@rubytech/create-maxy-code 0.1.567 → 0.1.569

package/payload/platform/services/claude-session-manager/dist/specialist-preference-audit.js

@@ -0,0 +1,299 @@
+// Task 2469 — a specialist that CAN be reached is not a specialist that WAS.
+//
+// The registry reconcile in account-agent-registry.ts answers the first
+// question and emits `op=agent-registry-resolution`. It was green on the
+// account that filed this, and would have stayed green through the whole
+// incident, because every clerk was reachable and none was reached: four
+// authored clerks owned the works orders, invoices and client emails while
+// content-producer produced all of them. The two questions are deliberately
+// separate signals, because one cannot answer the other.
+//
+// Keyed on the written path rather than on the dispatch prose. A dispatch
+// description is the model's own account of what it is doing, and the incident
+// this closes had twelve descriptions that each read as reasonable. A path is
+// a fact, and it is the same fact a write gate enforces on, so enforcement and
+// audit cannot drift apart.
+//
+// The input is `<projectDir>/<sessionId>/subagents/agent-<agentId>.jsonl` with
+// its sibling `.meta.json`. That directory is the ONLY surface that ties a
+// write to a specialist: the parent transcript records every record as
+// `isSidechain: false`, carries none of the subagent's tool calls, and its
+// `toolUseResult.toolStats` gives aggregate counts with no paths.
+//
+// Shape mirrors public-surface-audit.ts: PURE parsers, selector and formatters
+// plus an impure factory whose setInterval is unref'd and whose readers are
+// injected.
+import { closeSync, openSync, readSync } from 'node:fs';
+import { StringDecoder } from 'node:string_decoder';
+const TAG = '[specialist-preference]';
+/** Lines of a file, read in bounded chunks rather than into one string.
+ *
+ *  One session's `subagents/` directory measured 473 MB, so reading a
+ *  transcript with `readFileSync` would put the whole thing on the heap to look
+ *  at one field per line. A `StringDecoder` carries partial multi-byte
+ *  characters across chunk boundaries: splitting one would corrupt the line,
+ *  `JSON.parse` would reject it, and the write it carried would vanish from
+ *  the audit silently. */
+export function* readLinesSync(path, chunkBytes = 1 << 20) {
+    const fd = openSync(path, 'r');
+    try {
+        const buf = Buffer.allocUnsafe(chunkBytes);
+        const decoder = new StringDecoder('utf8');
+        let carry = '';
+        for (;;) {
+            const n = readSync(fd, buf, 0, chunkBytes, null);
+            if (n === 0)
+                break;
+            const parts = (carry + decoder.write(buf.subarray(0, n))).split('\n');
+            carry = parts.pop() ?? '';
+            for (const p of parts)
+                if (p.length > 0)
+                    yield p;
+        }
+        carry += decoder.end();
+        if (carry.length > 0)
+            yield carry;
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+const WRITE_TOOLS = new Set(['Write', 'Edit', 'MultiEdit', 'NotebookEdit']);
+/** Artefact directory to the specialist that owns it.
+ *
+ *  Every entry is a directory measured in the live job tree: `quote` (17 jobs),
+ *  `Quotations` (5), `orders` (8), `invoices` (1). There is no valuation
+ *  directory anywhere in that tree, so valuation-clerk deliberately has no
+ *  entry — a guessed owner produces misroute lines nobody can act on.
+ *
+ *  Two exclusions are deliberate. `pricing/` holds the internal priced
+ *  breakdown rather than a client-facing artefact. `Suppliers Invoices` is the
+ *  supplier's invoice to the business, not the client invoice the
+ *  invoice-clerk issues, and the match is exact-segment so it cannot be swept
+ *  in by the `invoices` entry. */
+export const OWNED_PATHS = [
+    { segment: 'quote', owner: 'sitedesk:quoter' },
+    { segment: 'Quotations', owner: 'sitedesk:quoter' },
+    { segment: 'orders', owner: 'order-clerk' },
+    { segment: 'invoices', owner: 'invoice-clerk' },
+];
+/** The specialist that owns a written path, or null when the path is not an
+ *  owned artefact. Anchored on `jobs/<jobId>/<segment>/`, so a same-named
+ *  directory elsewhere in the account is not swept in and a file sitting
+ *  directly in a job directory belongs to nobody in particular. */
+export function ownerForPath(filePath) {
+    const seg = filePath.split('/');
+    for (let i = 0; i + 3 < seg.length; i++) {
+        if (seg[i] !== 'jobs')
+            continue;
+        const bucket = seg[i + 2];
+        const hit = OWNED_PATHS.find((o) => o.segment === bucket);
+        if (hit)
+            return hit.owner;
+    }
+    return null;
+}
+/** `agentType` from a subagent's sibling meta file, or null when the file is
+ *  unreadable, unparseable, or carries no type. Null is never read as
+ *  compliance: see `auditTranscript`. */
+export function parseAgentType(metaJson) {
+    if (metaJson === null)
+        return null;
+    try {
+        const d = JSON.parse(metaJson);
+        const t = d?.agentType;
+        return typeof t === 'string' && t.length > 0 ? t : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Written paths in one transcript line. A line that will not parse yields
+ *  nothing rather than throwing: the corpus carries partial trailing writes,
+ *  and one bad line must not abort the transcript it sits in. */
+export function selectWrites(transcriptLine) {
+    let d;
+    try {
+        d = JSON.parse(transcriptLine);
+    }
+    catch {
+        return [];
+    }
+    const content = d?.message?.content;
+    if (!Array.isArray(content))
+        return [];
+    const out = [];
+    for (const b of content) {
+        if (!b || typeof b !== 'object')
+            continue;
+        const blk = b;
+        if (blk.type !== 'tool_use')
+            continue;
+        if (typeof blk.name !== 'string' || !WRITE_TOOLS.has(blk.name))
+            continue;
+        const fp = blk.input?.file_path;
+        if (typeof fp === 'string' && fp.length > 0)
+            out.push(fp);
+    }
+    return out;
+}
+/** One subagent run.
