@rubytech/create-maxy-code 0.1.92 → 0.1.94

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -24,9 +24,10 @@
 import { Hono } from 'hono';
 import { stream } from 'hono/streaming';
 import { existsSync, statSync, createReadStream, watchFile, unwatchFile, rmSync, mkdirSync, renameSync, readFileSync } from 'node:fs';
-import { spawnClaudeSession, stopSession, PERMISSION_MODES } from './pty-spawner.js';
+import { spawnClaudeSession, stopSession, writeInputToPty, isLive, onPtyExit, livePtyCount, getPtyTrackerForTests, PERMISSION_MODES, } from './pty-spawner.js';
+import { readSidecar } from './session-sidecar.js';
 import { readJsonlSession } from './jsonl-enumerator.js';
-import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId } from './jsonl-path.js';
+import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId } from './jsonl-path.js';
 import { basename, join } from 'node:path';
 import { validateUserTitle } from './user-title-store.js';
 const ROLES = ['admin', 'public'];
@@ -131,8 +132,15 @@ function parseSpecialistDomains(raw) {
     return out.length > 0 ? out : undefined;
 }
 // `<id>` may be: intrinsic UUID, bridgeSessionId ("session_<suffix>"),
-// bridgeSuffix, or pid (numeric). All resolve to a sessionId via watcher.
-const SESSION_ID_PATTERN = /^[A-Za-z0-9_-]{1,128}$/;
+// bridgeSuffix, pid (numeric), or the resume-conflict stash composite
+// id `<uuid>.<unix-ms>` minted at http-server.ts:1006/1013 and surfaced
+// by Task 260's archive enumerator. Dot is admitted; length raised to
+// fit UUID (36) + `.` + 13-digit ms; the negative lookahead rejects
+// all-dot strings so path-traversal shapes (`.`, `..`, `...`) cannot
+// satisfy the gate. No `/` — Hono's route param already excludes it,
+// and admitting it here would broaden the filesystem surface the
+// downstream `jsonlPathForSessionId` composition trusts.
+export const SESSION_ID_PATTERN = /^(?!\.+$)[A-Za-z0-9._-]{1,160}$/;
 const LIST_TAIL_BYTES = 64 * 1024;
 function timed(logger, method, path, status, ms) {
     logger(`api method=${method} path=${path} outcome=${status} ms=${ms}`);
@@ -166,11 +174,11 @@ function resolveRow(watcher, id) {
 // auto-archive` lines cover the lifecycle.
 const END_TURN_SIGNATURE = '"stop_reason":"end_turn"';
 const AUTO_ARCHIVE_SPECIALIST = 'database-operator';
-function attachSpecialistEndTurnAutoArchive(deps, session) {
-    if (session.specialist !== AUTO_ARCHIVE_SPECIALIST)
+function attachSpecialistEndTurnAutoArchive(deps, sessionId, specialist) {
+    if (specialist !== AUTO_ARCHIVE_SPECIALIST)
         return;
     let archived = false;
-    const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, session.sessionId);
+    const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
     function endTurnSeen() {
         try {
             const content = readFileSync(jsonlPath, 'utf8');
@@ -188,35 +196,38 @@ function attachSpecialistEndTurnAutoArchive(deps, session) {
         if (!endTurnSeen())
             return;
         archived = true;
-        deps.logger(`auto-archive sessionId=${session.sessionId} specialist=${AUTO_ARCHIVE_SPECIALIST} reason=end-turn archivedAt=${new Date().toISOString()}`);
-        void stopSession({ store: deps.store, killGraceMs: deps.killGraceMs, logger: deps.logger }, session.sessionId);
+        deps.logger(`auto-archive sessionId=${sessionId} specialist=${AUTO_ARCHIVE_SPECIALIST} reason=end-turn archivedAt=${new Date().toISOString()}`);
+        void stopSession({
+            killGraceMs: deps.killGraceMs,
+            logger: deps.logger,
+            runSystemctl: deps.runSystemctl,
+        }, sessionId);
     }
     tryArchive();
     const unsubscribe = deps.watcher.subscribe((event) => {
         if (archived)
             return;
-        if (event.sessionId !== session.sessionId)
+        if (event.sessionId !== sessionId)
             return;
         if (event.source !== 'jsonl')
             return;
         tryArchive();
     });
-    session.pty.onExit(() => unsubscribe());
+    onPtyExit(sessionId, () => unsubscribe());
 }
-function attachPublicAudit(deps, session) {
-    if (session.role !== 'public')
+function attachPublicAudit(deps, sessionId, role) {
+    if (role !== 'public')
         return;
-    const claudeSessionId = session.sessionId;
-    const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, claudeSessionId);
+    const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
     if (!existsSync(jsonlPath))
         return;
