@rubytech/create-maxy-code 0.1.91 → 0.1.93

package/payload/platform/services/claude-session-manager/dist/session-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,uEAAuE;AACvE,sEAAsE;AACtE,oEAAoE;AACpE,0EAA0E;AAC1E,wEAAwE;AACxE,kCAAkC;AAClC,EAAE;AACF,aAAa;AACb,oEAAoE;AACpE,yEAAyE;AACzE,uEAAuE;AACvE,uEAAuE;AACvE,+CAA+C;AAC/C,kEAAkE;AAClE,uEAAuE;AACvE,0DAA0D;AAC1D,wEAAwE;AACxE,uEAAuE;AAuCvE,MAAM,OAAO,YAAY;IACN,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAA;IAE/D,GAAG,CAAC,CAAgB;QAClB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAoC,EAAE;QACnE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAA;QACjD,MAAM,GAAG,GAAoB,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YACrC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM;gBAAE,SAAQ;YACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;CACF"}
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,aAAa;AACb,oEAAoE;AACpE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,kEAAkE;AAClE,uEAAuE;AACvE,0DAA0D;AAC1D,wEAAwE;AACxE,8DAA8D;AAyC9D,MAAM,OAAO,YAAY;IACN,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAA;IAE/D,GAAG,CAAC,CAAgB;QAClB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAoC,EAAE;QACnE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAA;QACjD,MAAM,GAAG,GAAoB,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YACrC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM;gBAAE,SAAQ;YACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;CACF"}

package/payload/platform/services/claude-session-manager/dist/systemd-scope.d.ts

@@ -0,0 +1,114 @@
+/** Single source of truth for the slice unit name. Used by the spawn argv,
+ *  the boot-seed list-units filter, and the installer's slice unit
+ *  emission. */
+export declare const CLAUDE_PTYS_SLICE = "claude-ptys.slice";
+/** Hard cap on SIGTERM→SIGKILL escalation inside the scope. systemd
+ *  delivers SIGTERM on stop, waits TimeoutStopSec, then SIGKILL. 5 s
+ *  matches the manager's prior killGraceMs (`config.killGraceMs`); the
+ *  manager no longer manages the escalation itself. */
+export declare const SCOPE_TIMEOUT_STOP_SEC = 5;
+/** Result of one systemctl invocation. Mirrors the shape of
+ *  spawnSync('utf8') return — exit code plus captured streams. The
+ *  scope-stop and list-units paths both go through this shape so tests
+ *  can inject a single stub. */
+export interface SystemctlResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+/** Synchronous runner for `systemctl <args...>`. Default impl uses
+ *  spawnSync (matches uninstall.ts's existing idiom and keeps the call
+ *  site free of async glue for what is in practice a sub-50ms call).
+ *  Tests inject a recording stub. */
+export type SystemctlRunner = (args: readonly string[]) => SystemctlResult;
+export declare function defaultSystemctlRunner(args: readonly string[]): SystemctlResult;
+export declare function scopeUnitName(unitToken: string): string;
+/** Inverse of `scopeUnitName` — extracts the unitToken from a unit name
+ *  emitted by `systemctl --user list-units --type=scope 'claude-session-*.scope'`.
+ *  Returns null when the name doesn't match the prefix/suffix shape. */
+export declare function unitTokenFromScopeUnit(unit: string): string | null;
+/** One row from `systemctl --user list-units --type=scope --no-legend
+ *  'claude-session-*.scope'`. The `loaded`/`active`/`sub` columns let the
+ *  boot-seed reconciler ignore units that are draining (`sub=stop-sigterm`)
+ *  vs running (`sub=running`). */
+export interface SurvivingScope {
+    unitName: string;
+    unitToken: string;
+    loaded: string;
+    active: string;
+    sub: string;
+}
+/** Parse the `--no-legend` output of `systemctl --user list-units`.
+ *  Tolerant of leading column whitespace and trailing description column.
+ *  Rows whose unit name doesn't extract a unitToken are skipped (defensive
+ *  against future systemctl-output drift). */
+export declare function parseSurvivingScopes(stdout: string): SurvivingScope[];
+/** Issue `systemctl --user list-units --type=scope --no-legend
+ *  'claude-session-*.scope'` and return the parsed rows. The boot-seed
+ *  uses this to discover surviving PTYs across a manager restart. */
+export declare function listSurvivingScopes(run: SystemctlRunner): {
+    scopes: SurvivingScope[];
+    result: SystemctlResult;
+};
+/** Outcome surface for a scope-stop attempt. `already-gone` is the
+ *  idempotent success case: systemd reports the unit isn't loaded
+ *  (exit code 5) because claude exited naturally and systemd retired the
+ *  scope. */
+export type StopScopeOutcome = 'ok' | 'already-gone' | 'error';
+export interface StopScopeResult {
+    outcome: StopScopeOutcome;
+    exitCode: number;
+    stderr: string;
+}
+/** Issue `systemctl --user stop --no-block <unit>`. The --no-block flag
+ *  returns once the stop request is queued; the scope's TimeoutStopSec=5
+ *  handles SIGTERM→SIGKILL escalation. Exit code 5 ("not loaded") means
+ *  the scope retired naturally — treated as success. */
+export declare function stopScopeUnit(run: SystemctlRunner, unitToken: string): StopScopeResult;
+/** Argv shape produced by `buildSystemdRunArgv`. The cmd is always
+ *  `systemd-run`; the manager passes this to node-pty. */
+export interface SystemdRunArgv {
+    cmd: 'systemd-run';
+    args: string[];
+}
+export interface BuildSystemdRunArgvParams {
+    unitToken: string;
+    claudeBin: string;
+    claudeArgs: readonly string[];
+    /** Full env map to thread into the scope via `--setenv=KEY=VAL`. Every
+     *  pair lands as one flag. The default systemd-run inherit-from-caller
+     *  is NOT relied on; spawnPtyAdapter composes the explicit env block
+     *  (per-spawn overrides + a copy of process.env it wants in the scope)
+     *  and the helper threads exactly that shape. */
+    env: Readonly<Record<string, string>>;
+    /** Working directory passed via `--working-directory=`. The manager's
+     *  prior node-pty spawn passed `cwd`; the scope receives it the same way. */
+    cwd: string;
+}
+/** Build the systemd-run argv that node-pty wraps for one claude spawn.
+ *  Inside the scope, `/bin/sh -c 'trap "" HUP; exec "$@"'` wraps the
+ *  launch so claude ignores SIGHUP when the manager closes the PTY master
+ *  fd on restart. Without the wrap, master-close → kernel SIGHUP → claude
+ *  exits, and the brief's "PTY pid survives manager restart" verify-gate
+ *  fails.
+ *
+ *  The shell `exec` replaces the sh process image with claude in-place
+ *  rather than forking, so pty.pid == claude.pid (the pid is preserved
+ *  across execve). This matters because the manager's
+ *  `watcher.waitForPid(pty.pid, …)` resolves when Claude Code writes its
+ *  own PID file at `$CLAUDE_CONFIG_DIR/sessions/<claude-pid>.json`; with
+ *  a non-exec sh wrap, pty.pid would be sh's pid (≠ claude's pid) and
+ *  waitForPid would never resolve. */
+export declare function buildSystemdRunArgv(p: BuildSystemdRunArgvParams): SystemdRunArgv;
+/** Query `systemctl --user show -p MainPID claude-session-<token>.scope`
+ *  and return the main pid (the claude process). Boot-seed uses this to
+ *  bridge from the surviving scope unit to the PID file claude wrote at
+ *  `$CLAUDE_CONFIG_DIR/sessions/<pid>.json`, which in turn carries claude's
+ *  intrinsic sessionId. Returns null when the unit has no main pid (the
+ *  scope is draining) or when the systemctl call fails. */
+export declare function getScopeMainPid(run: SystemctlRunner, unitToken: string): number | null;
+/** Slice unit declared at install time so every claude scope shares one
+ *  cohort cgroup. `systemctl --user status claude-ptys.slice` gives the
+ *  operator a one-glance view of total live-session memory + CPU. */
+export declare function buildClaudePtysSliceUnitFile(): string;
+//# sourceMappingURL=systemd-scope.d.ts.map