+ *
+ *  `agentType` null means the meta file was missing or unreadable. Its
+ *  owned-path writes are counted as unattributed rather than as compliant:
+ *  "we could not tell who wrote this" is not "the right specialist wrote it",
+ *  and folding the two together is how a broken reader reads as a clean
+ *  account. */
+export function auditTranscript(p) {
+    let ownedPathWrites = 0;
+    let unattributed = 0;
+    const misroutes = [];
+    for (const line of p.lines) {
+        for (const path of selectWrites(line)) {
+            const owner = ownerForPath(path);
+            if (owner === null)
+                continue;
+            ownedPathWrites++;
+            if (p.agentType === null) {
+                unattributed++;
+                continue;
+            }
+            if (p.agentType !== owner) {
+                misroutes.push({ session: p.session, agent: p.agentType, owner, path });
+            }
+        }
+    }
+    return { ownedPathWrites, unattributed, misroutes };
+}
+/** The every-tick line. Emitted including zero, so a run that found nothing is
+ *  distinguishable from a run that did not happen. */
+export function formatPreferenceSummary(p) {
+    return `${TAG} op=audit sessionsScanned=${p.sessionsScanned}` +
+        ` transcriptsScanned=${p.transcriptsScanned}` +
+        ` ownedPathWrites=${p.ownedPathWrites}` +
+        ` misrouted=${p.misrouted} unattributed=${p.unattributed}`;
+}
+/** One line per misroute, naming the subagent, the owner it displaced and the
+ *  path. The displaced owner is the actionable half: "content-producer wrote
+ *  this" says less than "content-producer wrote this instead of the quoter".
+ *
+ *  The path is JSON-quoted because these paths contain spaces — the document
+ *  that prompted this task is `Q 1879 - Woolgrove School - Yellow Class
+ *  Kitchenette.html` — and a bare value would split into four tokens under any
+ *  `key=value` reader, including `grep -o 'path=\S*'`. */
+export function formatMisroute(p) {
+    return `${TAG} op=misroute session=${p.session} agent=${p.agent}` +
+        ` owner=${p.owner} path=${JSON.stringify(p.path)}`;
+}
+export function createSpecialistPreferenceAudit(deps) {
+    /** jsonl path -> the result of reading it at `mtimeMs`.
+     *
+     *  The emitted counts are a STATE — the totals across every transcript
+     *  currently known — not a per-tick delta. A transcript still being appended
+     *  to is re-read when its mtime moves and its entry is REPLACED, so its
+     *  earlier writes are counted once, not once per tick. A delta counter over
+     *  a growing file would inflate every total it reported. */
+    const seen = new Map();
+    /** Misroutes already named, so a steady state does not re-log every tick. */
+    const logged = new Set();
+    let timer = null;
+    function tickOnce() {
+        let sessionsScanned = 0;
+        const live = new Set();
+        for (const session of deps.listSessions()) {
+            sessionsScanned++;
+            let transcripts;
+            try {
+                transcripts = deps.listTranscripts(session);
+            }
+            catch (err) {
+                // A directory that cannot be listed is named and skipped. Silence here
+                // would read as a session with no subagent activity, which is the one
+                // reading this audit must never produce by accident.
+                deps.logger(`${TAG} op=session-unreadable session=${session}` +
+                    ` reason=${err instanceof Error ? err.message : String(err)}`);
+                continue;
+            }
+            for (const t of transcripts) {
+                live.add(t.jsonl);
+                const prior = seen.get(t.jsonl);
+                if (prior && prior.mtimeMs === t.mtimeMs)
+                    continue;
+                const agentType = parseAgentType(deps.readMeta(t.meta));
+                let audit;
+                try {
+                    audit = auditTranscript({ session, agentType, lines: deps.readLines(t.jsonl) });
+                }
+                catch (err) {
+                    deps.logger(`${TAG} op=transcript-unreadable path=${t.jsonl}` +
+                        ` reason=${err instanceof Error ? err.message : String(err)}`);
+                    continue;
+                }
+                seen.set(t.jsonl, { mtimeMs: t.mtimeMs, audit });
+                for (const m of audit.misroutes) {
+                    const key = `${m.session}|${m.agent}|${m.path}`;
+                    if (logged.has(key))
+                        continue;
+                    deps.logger(formatMisroute(m));
+                    logged.add(key);
+                }
+            }
+        }
+        // Drop transcripts that have gone, so the totals describe what is on disk
+        // now rather than accumulating across the process's whole lifetime. The
+        // logged-misroute keys go with them: this process runs for weeks, and a set
+        // that only ever grew would hold every path of every session the install
+        // has ever archived.