-    deps.publicToolAudit.attach(claudeSessionId, jsonlPath);
-    if (session.exited) {
-        deps.publicToolAudit.detach(claudeSessionId);
+    deps.publicToolAudit.attach(sessionId, jsonlPath);
+    if (!isLive(sessionId)) {
+        deps.publicToolAudit.detach(sessionId);
         return;
     }
-    session.pty.onExit(() => {
-        deps.publicToolAudit.detach(claudeSessionId);
+    onPtyExit(sessionId, () => {
+        deps.publicToolAudit.detach(sessionId);
     });
 }
 export function buildHttpApp(deps) {
@@ -245,8 +256,10 @@ export function buildHttpApp(deps) {
     }
     app.__notifyRenameForTests = notifyRename;
     // Watcher subscriber: when the JSONL CREATE event fires for a live
-    // session, attach the public-audit watcher. The path is derived
-    // (Task 258 — StoredSession no longer carries jsonlPath).
+    // session, attach the public-audit watcher. The watcher row carries
+    // the role from the sidecar (Task 260 — disk is the source of truth),
+    // so the audit attachment fires deterministically against rows whose
+    // PTY is still alive in this manager process.
     deps.watcher.subscribe((event) => {
         if (event.source !== 'jsonl')
             return;
@@ -254,10 +267,9 @@ export function buildHttpApp(deps) {
             return;
         if (!event.row)
             return;
-        const live = deps.store.get(event.sessionId);
-        if (!live)
+        if (!isLive(event.sessionId))
             return;
-        attachPublicAudit(deps, live);
+        attachPublicAudit(deps, event.sessionId, event.row.role);
     });
     // Task 183 — dispatch jsonl modify/create events into the recorder
     // tail. The tail filters by registered sessionId (only specialist
@@ -279,75 +291,71 @@ export function buildHttpApp(deps) {
             tail.onJsonlModify(event.sessionId, path);
         });
     }
-    /** Task 253 — resolve (displayName, titleSource) for a live PTY.
-     *  Three cases:
-     *  - JSONL exists: read the enumerator's merged result (the enumerator
-     *    consults the user-title store; one resolution site for both layers).
-     *  - JSONL missing but user-title-store has an entry: pre-jsonl rename —
-     *    operator renamed a brand-new row before the first turn flushed.
-     *  - Neither: null + null. */
-    function liveTitleAndSource(s) {
-        const path = jsonlPathForSessionId(deps.spawnCwd, s.sessionId);
-        if (existsSync(path)) {
-            const enriched = readJsonlSession(deps.spawnCwd, s.sessionId, LIST_TAIL_BYTES, deps.logger, deps.userTitleStore);
-            if (enriched)
-                return { displayName: enriched.displayName, titleSource: enriched.titleSource };
+    /** Task 260 — /spawn and /resume need to return a wire payload
+     *  immediately, but at that moment the watcher row may not yet
+     *  include the sidecar fields (the JSONL CREATE event hasn't fired
+     *  in fresh-spawn tests with synthetic watchers). Build the payload
+     *  from the row if present, falling back to a synthetic shape that
+     *  reads the sidecar directly. */
+    function buildSpawnReturnPayload(sessionId, pid, startedAt, capturedUrl) {
+        const row = deps.watcher.getBySessionId(sessionId);
+        if (row && row.senderId !== null) {
+            return toPayload(row);
         }
-        const userTitle = deps.userTitleStore.get(s.sessionId)?.title;
-        if (userTitle)
-            return { displayName: userTitle, titleSource: 'user' };
-        return { displayName: null, titleSource: null };
-    }
-    /** Task 258/259 — derived: a session is "archived" when its canonical
-     *  top-level jsonl is absent but the archive/ variant exists. After the
-     *  Task 258 refactor the watcher's row index doesn't surface archive/
-     *  rows; the field stays on the wire so the Sidebar/SessionMetadataPane
-     *  Unarchive affordance remains type-stable. A future task that
-     *  enumerates archive/ jsonls into the row index will populate this
-     *  honestly for archived rows. */
-    function isArchivedJsonlPath(sessionId) {
-        const canonical = jsonlPathForSessionId(deps.spawnCwd, sessionId);
-        if (existsSync(canonical))
-            return false;
-        return existsSync(jsonlPathForSessionId(deps.spawnCwd, sessionId, { archived: true }));
-    }
-    function toLivePayload(s) {
-        const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, s.sessionId);
+        // Read the sidecar directly — the spawn just wrote it.