package/payload/platform/services/claude-session-manager/dist/systemd-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd-scope.d.ts","sourceRoot":"","sources":["../src/systemd-scope.ts"],"names":[],"mappings":"AAuBA;;gBAEgB;AAChB,eAAO,MAAM,iBAAiB,sBAAsB,CAAA;AAEpD;;;uDAGuD;AACvD,eAAO,MAAM,sBAAsB,IAAI,CAAA;AAEvC;;;gCAGgC;AAChC,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;qCAGqC;AACrC,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,eAAe,CAAA;AAE1E,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAU/E;AAiBD,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAOvD;AAED;;wEAEwE;AACxE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGlE;AAED;;;kCAGkC;AAClC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;8CAG8C;AAC9C,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAiBrE;AAED;;qEAEqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,eAAe,GAAG;IACzD,MAAM,EAAE,cAAc,EAAE,CAAA;IACxB,MAAM,EAAE,eAAe,CAAA;CACxB,CAaA;AAED;;;aAGa;AACb,MAAM,MAAM,gBAAgB,GAAG,IAAI,GAAG,cAAc,GAAG,OAAO,CAAA;AAE9D,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,gBAAgB,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;;wDAGwD;AACxD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,GAChB,eAAe,CAcjB;AAED;0DAC0D;AAC1D,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,aAAa,CAAA;IAClB,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IAC7B;;;;qDAIiD;IACjD,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACrC;iFAC6E;IAC7E,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;;;;;;;;;;;sCAasC;AACtC,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,yBAAyB,GAAG,cAAc,CA8BhF;AAED;;;;;2DAK2D;AAC3D,wBAAgB,eAAe,CAC7B,GAAG,EAAE,eAAe,EACpB,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,IAAI,CAQf;AAED;;qEAEqE;AACrE,wBAAgB,4BAA4B,IAAI,MAAM,CAWrD"}