+        for (const path of Array.from(seen.keys()))
+            if (!live.has(path))
+                seen.delete(path);
+        const liveKeys = new Set();
+        for (const { audit } of seen.values()) {
+            for (const m of audit.misroutes)
+                liveKeys.add(`${m.session}|${m.agent}|${m.path}`);
+        }
+        for (const key of Array.from(logged))
+            if (!liveKeys.has(key))
+                logged.delete(key);
+        let ownedPathWrites = 0;
+        let misrouted = 0;
+        let unattributed = 0;
+        for (const { audit } of seen.values()) {
+            ownedPathWrites += audit.ownedPathWrites;
+            misrouted += audit.misroutes.length;
+            unattributed += audit.unattributed;
+        }
+        deps.logger(formatPreferenceSummary({
+            sessionsScanned,
+            transcriptsScanned: seen.size,
+            ownedPathWrites,
+            misrouted,
+            unattributed,
+        }));
+    }
+    return {
+        tickOnce,
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(() => {
+                try {
+                    tickOnce();
+                }
+                catch (err) {
+                    deps.logger(`${TAG} op=audit-tick-failed message=${err instanceof Error ? err.message : String(err)}`);
+                }
+            }, deps.intervalMs);
+            if (typeof timer.unref === 'function')
+                timer.unref();
+            deps.logger(`${TAG} op=audit-started intervalMs=${deps.intervalMs}`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = null;
+            }
+        },
+    };
+}
+//# sourceMappingURL=specialist-preference-audit.js.map

package/payload/platform/services/claude-session-manager/dist/specialist-preference-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specialist-preference-audit.js","sourceRoot":"","sources":["../src/specialist-preference-audit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,yDAAyD;AACzD,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,4BAA4B;AAC5B,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,uEAAuE;AACvE,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,YAAY;AAEZ,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,MAAM,GAAG,GAAG,yBAAyB,CAAA;AAGrC;;;;;;;0BAO0B;AAC1B,MAAM,SAAS,CAAC,CAAC,aAAa,CAAC,IAAY,EAAE,UAAU,GAAG,CAAC,IAAI,EAAE;IAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,CAAA;QAC1C,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAA;QACzC,IAAI,KAAK,GAAG,EAAE,CAAA;QACd,SAAS,CAAC;YACR,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAA;YAChD,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAK;YAClB,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrE,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAA;YACzB,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,CAAC,CAAA;QAClD,CAAC;QACD,KAAK,IAAI,OAAO,CAAC,GAAG,EAAE,CAAA;QACtB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,KAAK,CAAA;IACnC,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAA;IACf,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAA;AAEhG;;;;;;;;;;;kCAWkC;AAClC,MAAM,CAAC,MAAM,WAAW,GAAsD;IAC5E,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE;IAC9C,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACnD,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE;IAC3C,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,eAAe,EAAE;CAChD,CAAA;AAED;;;mEAGmE;AACnE,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,SAAQ;QAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAA;QACzD,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC,KAAK,CAAA;IAC3B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;yCAEyC;AACzC,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,CAAC,GAAI,CAA6B,EAAE,SAAS,CAAA;QACnD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;iEAEiE;AACjE,MAAM,UAAU,YAAY,CAAC,cAAsB;IACjD,IAAI,CAAU,CAAA;IACd,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,OAAO,GAAI,CAAyC,EAAE,OAAO,EAAE,OAAO,CAAA;IAC5E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,CAAA;IACtC,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,SAAQ;QACzC,MAAM,GAAG,GAAG,CAAsE,CAAA;QAClF,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,SAAQ;QACrC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QACxE,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,EAAE,SAAS,CAAA;QAC/B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC3D,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAeD;;;;;;eAMe;AACf,MAAM,UAAU,eAAe,CAAC,CAI/B;IACC,IAAI,eAAe,GAAG,CAAC,CAAA;IACvB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,MAAM,SAAS,GAAe,EAAE,CAAA;IAChC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;YAChC,IAAI,KAAK,KAAK,IAAI;gBAAE,SAAQ;YAC5B,eAAe,EAAE,CAAA;YACjB,IAAI,CAAC,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBACzB,YAAY,EAAE,CAAA;gBACd,SAAQ;YACV,CAAC;YACD,IAAI,CAAC,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;gBAC1B,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACzE,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,SAAS,EAAE,CAAA;AACrD,CAAC;AAED;sDACsD;AACtD,MAAM,UAAU,uBAAuB,CAAC,CAMvC;IACC,OAAO,GAAG,GAAG,6BAA6B,CAAC,CAAC,eAAe,EAAE;QAC3D,uBAAuB,CAAC,CAAC,kBAAkB,EAAE;QAC7C,oBAAoB,CAAC,CAAC,eAAe,EAAE;QACvC,cAAc,CAAC,CAAC,SAAS,iBAAiB,CAAC,CAAC,YAAY,EAAE,CAAA;AAC9D,CAAC;AAED;;;;;;;0DAO0D;AAC1D,MAAM,UAAU,cAAc,CAAC,CAAW;IACxC,OAAO,GAAG,GAAG,wBAAwB,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,KAAK,EAAE;QAC/D,UAAU,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;AACtD,CAAC;AA+BD,MAAM,UAAU,+BAA+B,CAC7C,IAAmC;IAEnC;;;;;;gEAM4D;IAC5D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAuD,CAAA;IAC3E,6EAA6E;IAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,IAAI,KAAK,GAA0B,IAAI,CAAA;IAEvC,SAAS,QAAQ;QACf,IAAI,eAAe,GAAG,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YAC1C,eAAe,EAAE,CAAA;YACjB,IAAI,WAAqC,CAAA;YACzC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAA;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,uEAAuE;gBACvE,sEAAsE;gBACtE,qDAAqD;gBACrD,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,kCAAkC,OAAO,EAAE;oBACjD,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAA;gBACD,SAAQ;YACV,CAAC;YACD,KAAK,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBACjB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;gBAC/B,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO;oBAAE,SAAQ;gBAClD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;gBACvD,IAAI,KAAsB,CAAA;gBAC1B,IAAI,CAAC;oBACH,KAAK,GAAG,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;gBACjF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CACT,GAAG,GAAG,kCAAkC,CAAC,CAAC,KAAK,EAAE;wBACjD,WAAW,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9D,CAAA;oBACD,SAAQ;gBACV,CAAC;gBACD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;gBAChD,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBAChC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAA;oBAC/C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;wBAAE,SAAQ;oBAC7B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAA;oBAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,qBAAqB;QACrB,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAClC,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QACpF,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAEhF,IAAI,eAAe,GAAG,CAAC,CAAA;QACvB,IAAI,SAAS,GAAG,CAAC,CAAA;QACjB,IAAI,YAAY,GAAG,CAAC,CAAA;QACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;YACtC,eAAe,IAAI,KAAK,CAAC,eAAe,CAAA;YACxC,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,MAAM,CAAA;YACnC,YAAY,IAAI,KAAK,CAAC,YAAY,CAAA;QACpC,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC;YAClC,eAAe;YACf,kBAAkB,EAAE,IAAI,CAAC,IAAI;YAC7B,eAAe;YACf,SAAS;YACT,YAAY;SACb,CAAC,CAAC,CAAA;IACL,CAAC;IAED,OAAO;QACL,QAAQ;QACR,KAAK;YACH,IAAI,KAAK;gBAAE,OAAM;YACjB,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;gBACvB,IAAI,CAAC;oBACH,QAAQ,EAAE,CAAA;gBACZ,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;gBACxG,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAA;YACnB,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;gBAAE,KAAK,CAAC,KAAK,EAAE,CAAA;YACpD,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,gCAAgC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;QACtE,CAAC;QACD,IAAI;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,aAAa,CAAC,KAAK,CAAC,CAAA;gBACpB,KAAK,GAAG,IAAI,CAAA;YACd,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/payload/platform/services/claude-session-manager/dist/systemd-scope.d.ts

@@ -28,11 +28,15 @@ export interface SystemctlResult {
  *  Tests inject a recording stub. */
 export type SystemctlRunner = (args: readonly string[]) => SystemctlResult;
 export declare function defaultSystemctlRunner(args: readonly string[]): SystemctlResult;
-export declare function scopeUnitName(unitToken: string): string;
-/** Inverse of `scopeUnitName` — extracts the unitToken from a unit name
- *  emitted by `systemctl --user list-units --type=scope 'claude-session-*.scope'`.
- *  Returns null when the name doesn't match the prefix/suffix shape. */
-export declare function unitTokenFromScopeUnit(unit: string): string | null;
+export declare function scopeUnitName(brandSlug: string, unitToken: string): string;
+/** Inverse of `scopeUnitName`, for THIS brand only. Returns null for a peer
+ *  brand's unit and for the pre-2457 unbranded shape — both are units this
+ *  manager must never claim, reattach, or stop.
+ *
+ *  A literal prefix test, not a regex: `^claude-session-(.+)\.scope$` against a
+ *  branded name hands back `<brand>-claude-session-<token>` as the token, and a
+ *  `maxy` slug would prefix-match a `maxy-code` unit. */
+export declare function unitTokenFromScopeUnit(brandSlug: string, unit: string): string | null;
 /** One row from `systemctl --user list-units --type=scope --no-legend
  *  'claude-session-*.scope'`. The `loaded`/`active`/`sub` columns let the
  *  boot-seed reconciler ignore units that are draining (`sub=stop-sigterm`)
@@ -48,21 +52,24 @@ export interface SurvivingScope {
  *  Tolerant of leading column whitespace and trailing description column.
