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;IACzC;;;sCAGkC;IAClC,oBAAoB,CAAC,EAAE,oBAAoB,CAAA;IAC3C;;gFAE4E;IAC5E,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;4EAGwE;IACxE,YAAY,CAAC,EAAE,MAAM,iBAAiB,GAAG,IAAI,CAAA;CAC9C;AAsFD;;;;;;mEAMmE;AACnE,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAiC9D;AAMD;;;;;;iBAMiB;AACjB,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAmCvF;AAID;;;;;;yBAMyB;AACzB,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAiCzD;AAwCD,wBAAgB,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAEpG;AAgBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE1D;AAUD,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAMvE;AAMD,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,OAAO,EAAE,MAAM,EACf,YAAY,EAAE,MAAM,EACpB,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GAAG,IAAI,GACtB,MAAM,CAER;AAkCD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAe5F;AAiGD,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CASvG;AAUD,wBAAgB,6BAA6B,CAC3C,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,OAAO,EAChB,gBAAgB,EAAE,OAAO,GACxB,IAAI,CA4BN;AA6DD;;;kEAGkE;AAClE,MAAM,MAAM,OAAO,GAAG,IAAI,GAAG;IAC3B,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACpD;;;+CAG2C;IAC3C,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAChD,CAAA;AA8CD,wBAAgB,YAAY,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAsnGpD"}

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -2071,6 +2071,10 @@ export function buildHttpApp(deps) {
         }
         const byte = body.byte;
         const trigger = typeof body.trigger === 'string' ? body.trigger : 'manual';
+        // Task 1920 — the stop button sets escalate:true so that when ESC proves
+        // ineffective (turn blocked in a tool/subagent call) the manager escalates
+        // once to Ctrl-C. Absent/false keeps the ESC-only re-send path.
+        const escalate = body.escalate === true;
         const intId = `${sessionId.slice(0, 8)}-${start}`;
         deps.logger(`[webchat-interrupt] op=interrupt-requested intId=${intId} sessionId=${sessionId.slice(0, 8)} trigger=${trigger}`);
         const result = writeInterruptToPty(sessionId, byte, deps.logger);
@@ -2115,6 +2119,11 @@ export function buildHttpApp(deps) {
         let lastSendAt = sentAt;
         let escSends = 1; // the initial ESC already written above
         let canResend = true;
+        // Task 1920 — the one-shot escalation guard. Seed it from the initial byte:
+        // if the pre-loop write above already sent Ctrl-C (byte='ctrl-c'), the loop
+        // must not send a second one. The invariant is "exactly one Ctrl-C ever per
+        // call" because a second SIGINT can exit the CLI and kill the session.
+        let ctrlCSent = byte === 'ctrl-c';
         while (Date.now() - sentAt < stopMs) {
             const st = deps.watcher.getBySessionId(sessionId)?.status;
             if (st !== 'busy') {
@@ -2122,14 +2131,34 @@ export function buildHttpApp(deps) {
                 break;
             }
             if (canResend && Date.now() - lastSendAt >= reescalateMs) {
-                const re = writeInterruptToPty(sessionId, byte, deps.logger);
-                lastSendAt = Date.now();
-                if (re.ok) {
-                    escSends += 1;
-                    deps.logger(`[webchat-interrupt] op=interrupt-reescalated intId=${intId} sends=${escSends}`);
+                if (escalate) {
+                    // Task 1920 — ESC ran for a full sub-window while still busy, so it is
+                    // ineffective (turn blocked in a tool/subagent call). Escalate once to
+                    // Ctrl-C (SIGINT reaches the harness mid-tool-call); never a second
+                    // time — a second SIGINT can exit the CLI and kill the session. After
+                    // the one Ctrl-C, stop sending and just poll for busy-clear.
+                    if (!ctrlCSent) {
+                        const esc = writeInterruptToPty(sessionId, 'ctrl-c', deps.logger);
+                        lastSendAt = Date.now();
+                        if (esc.ok) {
+                            ctrlCSent = true;
+                            deps.logger(`[webchat-interrupt] op=interrupt-escalated intId=${intId} mechanism=ctrl-c sends=${escSends + 1}`);
+                        }
+                        else {
+                            canResend = false; // child vanished mid-interrupt; the next status read exits the loop
+                        }
+                    }
                 }
                 else {
-                    canResend = false; // child vanished mid-interrupt; the next status read exits the loop
+                    const re = writeInterruptToPty(sessionId, byte, deps.logger);
+                    lastSendAt = Date.now();
+                    if (re.ok) {
+                        escSends += 1;
+                        deps.logger(`[webchat-interrupt] op=interrupt-reescalated intId=${intId} sends=${escSends}`);
+                    }
+                    else {
+                        canResend = false; // child vanished mid-interrupt; the next status read exits the loop
+                    }
                 }
             }
             await new Promise((r) => setTimeout(r, 120));