package/payload/platform/services/claude-session-manager/dist/systemd-scope.js

@@ -0,0 +1,209 @@
+// Task 250 — every `claude --verbose` PTY spawn lives in its own systemd
+// transient scope unit under a shared `claude-ptys.slice`, instead of inside
+// the session-manager unit's cgroup. The scope cgroup is owned by user
+// systemd, not by the manager; stopping the manager unit (installer rerun,
+// crash, watchdog, restart) no longer cascades a control-group kill to
+// active operator PTYs.
+//
+// This module holds the pure argv/parser helpers that the spawn adapter,
+// stop path, reaper, boot-seed, and the installer share. I/O happens via an
+// injected systemctl callable so tests can stub it without invoking real
+// systemd. node-pty owns the spawn of `systemd-run` itself — this module
+// never touches node-pty.
+//
+// SIGHUP wrap. Inside the scope, the claude invocation is wrapped with
+// `/bin/sh -c 'trap "" HUP; <invoke> "$@"' --`. The wrap exists because
+// closing the PTY master fd (which the manager owns) makes the kernel
+// deliver SIGHUP to the foreground process group of the slave session —
+// and claude's default disposition is exit. With SIGHUP set to ignore,
+// claude survives the master closing on manager restart, which is what
+// the cgroup separation is there to enable.
+import { spawnSync } from 'node:child_process';
+/** Single source of truth for the slice unit name. Used by the spawn argv,
+ *  the boot-seed list-units filter, and the installer's slice unit
+ *  emission. */
+export const CLAUDE_PTYS_SLICE = 'claude-ptys.slice';
+/** Hard cap on SIGTERM→SIGKILL escalation inside the scope. systemd
+ *  delivers SIGTERM on stop, waits TimeoutStopSec, then SIGKILL. 5 s
+ *  matches the manager's prior killGraceMs (`config.killGraceMs`); the
+ *  manager no longer manages the escalation itself. */
+export const SCOPE_TIMEOUT_STOP_SEC = 5;
+export function defaultSystemctlRunner(args) {
+    const r = spawnSync('systemctl', [...args], {
+        encoding: 'utf8',
+        timeout: 10_000,
+    });
+    return {
+        exitCode: typeof r.status === 'number' ? r.status : 1,
+        stdout: typeof r.stdout === 'string' ? r.stdout : '',
+        stderr: typeof r.stderr === 'string' ? r.stderr : '',
+    };
+}
+// systemd unit names accept `[a-zA-Z0-9:_.\-]`. The unit-token is a
+// per-spawn stable id the manager passes in: for resume spawns it equals
+// Claude Code's intrinsic sessionId (a UUID, which satisfies the char
+// set); for fresh spawns it's a manager-minted UUID. Either way the
+// helper refuses any token that doesn't match the systemd char set
+// rather than silently rewriting — preserving the lookup-by-name contract
+// the brief depends on ("no clever uniqueness suffixes").
+//
+// Why the token isn't always Claude Code's sessionId: at fresh-spawn
+// time the manager has no sessionId yet (Claude Code mints it during
+// boot and writes it to its PID file). The manager mints a separate
+// token for the unit name; boot-seed reconciles unit → claude pid →
+// PID-file → claude sessionId after a restart.
+const SCOPE_NAME_VALID = /^[a-zA-Z0-9:_.\-]+$/;
+export function scopeUnitName(unitToken) {
+    if (!unitToken || !SCOPE_NAME_VALID.test(unitToken)) {
+        throw new Error(`[systemd-scope] invalid unitToken for unit name: ${JSON.stringify(unitToken)}`);
+    }
+    return `claude-session-${unitToken}.scope`;
+}
+/** Inverse of `scopeUnitName` — extracts the unitToken from a unit name
+ *  emitted by `systemctl --user list-units --type=scope 'claude-session-*.scope'`.
+ *  Returns null when the name doesn't match the prefix/suffix shape. */
+export function unitTokenFromScopeUnit(unit) {
+    const m = unit.match(/^claude-session-(.+)\.scope$/);
+    return m ? m[1] : null;
+}
+/** Parse the `--no-legend` output of `systemctl --user list-units`.
+ *  Tolerant of leading column whitespace and trailing description column.
+ *  Rows whose unit name doesn't extract a unitToken are skipped (defensive
+ *  against future systemctl-output drift). */
+export function parseSurvivingScopes(stdout) {
+    const out = [];
+    for (const rawLine of stdout.split('\n')) {
+        const line = rawLine.trim();
+        if (!line)
+            continue;
+        const cols = line.split(/\s+/);
+        if (cols.length < 4)
+            continue;
+        const unitName = cols[0];
+        const loaded = cols[1];
+        const active = cols[2];
+        const sub = cols[3];
+        if (!unitName.startsWith('claude-session-') || !unitName.endsWith('.scope'))
+            continue;
+        const unitToken = unitTokenFromScopeUnit(unitName);
+        if (!unitToken)
+            continue;
+        out.push({ unitName, unitToken, loaded, active, sub });
+    }
+    return out;
+}
+/** Issue `systemctl --user list-units --type=scope --no-legend
+ *  'claude-session-*.scope'` and return the parsed rows. The boot-seed
+ *  uses this to discover surviving PTYs across a manager restart. */
+export function listSurvivingScopes(run) {
+    const result = run([
+        '--user',
+        'list-units',
+        '--type=scope',
+        '--no-legend',
+        '--all',
+        'claude-session-*.scope',
+    ]);
+    if (result.exitCode !== 0) {
+        return { scopes: [], result };
+    }
+    return { scopes: parseSurvivingScopes(result.stdout), result };
+}
+/** Issue `systemctl --user stop --no-block <unit>`. The --no-block flag
+ *  returns once the stop request is queued; the scope's TimeoutStopSec=5
+ *  handles SIGTERM→SIGKILL escalation. Exit code 5 ("not loaded") means
+ *  the scope retired naturally — treated as success. */
+export function stopScopeUnit(run, unitToken) {
+    const unit = scopeUnitName(unitToken);
+    const result = run(['--user', 'stop', '--no-block', unit]);
+    if (result.exitCode === 0) {
+        return { outcome: 'ok', exitCode: 0, stderr: result.stderr };
+    }
+    // systemctl exits 5 when the unit isn't loaded — i.e. systemd already
+    // retired the scope because claude exited on its own. Operator pressed
+    // End on a row whose claude had already quit; we treat the request as
+    // satisfied.
+    if (result.exitCode === 5) {
+        return { outcome: 'already-gone', exitCode: 5, stderr: result.stderr };
+    }
+    return { outcome: 'error', exitCode: result.exitCode, stderr: result.stderr };
+}
+/** Build the systemd-run argv that node-pty wraps for one claude spawn.
+ *  Inside the scope, `/bin/sh -c 'trap "" HUP; exec "$@"'` wraps the
+ *  launch so claude ignores SIGHUP when the manager closes the PTY master
+ *  fd on restart. Without the wrap, master-close → kernel SIGHUP → claude
+ *  exits, and the brief's "PTY pid survives manager restart" verify-gate
+ *  fails.
+ *
+ *  The shell `exec` replaces the sh process image with claude in-place
+ *  rather than forking, so pty.pid == claude.pid (the pid is preserved
+ *  across execve). This matters because the manager's
+ *  `watcher.waitForPid(pty.pid, …)` resolves when Claude Code writes its
+ *  own PID file at `$CLAUDE_CONFIG_DIR/sessions/<claude-pid>.json`; with
+ *  a non-exec sh wrap, pty.pid would be sh's pid (≠ claude's pid) and
+ *  waitForPid would never resolve. */
+export function buildSystemdRunArgv(p) {
+    const unit = scopeUnitName(p.unitToken);
+    const args = [
+        '--user',
+        '--scope',
+        '--quiet',
+        `--unit=${unit}`,
+        `--slice=${CLAUDE_PTYS_SLICE}`,
+        '-p',
+        `TimeoutStopSec=${SCOPE_TIMEOUT_STOP_SEC}`,
+        `--working-directory=${p.cwd}`,
+    ];
+    // One --setenv per env key. Order is sorted-by-key for deterministic
+    // log lines and test fixtures (and to make argv-diff review tractable
+    // across spawns).
+    const keys = Object.keys(p.env).sort();
+    for (const k of keys) {
+        args.push(`--setenv=${k}=${p.env[k]}`);
+    }
+    // POSIX `--` sentinel — ends systemd-run's own flag parsing so the
+    // following positional argv (the sh wrapper + claude) doesn't get
+    // swallowed by `--setenv=` etc.
+    args.push('--');
+    // SIGHUP-trap wrap. `$@` expands every argv from $0 onwards INSIDE the
+    // shell, so passing 'sh' as $0 lets `"$@"` resolve to
+    // `<claudeBin> <claudeArgs...>` after the trap. Without the explicit
+    // $0 ('sh') the first claudeArg would be consumed as $0 and lost.
+    args.push('/bin/sh', '-c', 'trap "" HUP; exec "$@"', 'sh', p.claudeBin);
+    for (const a of p.claudeArgs)
+        args.push(a);
+    return { cmd: 'systemd-run', args };
+}
+/** Query `systemctl --user show -p MainPID claude-session-<token>.scope`
+ *  and return the main pid (the claude process). Boot-seed uses this to
+ *  bridge from the surviving scope unit to the PID file claude wrote at
+ *  `$CLAUDE_CONFIG_DIR/sessions/<pid>.json`, which in turn carries claude's
+ *  intrinsic sessionId. Returns null when the unit has no main pid (the
+ *  scope is draining) or when the systemctl call fails. */
+export function getScopeMainPid(run, unitToken) {
+    const unit = scopeUnitName(unitToken);
+    const result = run(['--user', 'show', '-p', 'MainPID', '--value', unit]);
+    if (result.exitCode !== 0)
+        return null;
+    const raw = result.stdout.trim();
+    if (!raw || raw === '0')
+        return null;
+    const n = Number.parseInt(raw, 10);
+    return Number.isFinite(n) && n > 0 ? n : null;
+}
+/** Slice unit declared at install time so every claude scope shares one
+ *  cohort cgroup. `systemctl --user status claude-ptys.slice` gives the
+ *  operator a one-glance view of total live-session memory + CPU. */
+export function buildClaudePtysSliceUnitFile() {
+    return `[Unit]
+Description=Claude Code PTY sessions (Task 250)
+Documentation=https://github.com/rubytech/maxy-code/blob/main/.tasks/archive/250-claude-ptys-survive-manager-restart-via-systemd-scope-per-pty.md
+Before=shutdown.target
+
+[Slice]
+
+[Install]
+WantedBy=default.target
+`;
+}
+//# sourceMappingURL=systemd-scope.js.map