  *  Rows whose unit name doesn't extract a unitToken are skipped (defensive
  *  against future systemctl-output drift). */
-export declare function parseSurvivingScopes(stdout: string): SurvivingScope[];
+export declare function parseSurvivingScopes(brandSlug: string, stdout: string): SurvivingScope[];
 /** Issue `systemctl --user list-units --type=scope --no-legend
  *  'claude-session-*.scope'` and return the parsed rows. The boot-seed
  *  uses this to discover surviving PTYs across a manager restart. */
-export declare function listSurvivingScopes(run: SystemctlRunner): {
+export declare function listSurvivingScopes(run: SystemctlRunner, brandSlug: string): {
     scopes: SurvivingScope[];
     result: SystemctlResult;
 };
 /** Stop any orphan rc scope units left over from prior session-manager
- *  boots. Called from the session-manager startup BEFORE the rc-daemon
- *  supervisor's first spawn and BEFORE the HTTP server begins accepting
- *  /rc-spawn requests, so no in-flight scope can be misidentified as an
- *  orphan. Idempotent and safe to call on every boot — if nothing
- *  matches, no stop is issued. */
-export declare function reapOrphanNonPtyScopes(run: SystemctlRunner, logger: (line: string) => void): Promise<void>;
+ *  boots OF THIS BRAND. Called from the session-manager startup BEFORE the
+ *  rc-daemon supervisor's first spawn and BEFORE the HTTP server begins
+ *  accepting /rc-spawn requests, so no in-flight scope can be misidentified
+ *  as an orphan. Idempotent and safe to call on every boot — if nothing
+ *  matches, no stop is issued.
+ *
+ *  Task 2457 — `listSurvivingScopes` globs this brand only, so a peer brand's
+ *  live session can no longer be classified as an orphan here. */
+export declare function reapOrphanNonPtyScopes(run: SystemctlRunner, logger: (line: string) => void, brandSlug: string): Promise<void>;
 /** Outcome surface for a scope-stop attempt.
  *
  *  Task 451 — `outcome=ok` means **unit stopped AND pid is gone**. Pre-451,
@@ -115,7 +122,7 @@ export declare const defaultProcessSignals: ProcessSignals;
  *  scope's TimeoutStopSec=5 handles in-cgroup SIGTERM→SIGKILL escalation.
  *  Exit code 5 ("not loaded") still means the scope retired naturally —
  *  treated as `already-gone`. */
-export declare function stopScopeUnit(run: SystemctlRunner, unitToken: string, opts?: {
+export declare function stopScopeUnit(run: SystemctlRunner, brandSlug: string, unitToken: string, opts?: {
     pid?: number | null;
     killGraceMs?: number;
     signals?: ProcessSignals;
@@ -128,6 +135,9 @@ export interface SystemdRunArgv {
 }
 export interface BuildSystemdRunArgvParams {
     unitToken: string;
+    /** Task 2457 — the brand that owns this scope. Lands first in the unit name
+     *  so no peer brand's enumeration can see it. */
+    brandSlug: string;
     claudeBin: string;
     claudeArgs: readonly string[];
     /** Full env map to thread into the scope via `--setenv=KEY=VAL`. Every
@@ -168,7 +178,7 @@ export declare function buildSystemdRunArgv(p: BuildSystemdRunArgvParams): Syste
  *  `$CLAUDE_CONFIG_DIR/sessions/<pid>.json`, which in turn carries claude's
  *  intrinsic sessionId. Returns null when the unit has no main pid (the
  *  scope is draining) or when the systemctl call fails. */
-export declare function getScopeMainPid(run: SystemctlRunner, unitToken: string): number | null;
+export declare function getScopeMainPid(run: SystemctlRunner, brandSlug: string, unitToken: string): number | null;
 /** Task 1398 gap 2 — platform-branching spawn plan. macOS has no `systemd-run`;
  *  wrapping a spawn in it makes node-pty exec a missing binary, which the child
  *  fails as `exitCode=1 ranMs=5 bytes=0`. On darwin, spawn claude directly and
@@ -203,7 +213,7 @@ export declare function stopPidDirect(pid: number | null, opts?: {
  *  the evicted pty would linger until the manager exits. This helper branches
  *  on platform: darwin kills `victim.pid` directly; every other platform issues
  *  exactly today's pid-omitted scope stop, byte-identical. */
-export declare function evictSessionProcess(platform: NodeJS.Platform, run: SystemctlRunner, victim: {
+export declare function evictSessionProcess(platform: NodeJS.Platform, run: SystemctlRunner, brandSlug: string, victim: {
     scopeUnitToken: string;
     pid: number;
 }, opts?: {

package/payload/platform/services/claude-session-manager/dist/systemd-scope.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systemd-scope.d.ts","sourceRoot":"","sources":["../src/systemd-scope.ts"],"names":[],"mappings":"AAuBA;;gBAEgB;AAChB,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD;;;uDAGuD;AACvD,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;gCAGgC;AAChC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd;;;;mDAI+C;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED;;;qCAGqC;AACrC,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,eAAe,CAAA;AAE1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAgB/E;AAiBD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;wEAEwE;AACxE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED;;;kCAGkC;AAClC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;8CAG8C;AAC9C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAiBrE;AAED;;qEAEqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG;IACzD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,EAAE,eAAe,CAAA;CACxB,CAaA;AASD;;;;;kCAKkC;AAClC,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAC7B,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,OAAO,CAAA;AAEX,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;kEAEkE;AAClE,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAChD;;;uDAGmD;IACnD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB,EAAE,cAcnC,CAAA;AAUD;;;;;;;;;;