+        const sidecarPath = sidecarPathForSessionId(deps.spawnCwd, sessionId);
+        const { sidecar } = readSidecar(sidecarPath, deps.logger);
+        const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
         const hasJsonl = existsSync(jsonlPath);
-        const title = liveTitleAndSource(s);
         return {
-            sessionId: s.sessionId,
-            pid: s.pid,
-            url: s.url,
-            startedAt: s.startedAt,
-            senderId: s.senderId,
-            role: s.role,
-            channel: s.channel,
+            sessionId,
+            pid,
+            url: capturedUrl ?? sidecar?.url ?? null,
+            startedAt: sidecar?.startedAt ?? startedAt,
+            senderId: sidecar?.senderId ?? '',
+            role: sidecar?.role ?? null,
+            channel: sidecar?.channel ?? null,
             jsonlPath: hasJsonl ? jsonlPath : null,
             status: 'alive',
             archived: false,
-            displayName: title.displayName,
-            titleSource: title.titleSource,
+            displayName: null,
+            titleSource: null,
             lastMessageAt: null,
             turnCount: 0,
             capped: false,
             sizeBytes: hasJsonl ? statSync(jsonlPath).size : null,
-            hidden: s.hidden,
-            specialist: s.specialist,
+            hidden: sidecar?.hidden ?? false,
+            specialist: sidecar?.specialist ?? null,
             model: null,
         };
     }
-    function toArchivedPayload(row, senderId) {
+    /** Task 260 — single payload builder. Both live and archived rows
+     *  derive every wire field from the watcher row (which itself derived
+     *  from the sidecar + JSONL + PID file). The split between
+     *  `toLivePayload`/`toArchivedPayload` is gone; the row's `state`
+     *  and `pid` decide `status` and the `archived` flag.
+     *
+     *  The `model` field continues to derive from the JSONL tail (last
+     *  assistant turn) rather than the sidecar's spawn-request model —
+     *  see [[learnings_writer_reader_charset_drift]] family: the running
+     *  model is what the wire's `model` has historically meant, and the
+     *  sidecar's `model` is kept as a self-diagnostic record. */
+    function toPayload(row) {
+        const isLiveState = row.state === 'live';
+        const archivedJsonlPath = jsonlPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true });
+        const topJsonlPath = jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
+        const jsonlPath = isLiveState
+            ? topJsonlPath
+            : existsSync(archivedJsonlPath) ? archivedJsonlPath : topJsonlPath;
+        const hasJsonl = existsSync(jsonlPath);
         let displayName = null;
         let titleSource = null;
         let lastMessageAt = null;
         let turnCount = 0;
         let capped = false;
-        let sizeBytes = null;
+        let sizeBytes = hasJsonl ? statSync(jsonlPath).size : null;
         let model = null;
-        let startedAt = new Date(row.updatedAt || 0).toISOString();
-        const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
-        const hasJsonl = existsSync(jsonlPath);
+        let enrichedStartedAt = null;
         if (hasJsonl) {
             const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, LIST_TAIL_BYTES, deps.logger, deps.userTitleStore);
             if (enriched) {
@@ -357,38 +365,49 @@ export function buildHttpApp(deps) {
                 turnCount = enriched.turnCount;
                 capped = enriched.capped;
                 sizeBytes = enriched.sizeBytes;
-                startedAt = enriched.startedAt;
+                enrichedStartedAt = enriched.startedAt;
                 model = enriched.model;
             }
         }
         else {
-            // JSONL gone but user override may still exist (operator renamed the row
-            // before the cascade deleted the file). Surface the user title.