package/payload/platform/services/claude-session-manager/dist/systemd-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"systemd-scope.js","sourceRoot":"","sources":["../src/systemd-scope.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,6EAA6E;AAC7E,uEAAuE;AACvE,2EAA2E;AAC3E,uEAAuE;AACvE,wBAAwB;AACxB,EAAE;AACF,yEAAyE;AACzE,4EAA4E;AAC5E,yEAAyE;AACzE,yEAAyE;AACzE,0BAA0B;AAC1B,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,uEAAuE;AACvE,4CAA4C;AAE5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C;;gBAEgB;AAChB,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAAmB,CAAA;AAEpD;;;uDAGuD;AACvD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAA;AAkBvC,MAAM,UAAU,sBAAsB,CAAC,IAAuB;IAC5D,MAAM,CAAC,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QAC1C,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAM;KAChB,CAAC,CAAA;IACF,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;QACpD,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;KACrD,CAAA;AACH,CAAC;AAED,oEAAoE;AACpE,yEAAyE;AACzE,sEAAsE;AACtE,oEAAoE;AACpE,mEAAmE;AACnE,0EAA0E;AAC1E,0DAA0D;AAC1D,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,oEAAoE;AACpE,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,qBAAqB,CAAA;AAE9C,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,IAAI,CAAC,SAAS,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CACb,oDAAoD,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAChF,CAAA;IACH,CAAC;IACD,OAAO,kBAAkB,SAAS,QAAQ,CAAA;AAC5C,CAAC;AAED;;wEAEwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAA;IACpD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AACxB,CAAC;AAcD;;;8CAG8C;AAC9C,MAAM,UAAU,oBAAoB,CAAC,MAAc;IACjD,MAAM,GAAG,GAAqB,EAAE,CAAA;IAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAA;QAC3B,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QAC9B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACxB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAQ;QACrF,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAClD,IAAI,CAAC,SAAS;YAAE,SAAQ;QACxB,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IACxD,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,GAAoB;IAItD,MAAM,MAAM,GAAG,GAAG,CAAC;QACjB,QAAQ;QACR,YAAY;QACZ,cAAc;QACd,aAAa;QACb,OAAO;QACP,wBAAwB;KACzB,CAAC,CAAA;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAA;IAC/B,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;AAChE,CAAC;AAcD;;;wDAGwD;AACxD,MAAM,UAAU,aAAa,CAC3B,GAAoB,EACpB,SAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAA;IAC1D,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;IAC9D,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,aAAa;IACb,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;IACxE,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;AAC/E,CAAC;AAwBD;;;;;;;;;;;;;sCAasC;AACtC,MAAM,UAAU,mBAAmB,CAAC,CAA4B;IAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACvC,MAAM,IAAI,GAAa;QACrB,QAAQ;QACR,SAAS;QACT,SAAS;QACT,UAAU,IAAI,EAAE;QAChB,WAAW,iBAAiB,EAAE;QAC9B,IAAI;QACJ,kBAAkB,sBAAsB,EAAE;QAC1C,uBAAuB,CAAC,CAAC,GAAG,EAAE;KAC/B,CAAA;IACD,qEAAqE;IACrE,sEAAsE;IACtE,kBAAkB;IAClB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;IACtC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACxC,CAAC;IACD,mEAAmE;IACnE,kEAAkE;IAClE,gCAAgC;IAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACf,uEAAuE;IACvE,sDAAsD;IACtD,qEAAqE;IACrE,kEAAkE;IAClE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,CAAA;IACvE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU;QAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC1C,OAAO,EAAE,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,CAAA;AACrC,CAAC;AAED;;;;;2DAK2D;AAC3D,MAAM,UAAU,eAAe,CAC7B,GAAoB,EACpB,SAAiB;IAEjB,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAA;IACxE,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;IAChC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;IAClC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/C,CAAC;AAED;;qEAEqE;AACrE,MAAM,UAAU,4BAA4B;IAC1C,OAAO;;;;;;;;;CASR,CAAA;AACD,CAAC"}