;;;;iCAciC;AACjC,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,cAAc,CAAA;CACpB,GACL,OAAO,CAAC,eAAe,CAAC,CAuC1B;AAED;0DAC0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,aAAa,CAAA;IAClB,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;qDAIiD;IACjD,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC;iFAC6E;IAC7E,GAAG,EAAE,MAAM,CAAA;IACX;;;;yDAIqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;gBAcgB;AAChB,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,yBAAyB,GAAG,cAAc,CAiChF;AAED;;;;;2DAK2D;AAC3D,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAQf;AAED;;;;;wCAKwC;AACxC,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,CAAC,EAAE,yBAAyB,GAC3B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAMpE;AAED;;;;;oEAKoE;AACpE,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACrG,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;;;;;;;;8DAW8D;AAC9D,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC/C,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACrG,OAAO,CAAC,eAAe,CAAC,CAK1B"}
+{"version":3,"file":"systemd-scope.d.ts","sourceRoot":"","sources":["../src/systemd-scope.ts"],"names":[],"mappings":"AAuBA;;gBAEgB;AAChB,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD;;;uDAGuD;AACvD,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;gCAGgC;AAChC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd;;;;mDAI+C;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED;;;qCAGqC;AACrC,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,eAAe,CAAA;AAE1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAgB/E;AAuBD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAY1E;AAED;;;;;;yDAMyD;AACzD,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMrF;AAED;;;kCAGkC;AAClC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;8CAG8C;AAC9C,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAmBxF;AAED;;qEAEqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,GAAG;IAC5E,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,EAAE,eAAe,CAAA;CACxB,CAgBA;AASD;;;;;;;;kEAQkE;AAClE,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,eAAe,EACpB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAmCf;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,MAAM,gBAAgB,GACxB,IAAI,GACJ,cAAc,GACd,gBAAgB,GAChB,gBAAgB,GAChB,qBAAqB,GACrB,OAAO,CAAA;AAEX,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;kEAEkE;AAClE,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;IAChD;;;uDAGmD;IACnD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB,EAAE,cAcnC,CAAA;AAUD;;;;;;;;;;;;;;iCAciC;AACjC,wBAAsB,aAAa,CACjC,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;IACJ,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,cAAc,CAAA;CACpB,GACL,OAAO,CAAC,eAAe,CAAC,CAgD1B;AAED;0DAC0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,aAAa,CAAA;IAClB,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB;qDACiD;IACjD,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;qDAIiD;IACjD,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC;iFAC6E;IAC7E,GAAG,EAAE,MAAM,CAAA;IACX;;;;yDAIqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;;;;;;;gBAcgB;AAChB,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,yBAAyB,GAAG,cAAc,CAiChF;AAED;;;;;2DAK2D;AAC3D,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAQf;AAED;;;;;wCAKwC;AACxC,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,CAAC,EAAE,yBAAyB,GAC3B;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,GAAG,SAAS,CAAA;CAAE,CAMpE;AAED;;;;;oEAKoE;AACpE,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,GAAG,IAAI,EAClB,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACrG,OAAO,CAAC,eAAe,CAAC,CAc1B;AAED;;;;;;;;;;;8DAW8D;AAC9D,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE;IAAE,cAAc,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,EAC/C,IAAI,GAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAAO,GACrG,OAAO,CAAC,eAAe,CAAC,CAK1B"}

package/payload/platform/services/claude-session-manager/dist/systemd-scope.js

@@ -59,24 +59,41 @@ export function defaultSystemctlRunner(args) {
 // token for the unit name; boot-seed reconciles unit → claude pid →
 // PID-file → claude sessionId after a restart.
 const SCOPE_NAME_VALID = /^[a-zA-Z0-9:_.\-]+$/;
-export function scopeUnitName(unitToken) {
+// Task 2457 — the brand goes BEFORE `claude-session-`, not inside it. Every
+// co-resident brand shares one `user@1000.service`, so an unbranded name let any
+// brand's boot enumerate — and stop — every other brand's live scopes. The
+// brand-first shape also means an un-upgraded peer, which globs
+// `claude-session-*.scope`, matches none of these: a brand is protected the
+// moment it upgrades, whatever state its neighbours are in.
+export function scopeUnitName(brandSlug, unitToken) {
+    if (!brandSlug || !SCOPE_NAME_VALID.test(brandSlug)) {
+        throw new Error(`[systemd-scope] invalid brandSlug for unit name: ${JSON.stringify(brandSlug)}`);
+    }
     if (!unitToken || !SCOPE_NAME_VALID.test(unitToken)) {
         throw new Error(`[systemd-scope] invalid unitToken for unit name: ${JSON.stringify(unitToken)}`);
     }
-    return `claude-session-${unitToken}.scope`;
+    return `${brandSlug}-claude-session-${unitToken}.scope`;
 }
-/** Inverse of `scopeUnitName` — extracts the unitToken from a unit name
- *  emitted by `systemctl --user list-units --type=scope 'claude-session-*.scope'`.
- *  Returns null when the name doesn't match the prefix/suffix shape. */
-export function unitTokenFromScopeUnit(unit) {
-    const m = unit.match(/^claude-session-(.+)\.scope$/);
-    return m ? m[1] : null;
+/** Inverse of `scopeUnitName`, for THIS brand only. Returns null for a peer
+ *  brand's unit and for the pre-2457 unbranded shape — both are units this
+ *  manager must never claim, reattach, or stop.