             const userTitle = deps.userTitleStore.get(row.sessionId)?.title;
             if (userTitle) {
                 displayName = userTitle;
                 titleSource = 'user';
             }
         }
+        // startedAt resolution order:
+        // 1. JSONL enrichment (the most authoritative — claude's own record)
+        // 2. Sidecar (/spawn time)
+        // 3. Row mtime fallback (legacy archived rows without sidecar)
+        const startedAt = enrichedStartedAt
+            ?? row.startedAt
+            ?? new Date(row.updatedAt || 0).toISOString();
+        // Agent label: PID-file `agent` for live rows; cachedAgentSetting for
+        // archived rows (JSONL head). Sidecar's `sidecarSpecialist` is the
+        // spawn-time request — fall back to it when both above are null so
+        // post-Task-260 rows surface their specialist even if the JSONL
+        // doesn't include an agent-setting record.
+        const specialist = row.agent ?? row.cachedAgentSetting ?? row.sidecarSpecialist;
         return {
             sessionId: row.sessionId,
-            pid: null,
-            url: null,
+            pid: row.pid,
+            url: row.url,
             startedAt,
-            senderId,
-            role: null,
-            channel: null,
+            senderId: row.senderId ?? '',
+            role: row.role,
+            channel: row.channel,
             jsonlPath: hasJsonl ? jsonlPath : null,
-            status: 'ended',
-            archived: isArchivedJsonlPath(row.sessionId),
+            status: isLiveState ? 'alive' : 'ended',
+            archived: row.state === 'archived',
             displayName,
             titleSource,
             lastMessageAt,
             turnCount,
             capped,
             sizeBytes,
-            hidden: false,
-            specialist: row.agent,
+            hidden: row.hidden,
+            specialist,
             model,
         };
     }
@@ -462,7 +481,16 @@ export function buildHttpApp(deps) {
             : body.tunnelUrl === null
                 ? null
                 : undefined;
-        const result = await spawnClaudeSession({ ...deps, store: deps.store, watcher: deps.watcher, onSessionReady: (s) => { attachPublicAudit(deps, s); attachSpecialistEndTurnAutoArchive(deps, s); }, onUrlCaptured: notifyUrlCaptured, tunnelUrlOverride }, {
+        const result = await spawnClaudeSession({
+            ...deps,
+            watcher: deps.watcher,
+            onSessionReady: (tracker) => {
+                attachPublicAudit(deps, tracker.sessionId, role);
+                attachSpecialistEndTurnAutoArchive(deps, tracker.sessionId, tracker.specialist);
+            },
+            onUrlCaptured: notifyUrlCaptured,
+            tunnelUrlOverride,
+        }, {
             senderId,
             userId,
             role: role,
@@ -491,7 +519,8 @@ export function buildHttpApp(deps) {
             return c.json({ error: 'spawn-failed', reason: result.reason, stderrTail: result.stderrTail }, 500);
         }
         timed(deps.logger, 'POST', '/spawn', 200, Date.now() - start);
-        return c.json(toLivePayload(result.session), 200);
+        const payload = buildSpawnReturnPayload(result.session.sessionId, result.session.pid, result.session.startedAt, result.session.url);
+        return c.json(payload, 200);
     });
     // SSE feed of row deltas. One channel per client; manager fans out from
     // a single watcher subscription. On connect: replay current rows as
@@ -551,10 +580,17 @@ export function buildHttpApp(deps) {
                 firstPrompt,
                 titleSource,
                 updatedAt: row.updatedAt,
-                url: deps.store.get(row.sessionId)?.url ?? null,
-                // Task 259 — UI uses this to render Unarchive (vs Resume + Archive)
-                // on rows whose JSONL has been moved to projects/<slug>/archive/.
-                archived: isArchivedJsonlPath(row.sessionId),
+                // Task 260 — url is on the row from the sidecar; url-capture
+                // mutates the sidecar in place and the watcher re-reads on the
+                // next event. Earlier this dipped into deps.store for the live-
+                // row case and returned null for everything else.
+                url: row.url,
+                // Task 260 — archive state is on the row directly (the watcher
+                // enumerates both top and archive subdirs and folds a top→archive
+                // move into a single state change). Earlier this was an extra
+                // existsSync against the archive path because archived rows
+                // weren't first-class members of the index.