package/payload/platform/services/claude-session-manager/dist/types.d.ts

@@ -17,10 +17,6 @@ export interface Session {
     senderId: string;
     role: Role;
     channel: Channel;
-    /** Path of the JSONL Claude Code wrote, observed from disk. Non-null
-     *  on every wire payload — the manager blocks the spawn response on
-     *  observation, so a session never appears in /list without it. */
-    jsonlPath: string;
 }
 export interface PtyHandle {
     readonly pid: number;

package/payload/platform/services/claude-session-manager/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAA;AAErC,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;AAE/E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,OAAO;IACtB;;;2DAGuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;IAChB;;uEAEmE;IACnE,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAA;IACvD,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAA;IACnF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;;;wEAGoE;IACpE,OAAO,CAAC,IAAI,IAAI,CAAA;CACjB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG,OAAO,GAAG,QAAQ,CAAA;AAErC,MAAM,MAAM,OAAO,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,SAAS,GAAG,OAAO,CAAA;AAE/E,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,OAAO;IACtB;;;2DAGuD;IACvD,SAAS,EAAE,MAAM,CAAA;IACjB,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAA;IACvD,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,GAAG;QAAE,OAAO,IAAI,IAAI,CAAA;KAAE,CAAA;IACnF,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;;;wEAGoE;IACpE,OAAO,CAAC,IAAI,IAAI,CAAA;CACjB;AAED,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA"}

package/payload/platform/services/claude-session-manager/dist/user-title-store.d.ts

@@ -0,0 +1,39 @@
+import type { Logger } from './types.js';
+export interface UserTitleEntry {
+    title: string;
+    renamedAt: string;
+}
+export type ValidateResult = {
+    ok: true;
+    title: string;
+} | {
+    ok: false;
+    reason: 'empty' | 'too-long' | 'control-chars';
+};
+/** Single source of truth for user-title validation. Mirrored in
+ *  Sidebar.tsx + SessionMetadataPane.tsx as length-only client-side checks;
+ *  the control-char rejection is server-only. */
+export declare function validateUserTitle(raw: unknown): ValidateResult;
+export declare class UserTitleStore {
+    private readonly bySessionId;
+    private readonly filePath;
+    private readonly logger;
+    private loaded;
+    constructor(filePath: string, logger: Logger);
+    /** Read the persisted file into the in-memory map. Boot-resilient: any
+     *  failure (missing file, malformed JSON, permission denied) is logged
+     *  and the store starts empty. Never throws. */
+    loadFromDisk(): void;
+    get(sessionId: string): UserTitleEntry | undefined;
+    /** Persist `title` for `sessionId`. Caller is responsible for validating
+     *  via `validateUserTitle` first; the store stores whatever it's given. */
+    set(sessionId: string, title: string): UserTitleEntry;
+    /** Remove the entry for `sessionId` if present. Called on session
+     *  purge/delete cascade so the file doesn't accrete orphans.
+     *  Returns true when an entry was removed. */
+    remove(sessionId: string): boolean;
+    /** Current in-memory snapshot — diagnostic only. */
+    size(): number;
+    private persistAtomic;
+}
+//# sourceMappingURL=user-title-store.d.ts.map