+ *
+ *  A literal prefix test, not a regex: `^claude-session-(.+)\.scope$` against a
+ *  branded name hands back `<brand>-claude-session-<token>` as the token, and a
+ *  `maxy` slug would prefix-match a `maxy-code` unit. */
+export function unitTokenFromScopeUnit(brandSlug, unit) {
+    const prefix = `${brandSlug}-claude-session-`;
+    const suffix = '.scope';
+    if (!unit.startsWith(prefix) || !unit.endsWith(suffix))
+        return null;
+    const token = unit.slice(prefix.length, unit.length - suffix.length);
+    return token.length > 0 ? token : null;
 }
 /** Parse the `--no-legend` output of `systemctl --user list-units`.
  *  Tolerant of leading column whitespace and trailing description column.
  *  Rows whose unit name doesn't extract a unitToken are skipped (defensive
  *  against future systemctl-output drift). */
-export function parseSurvivingScopes(stdout) {
+export function parseSurvivingScopes(brandSlug, stdout) {
     const out = [];
     for (const rawLine of stdout.split('\n')) {
         const line = rawLine.trim();
@@ -89,9 +106,10 @@ export function parseSurvivingScopes(stdout) {
         const loaded = cols[1];
         const active = cols[2];
         const sub = cols[3];
-        if (!unitName.startsWith('claude-session-') || !unitName.endsWith('.scope'))
-            continue;
-        const unitToken = unitTokenFromScopeUnit(unitName);
+        // Task 2457 — the shape guard lives in `unitTokenFromScopeUnit`, which
+        // rejects a peer brand and the legacy unbranded name as well as a
+        // non-scope. A separate prefix test here could only disagree with it.
+        const unitToken = unitTokenFromScopeUnit(brandSlug, unitName);
         if (!unitToken)
             continue;
         out.push({ unitName, unitToken, loaded, active, sub });
@@ -101,43 +119,69 @@ export function parseSurvivingScopes(stdout) {
 /** Issue `systemctl --user list-units --type=scope --no-legend
  *  'claude-session-*.scope'` and return the parsed rows. The boot-seed
  *  uses this to discover surviving PTYs across a manager restart. */
-export function listSurvivingScopes(run) {
+export function listSurvivingScopes(run, brandSlug) {
     const result = run([
         '--user',
         'list-units',
         '--type=scope',
         '--no-legend',
         '--all',
-        'claude-session-*.scope',
+        // Task 2457 — the brand is IN the glob. Every consumer of this function
+        // (the reaper, the boot-seed reconciler, the liveness tick) inherits the
+        // ownership boundary from here rather than re-deriving it.
+        `${brandSlug}-claude-session-*.scope`,
     ]);
     if (result.exitCode !== 0) {
         return { scopes: [], result };
     }
-    return { scopes: parseSurvivingScopes(result.stdout), result };
+    return { scopes: parseSurvivingScopes(brandSlug, result.stdout), result };
 }
 /** Task 554 — rc-spawn / rc-daemon scope unit-token prefixes. PTY operator
- *  scopes use the bare `claude-session-<uuid>.scope` shape and are
+ *  scopes use the bare `<brand>-claude-session-<uuid>.scope` shape and are
  *  explicitly excluded: the boot-seed reconciler claims them as live
  *  operator sessions. The reaper only sweeps tokens emitted by the
  *  rc-daemon supervisor and the `/rc-spawn` HTTP route. */
 const NON_PTY_TOKEN_PREFIXES = ['rc-daemon-', 'rc-resume-'];
 /** Stop any orphan rc scope units left over from prior session-manager
- *  boots. Called from the session-manager startup BEFORE the rc-daemon
- *  supervisor's first spawn and BEFORE the HTTP server begins accepting
- *  /rc-spawn requests, so no in-flight scope can be misidentified as an
- *  orphan. Idempotent and safe to call on every boot — if nothing
- *  matches, no stop is issued. */
-export async function reapOrphanNonPtyScopes(run, logger) {
-    const { scopes, result } = listSurvivingScopes(run);
+ *  boots OF THIS BRAND. Called from the session-manager startup BEFORE the
+ *  rc-daemon supervisor's first spawn and BEFORE the HTTP server begins
+ *  accepting /rc-spawn requests, so no in-flight scope can be misidentified
+ *  as an orphan. Idempotent and safe to call on every boot — if nothing
+ *  matches, no stop is issued.
+ *
+ *  Task 2457 — `listSurvivingScopes` globs this brand only, so a peer brand's
+ *  live session can no longer be classified as an orphan here. */
+export async function reapOrphanNonPtyScopes(run, logger, brandSlug) {
+    const { scopes, result } = listSurvivingScopes(run, brandSlug);
     if (result.exitCode !== 0) {
         logger(`[systemd-scope] reaper list-units-failed exitCode=${result.exitCode} stderr=${result.stderr.trim()}`);
         return;
     }
+    // Task 2457 — count what belongs to other brands, unconditionally. Without
+    // this line the boundary holds silently and a regression is indistinguishable
+    // from a box with no other brands on it. Counted directly off the unit names,
+    // never by subtracting two list sizes, so a systemctl output change cannot
+    // turn a miscount into a plausible number.