+                archived: row.state === 'archived',
             };
         }
         timed(deps.logger, 'GET', '/events', 200, Date.now() - start);
@@ -630,12 +666,13 @@ export function buildHttpApp(deps) {
                 deps.logger(`[admin-events] emit event=${sseEvent} sessionId=${event.sessionId} subscribers=1`);
                 void out.write(`event: ${sseEvent}\ndata: ${JSON.stringify(payload)}\n\n`);
             });
-            // Task 189 — when `url-capture` fires for a session, the pty-spawner
-            // calls `notifyUrlCaptured(sessionId)` after mutating
-            // `StoredSession.url`. Re-emit the row so the client's hidden
-            // Open-in-new-tab arrow appears in step. The row lookup goes through
-            // the watcher (canonical row index); rowToPayload then re-reads `url`
-            // from `deps.store`, picking up the freshly-mutated value.
+            // Task 189 / 260 — when `url-capture` fires for a session, the
+            // pty-spawner calls `notifyUrlCaptured(sessionId)` after writing
+            // the URL to the sidecar. Re-emit the row so the client's hidden
+            // Open-in-new-tab arrow appears in step. The row lookup goes
+            // through the watcher (canonical row index); rowToPayload then
+            // reads `url` from the row (which the watcher just refreshed
+            // from the sidecar).
             const urlListener = (sessionId) => {
                 if (!active)
                     return;
@@ -698,32 +735,41 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'GET', '/list', 400, Date.now() - start);
             return c.json({ error: 'senderId-required' }, 400);
         }
-        const liveStored = deps.store.listBySender(senderId, { includeHidden });
-        const live = liveStored.map(toLivePayload);
-        const liveSessionIds = new Set();
-        for (const s of liveStored)
-            liveSessionIds.add(s.sessionId);
-        // Archived rows come from the watcher's JSONL index (rows whose
-        // state === 'archived'). The watcher's boot-seed already paired
-        // PID files with JSONLs on disk, so archived rows here are exactly
-        // the sessions whose PTY has exited but transcript persists.
-        const dehydrated = [];
+        // Task 260 — one source. Filter the watcher's row index by sidecar
+        // senderId, then partition into live vs archived for the log line
+        // (the merged list returns to the caller in startedAt-desc order).
+        // Rows without a sidecar carry `senderId: null` and never match
+        // unless includeHidden=1 is passed (the legacy pre-Task-260 archives
+        // case). Hidden rows are dropped unless includeHidden=1.
+        const payloads = [];
+        let liveCount = 0;
+        let archivedCount = 0;
+        let hiddenSkipped = 0;
         for (const row of deps.watcher.all()) {
-            if (row.state !== 'archived')
+            if (row.senderId !== senderId && !(includeHidden && row.senderId === null))
                 continue;
-            if (liveSessionIds.has(row.sessionId))
+            if (row.hidden && !includeHidden) {
+                hiddenSkipped += 1;
                 continue;
-            // Task 258 — confirm the jsonl is actually on disk; row state can lag
-            // behind a delete during boot-seed timing edges.
-            if (!existsSync(jsonlPathForSessionId(deps.spawnCwd, row.sessionId)))
+            }
+            // Confirm the JSONL is actually on disk; row state can lag behind
+            // a delete during boot-seed timing edges. Live rows whose PID
+            // file exists pre-first-turn legitimately have no JSONL — keep
+            // them in the result.
+            const archivedJsonl = jsonlPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true });
+            const topJsonl = jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
+            if (row.state === 'archived' && !existsSync(archivedJsonl) && !existsSync(topJsonl))
                 continue;
-            dehydrated.push(toArchivedPayload(row, senderId));
+            payloads.push(toPayload(row));
+            if (row.state === 'live')
+                liveCount += 1;
+            else
+                archivedCount += 1;
         }
-        deps.logger(`list-source live=${live.length} jsonl=${dehydrated.length}`);
-        const merged = [...live, ...dehydrated];
-        merged.sort((a, b) => (a.startedAt < b.startedAt ? 1 : -1));
+        deps.logger(`[list-source] live=${liveCount} archived=${archivedCount} hidden-skipped=${hiddenSkipped}`);
+        payloads.sort((a, b) => (a.startedAt < b.startedAt ? 1 : -1));
         timed(deps.logger, 'GET', '/list', 200, Date.now() - start);
-        return c.json(merged, 200);
+        return c.json(payloads, 200);
     });
     app.post('/resume', async (c) => {
         const start = Date.now();
@@ -800,6 +846,19 @@ export function buildHttpApp(deps) {
         if (archivedExists && !canonicalExists) {
             try {
                 renameSync(archivedJsonl, canonicalJsonl);
+                // Task 260 — sidecar travels with the JSONL. Move the archived
+                // sidecar to the top-level path so the watcher picks it up on
+                // the next reconcile.