package/payload/platform/services/claude-session-manager/dist/user-title-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-title-store.d.ts","sourceRoot":"","sources":["../src/user-title-store.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC3B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,UAAU,GAAG,eAAe,CAAA;CAAE,CAAA;AAKjE;;iDAEiD;AACjD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,cAAc,CAO9D;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAoC;IAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAQ;IAC/B,OAAO,CAAC,MAAM,CAAQ;gBAEV,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAK5C;;oDAEgD;IAChD,YAAY,IAAI,IAAI;IA0CpB,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIlD;+EAC2E;IAC3E,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,cAAc;IAOrD;;kDAE8C;IAC9C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAMlC,oDAAoD;IACpD,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,aAAa;CActB"}

package/payload/platform/services/claude-session-manager/dist/user-title-store.js

@@ -0,0 +1,138 @@
+// Persistent per-session title overrides. The operator renames any row from
+// the sidebar / detail pane; the title persists across manager restarts and
+// across `--resume` PTY swaps (the canonical sessionId stays constant).
+//
+// Lifecycle:
+//   - Boot reads `<accountDir>/session-titles.json` into the in-memory Map.
+//   - `set(sessionId, title)` writes the map and atomically persists.
+//   - `remove(sessionId)` mutates on session purge / delete cascade.
+//   - File corruption / missing parent dir / permission errors at boot are
+//     logged and treated as empty map; the manager NEVER refuses to start.
+//
+// File format (UTF-8 JSON):
+//   { "<sessionId>": { "title": "...", "renamedAt": "2026-05-22T18:00:00.000Z" } }
+//
+// Validation lives here (single source of truth). The /rename HTTP route
+// imports `validateUserTitle`; the UI does length-only checks for ergonomics
+// (the binding gate is the manager route — see SKILL: writer/reader char-set
+// drift learning).
+import { existsSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+const MAX_TITLE_LENGTH = 200;
+const CONTROL_CHAR_RE = /[\x00-\x1f\x7f]/;
+/** Single source of truth for user-title validation. Mirrored in
+ *  Sidebar.tsx + SessionMetadataPane.tsx as length-only client-side checks;
+ *  the control-char rejection is server-only. */
+export function validateUserTitle(raw) {
+    if (typeof raw !== 'string')
+        return { ok: false, reason: 'empty' };
+    const trimmed = raw.trim();
+    if (trimmed.length === 0)
+        return { ok: false, reason: 'empty' };
+    if (trimmed.length > MAX_TITLE_LENGTH)
+        return { ok: false, reason: 'too-long' };
+    if (CONTROL_CHAR_RE.test(trimmed))
+        return { ok: false, reason: 'control-chars' };
+    return { ok: true, title: trimmed };
+}
+export class UserTitleStore {
+    bySessionId = new Map();
+    filePath;
+    logger;
+    loaded = false;
+    constructor(filePath, logger) {
+        this.filePath = filePath;
+        this.logger = logger;
+    }
+    /** Read the persisted file into the in-memory map. Boot-resilient: any
+     *  failure (missing file, malformed JSON, permission denied) is logged
+     *  and the store starts empty. Never throws. */
+    loadFromDisk() {
+        this.loaded = true;
+        if (!existsSync(this.filePath)) {
+            this.logger(`[claude-session-manager] user-title-store-load empty reason=file-missing path=${this.filePath}`);
+            return;
+        }
+        let raw;
+        try {
+            raw = readFileSync(this.filePath, 'utf-8');
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.logger(`[claude-session-manager] user-title-store-load failed reason=read-error detail=${detail.slice(0, 200)} — starting empty`);
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.logger(`[claude-session-manager] user-title-store-load failed reason=malformed-json detail=${detail.slice(0, 200)} — starting empty`);
+            return;
+        }
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            this.logger(`[claude-session-manager] user-title-store-load failed reason=not-an-object — starting empty`);
+            return;
+        }
+        let loaded = 0;
+        for (const [sessionId, value] of Object.entries(parsed)) {
+            if (typeof sessionId !== 'string' || sessionId.length === 0)
+                continue;
+            if (!value || typeof value !== 'object')
+                continue;
+            const v = value;
+            if (typeof v.title !== 'string' || v.title.trim().length === 0)
+                continue;
+            const trimmed = v.title.trim();
+            if (trimmed.length > MAX_TITLE_LENGTH)
+                continue;
+            if (CONTROL_CHAR_RE.test(trimmed))
+                continue;
+            const renamedAt = typeof v.renamedAt === 'string' && v.renamedAt.length > 0 ? v.renamedAt : new Date(0).toISOString();
+            this.bySessionId.set(sessionId, { title: trimmed, renamedAt });
+            loaded += 1;
+        }
+        this.logger(`[claude-session-manager] user-title-store-load ok entries=${loaded} path=${this.filePath}`);
+    }
+    get(sessionId) {
+        return this.bySessionId.get(sessionId);
+    }
+    /** Persist `title` for `sessionId`. Caller is responsible for validating
+     *  via `validateUserTitle` first; the store stores whatever it's given. */
+    set(sessionId, title) {
+        const entry = { title, renamedAt: new Date().toISOString() };
+        this.bySessionId.set(sessionId, entry);
+        this.persistAtomic();
+        return entry;
+    }
+    /** Remove the entry for `sessionId` if present. Called on session
+     *  purge/delete cascade so the file doesn't accrete orphans.
+     *  Returns true when an entry was removed. */
+    remove(sessionId) {
+        const had = this.bySessionId.delete(sessionId);
+        if (had)
+            this.persistAtomic();
+        return had;
+    }
+    /** Current in-memory snapshot — diagnostic only. */
+    size() {
+        return this.bySessionId.size;
+    }
+    persistAtomic() {
+        const obj = {};
+        for (const [sessionId, entry] of this.bySessionId)
+            obj[sessionId] = entry;
+        const tmp = `${this.filePath}.tmp`;
+        try {
+            writeFileSync(tmp, JSON.stringify(obj, null, 2), 'utf-8');
+            renameSync(tmp, this.filePath);
+        }
+        catch (err) {
+            const detail = err instanceof Error ? err.message : String(err);
+            this.logger(`[claude-session-manager] user-title-store-persist failed detail=${detail.slice(0, 200)}`);
+            // No rethrow — a rename whose persist failed still serves reads from
+            // the in-memory map until next boot. Boot-resilient on next start.
+        }
+    }
+}
+//# sourceMappingURL=user-title-store.js.map