+    const own = `${brandSlug}-claude-session-`;
+    // Two explicit patterns rather than one leading-`*` glob: `*-claude-session-*`
+    // covers every brand and `claude-session-*` covers the pre-2457 shape, so the
+    // count does not rest on how systemd's matcher treats an empty `*`.
+    const all = run([
+        '--user', 'list-units', '--type=scope', '--no-legend', '--all',
+        '*-claude-session-*.scope', 'claude-session-*.scope',
+    ]);
+    const foreign = all.exitCode === 0
+        ? all.stdout.split('\n')
+            .map((l) => l.trim().split(/\s+/)[0] ?? '')
+            .filter((u) => u.endsWith('.scope') && u.includes('claude-session-') && !u.startsWith(own))
+            .length
+        : 0;
+    logger(`[systemd-scope] op=foreign-scope-skipped brand=${brandSlug} skipped=${foreign}`);
     const orphans = scopes.filter((s) => NON_PTY_TOKEN_PREFIXES.some((p) => s.unitToken.startsWith(p)));
     if (orphans.length === 0)
         return;
     for (const orphan of orphans) {
-        const stop = await stopScopeUnit(run, orphan.unitToken, {});
+        const stop = await stopScopeUnit(run, brandSlug, orphan.unitToken, {});
         logger(`[systemd-scope] reaped-orphan unitToken=${orphan.unitToken} active=${orphan.active} sub=${orphan.sub} outcome=${stop.outcome} exitCode=${stop.exitCode}`);
     }
 }
@@ -180,8 +224,8 @@ function sleep(ms) {
  *  scope's TimeoutStopSec=5 handles in-cgroup SIGTERM→SIGKILL escalation.
  *  Exit code 5 ("not loaded") still means the scope retired naturally —
  *  treated as `already-gone`. */
-export async function stopScopeUnit(run, unitToken, opts = {}) {
-    const unit = scopeUnitName(unitToken);
+export async function stopScopeUnit(run, brandSlug, unitToken, opts = {}) {
+    const unit = scopeUnitName(brandSlug, unitToken);
     const result = run(['--user', 'stop', '--no-block', unit]);
     // Task 1398 gap 2 — no systemctl on this host (macOS): there is no scope to
     // stop, so terminate the pid directly. On linux the injected/default runner
@@ -190,6 +234,15 @@ export async function stopScopeUnit(run, unitToken, opts = {}) {
         return stopPidDirect(opts.pid ?? null, { killGraceMs: opts.killGraceMs, signals: opts.signals });
     }
     if (result.exitCode === 5) {
+        // Task 2457 — "not loaded" is only `already-gone` if the process really is
+        // gone. Task 451 made that the contract for `ok`; it has to hold here too.
+        // The rename makes this reachable: a session alive when its brand upgrades
+        // has an UNBRANDED token in its on-disk scope record, which `http-server`
+        // falls back to on End, so the branded name resolves to no unit and exit 5
+        // used to report success while the PTY kept running.
+        if (opts.pid && opts.signals?.isAlive(opts.pid) !== false) {
+            return stopPidDirect(opts.pid, { killGraceMs: opts.killGraceMs, signals: opts.signals });
+        }
         return { outcome: 'already-gone', exitCode: 5, stderr: result.stderr };
     }
     if (result.exitCode !== 0) {
@@ -242,7 +295,7 @@ export async function stopScopeUnit(run, unitToken, opts = {}) {
  *  script(1) wrap (Task 556) plus the non-PTY scope primitive it served
  *  are gone. */
 export function buildSystemdRunArgv(p) {
-    const unit = scopeUnitName(p.unitToken);
+    const unit = scopeUnitName(p.brandSlug, p.unitToken);
     const args = [
         '--user',
         '--scope',
@@ -282,8 +335,8 @@ export function buildSystemdRunArgv(p) {
  *  `$CLAUDE_CONFIG_DIR/sessions/<pid>.json`, which in turn carries claude's
  *  intrinsic sessionId. Returns null when the unit has no main pid (the
  *  scope is draining) or when the systemctl call fails. */
-export function getScopeMainPid(run, unitToken) {
-    const unit = scopeUnitName(unitToken);
+export function getScopeMainPid(run, brandSlug, unitToken) {
+    const unit = scopeUnitName(brandSlug, unitToken);
     const result = run(['--user', 'show', '-p', 'MainPID', '--value', unit]);
     if (result.exitCode !== 0)
         return null;
@@ -347,10 +400,10 @@ export async function stopPidDirect(pid, opts = {}) {
  *  the evicted pty would linger until the manager exits. This helper branches
  *  on platform: darwin kills `victim.pid` directly; every other platform issues
  *  exactly today's pid-omitted scope stop, byte-identical. */
-export async function evictSessionProcess(platform, run, victim, opts = {}) {
+export async function evictSessionProcess(platform, run, brandSlug, victim, opts = {}) {
     if (platform === 'darwin') {
         return stopPidDirect(victim.pid, opts);
     }
-    return stopScopeUnit(run, victim.scopeUnitToken);
+    return stopScopeUnit(run, brandSlug, victim.scopeUnitToken);
 }
 //# sourceMappingURL=systemd-scope.js.map