package/payload/platform/services/claude-session-manager/dist/user-title-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-title-store.js","sourceRoot":"","sources":["../src/user-title-store.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,aAAa;AACb,4EAA4E;AAC5E,sEAAsE;AACtE,qEAAqE;AACrE,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,4BAA4B;AAC5B,mFAAmF;AACnF,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,mBAAmB;AAEnB,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAY7E,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAC5B,MAAM,eAAe,GAAG,iBAAiB,CAAA;AAEzC;;iDAEiD;AACjD,MAAM,UAAU,iBAAiB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAClE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAC1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;IAC/D,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAA;IAC/E,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAA;IAChF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;AACrC,CAAC;AAED,MAAM,OAAO,cAAc;IACR,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAA;IAC/C,QAAQ,CAAQ;IAChB,MAAM,CAAQ;IACvB,MAAM,GAAG,KAAK,CAAA;IAEtB,YAAY,QAAgB,EAAE,MAAc;QAC1C,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IAED;;oDAEgD;IAChD,YAAY;QACV,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,CAAC,iFAAiF,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;YAC7G,OAAM;QACR,CAAC;QACD,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,kFAAkF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YACtI,OAAM;QACR,CAAC;QACD,IAAI,MAAe,CAAA;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,sFAAsF,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAA;YAC1I,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,MAAM,CAAC,6FAA6F,CAAC,CAAA;YAC1G,OAAM;QACR,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;YACnF,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACrE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,SAAQ;YACjD,MAAM,CAAC,GAAG,KAAiD,CAAA;YAC3D,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ;YACxE,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAA;YAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;gBAAE,SAAQ;YAC/C,IAAI,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;gBAAE,SAAQ;YAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;YACrH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9D,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,6DAA6D,MAAM,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC1G,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED;+EAC2E;IAC3E,GAAG,CAAC,SAAiB,EAAE,KAAa;QAClC,MAAM,KAAK,GAAmB,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAA;QAC5E,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;QACtC,IAAI,CAAC,aAAa,EAAE,CAAA;QACpB,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;kDAE8C;IAC9C,MAAM,CAAC,SAAiB;QACtB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,aAAa,EAAE,CAAA;QAC7B,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,oDAAoD;IACpD,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;IAEO,aAAa;QACnB,MAAM,GAAG,GAAmC,EAAE,CAAA;QAC9C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,WAAW;YAAE,GAAG,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,MAAM,CAAA;QAClC,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;YACzD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC/D,IAAI,CAAC,MAAM,CAAC,mEAAmE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAA;YACtG,qEAAqE;YACrE,mEAAmE;QACrE,CAAC;IACH,CAAC;CACF"}

package/payload/premium-plugins/real-agent/plugins/brochures/skills/property-brochure/SKILL.md

@@ -176,7 +176,10 @@ When any field above is unresolved after consulting its primary source, **stop b
 - **Web bundle ships the PDF, not per-page JPGs.** The bundle does not include `cover-print.jpg … backpage-print.jpg` — those duplicate the brochure content already embedded in `<slug>-brochure.pdf`. The web copy of `brochure.html` has its `.print-img` src attributes cleared so the print stylesheet drops to the live-DOM fallback; operators who want a printable PDF download the bundled PDF directly. See `references/build.md → Clear .print-img src in the web copy`. Shipping both was the historical bundle-bloat defect.
 - **Pages with absolutely-positioned bottom elements must reserve their footprint in the in-flow content's padding.** Two absolute elements live at the bottom of every `.page`: the `.folio` page-number strip (`bottom: 8mm`, ~8mm tall → occupies bottom ~16mm) and, on the back page only, the `.back-disclaimer` (`bottom: 16mm`, wraps to up to 5 lines × 3.7mm → occupies bottom ~34.5mm). In-flow content above them (`.mi-foot` with `margin-top: auto` inside `.mi-page`, or `.backpage-inner` content with `justify-content: center`) is a SIBLING of those absolute elements — nothing in CSS structure enforces clearance. The fix is always to pull the in-flow container UP via its parent's `padding-bottom`: `.mi-page` uses **22mm** (folio clearance), `.backpage-inner` uses **42mm** (folio + disclaimer clearance with 4mm gap). Any future page that adds an absolute bottom element must update the in-flow parent's `padding-bottom` accordingly — never try to push the absolute element down with `margin-*` (no positional effect on `position: absolute` whose anchor is `bottom`). This is the "Absolute vs in-flow" lesson from the recommendations doc — pull the in-flow element, never the absolute one.
 - **Folio is plain text on whitespace or absent — never chrome over imagery.** The `.folio > span` carries no background, blur, padding, border-radius, or shadow. It is plain text in `--teal-900` that sits on the clean whitespace reserved at the page bottom (see the previous rule on padding-bottom clearance). The folio is **hidden entirely** on full-bleed-bottom pages: `.cover`, `.page.intermission`, `.page.folio-dark`, and any `.page` whose body wraps a `.feature-page` (photo+panel layout where the photo bleeds to the page bottom). Never reintroduce a folio-pill background to "make it readable over the image" — that's competing chrome on the page; suppress the folio on that page instead. Any new full-bleed-bottom page class must be added to the `.folio` `display: none` selector in `references/template.html`.
+- **Page 13's `{{ siteplan_src }}` is never the floorplan.** Page 13 (the site-plan / plot page, `.page siteplan-page`, "Continued, Chapter VI · The plot") expects a plot drawing, site plan, or aerial photo — an image distinct from the floorplan that page 14 already carries. If no such image is naturally available (no `<slug>-siteplan.png` line-art, no aerial photo on disk), the operator confirmation prompt MUST list `{{ siteplan_src }}` as an unresolved field and request a substitute by name — a wide exterior, a paddock/grounds photo, a drone shot of the property in its setting, or a hand-marked site sketch. Silently falling back to the floorplan duplicates page 14's content and is a defect (the brochure ships with the same image on two consecutive pages — visible immediately on review). The fallback is forbidden by the same doctrine as `TBC`: never coerce a field to a default the operator did not confirm. If the operator cannot supply a substitute, the brochure drops to the 12-page reduced layout (no page 13) — not to a 16-page layout with a duplicated floorplan.
 - **Verification covers every page in the deliverable — sampling is a defect, not a shortcut.** `scrollHeight` fit checks, computed-style collision probes (`.mi-foot` ↔ `.folio` gap, `.back-disclaimer` ↔ in-flow content, any future absolute-bottom element vs in-flow neighbour), and visual review before declaring done all walk **every page** in the 16-page folio (or 12-page reduced layout). "Sample-checked 3 of 12 pages" or any variant ("spot-checked the spreads I changed", "skimmed a few representative pages") is not authorised — the skill explicitly says "verify every page" in `references/build.md → Live editing workflow` step 8 and in `references/structure.md`. The deliverable is the brochure as a whole; a defect on an unchecked page ships exactly as readily as a defect on a checked one. If a probe is expensive enough that walking 16 pages feels burdensome, the cost is the probe's, not the skill's — propose a faster probe rather than narrowing the coverage.
+- **`scrollHeight > viewport budget` is ALWAYS a defect — never "negligible".** Landscape budget is **794px** (`min-height: 210mm` at 96dpi); portrait is **1123px**. Every `.page`'s `scrollHeight` must be `≤` the budget — strict, not "approximately equal". A 4px overflow IS a defect: `overflow: hidden` silently clips that excess, and on pages with absolute-positioned bottom chrome (`.folio`, `.back-disclaimer`) the clipped content paints over chrome that lives in the absolute layer. "It's only 4 pixels" is the rationalisation that ships defects — the rule does not have a tolerance band. If a page reports `scrollHeight > budget` even by 1px, the build halts until the operator addresses the content-volume mismatch (trim copy, shrink an image, reduce a row count, or split into a continuation page). Never paper over with `overflow: hidden`-as-clip; the warning sign is the deliverable's only signal that the content doesn't fit.
+- **Material Information table has a hard row capacity — overflow is a content-volume defect, not a render bug.** At the default `.mi-row` sizing (9.5/11.5px fonts, 6px vertical padding, 18px `.mi-grid` row-gap), one column in the three-column MI grid fits **~13 rows** within the 22mm-clearance budget. A property with an unusually full table (e.g. 17+ rows in the tallest column, observed on a recent run) overruns by ~25mm / ~85px and clips into the folio zone. When MI's content volume exceeds the budget, the operator confirmation prompt MUST surface `mi.<column>.row_count` as an overflow item and ask the operator to either (a) trim the column to ≤ 13 rows by consolidating related disclosures (e.g. merge "easements" + "water/sewerage" + "rights of way" into one "Other matters" row that points at the seller's solicitor), or (b) opt into a continuation page (15a / 15b) — a separate skill-level decision that breaks the default 16-page contract and must be operator-confirmed. The build never silently truncates rows, never shrinks fonts to "make it fit", and never accepts a scrollHeight overflow as "negligible". The default `.mi-page` 22mm bottom-padding is sized for the typical property; properties outside the typical range MUST resolve via operator confirmation, not via the agent's judgement about which rows are "less important".
 - **No `{{ token }}` may remain in rendered output** — `grep '{{' output/brochure.html` must return zero matches before PDFs are built.
 
 ## Scope