+                const archivedSidecar = sidecarPathForSessionId(deps.spawnCwd, sessionId, { archived: true });
+                const canonicalSidecar = sidecarPathForSessionId(deps.spawnCwd, sessionId);
+                if (existsSync(archivedSidecar)) {
+                    try {
+                        renameSync(archivedSidecar, canonicalSidecar);
+                    }
+                    catch (err) {
+                        deps.logger(`resume-sidecar-restore-failed sessionId=${sessionId.slice(0, 8)} message=${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
                 deps.logger(`resume-archive-restored sessionId=${sessionId.slice(0, 8)}`);
             }
             catch (err) {
@@ -837,7 +896,16 @@ export function buildHttpApp(deps) {
                 return c.json({ error: 'resume-restore-failed', detail: msg }, 500);
             }
         }
-        const result = await spawnClaudeSession({ ...deps, store: deps.store, watcher: deps.watcher, onSessionReady: (s) => { attachPublicAudit(deps, s); attachSpecialistEndTurnAutoArchive(deps, s); }, onUrlCaptured: notifyUrlCaptured, tunnelUrlOverride }, {
+        const result = await spawnClaudeSession({
+            ...deps,
+            watcher: deps.watcher,
+            onSessionReady: (tracker) => {
+                attachPublicAudit(deps, tracker.sessionId, role);
+                attachSpecialistEndTurnAutoArchive(deps, tracker.sessionId, tracker.specialist);
+            },
+            onUrlCaptured: notifyUrlCaptured,
+            tunnelUrlOverride,
+        }, {
             senderId,
             userId,
             role: role,
@@ -867,11 +935,13 @@ export function buildHttpApp(deps) {
         }
         // Task 258 — the archive-restore-before-spawn flow means the operator's
         // prior canonical sessionId IS the jsonl basename claude appends to.
-        // The pty-spawner's StoredSession.sessionId is set to that same prior
-        // canonical id (resumeClaudeSessionId), so the wire payload echoes it
-        // directly. No mint divergence to log: there's only one sessionId.
+        // The PtyTracker's sessionId is set to that same prior canonical id
+        // (resumeClaudeSessionId), so the wire payload echoes it directly.
         deps.logger(`resume pid=${result.session.pid} sessionId=${sessionId} resumeFrom=${sessionId} latency-ms=${Date.now() - start}`);
-        const payload = { ...toLivePayload(result.session), sessionId };
+        const payload = {
+            ...buildSpawnReturnPayload(result.session.sessionId, result.session.pid, result.session.startedAt, result.session.url),
+            sessionId,
+        };
         if (idempotencyKey) {
             resumeDedupCache.set(`${senderId}:${idempotencyKey}`, { payload, createdAt: Date.now() });
         }
@@ -890,30 +960,27 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'GET', `/${id}/meta`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }
-        const live = deps.store.get(row.sessionId);
-        let payload;
-        if (live) {
-            const base = toLivePayload(live);
-            let lastMessageAt = null;
-            let turnCount = 0;
-            let capped = false;
-            let sizeBytes = base.sizeBytes;
-            let model = null;
-            const liveJsonlPath = jsonlPathForSessionId(deps.spawnCwd, live.sessionId);
-            if (existsSync(liveJsonlPath)) {
-                const enriched = readJsonlSession(deps.spawnCwd, live.sessionId, deps.jsonlReadMaxBytes, deps.logger);
-                if (enriched) {
-                    lastMessageAt = enriched.lastMessageAt;
-                    turnCount = enriched.turnCount;
-                    capped = enriched.capped;
-                    sizeBytes = enriched.sizeBytes;
-                    model = enriched.model;
-                }
+        // Task 260 — single row source. /meta uses the deeper enumerator
+        // limit (jsonlReadMaxBytes) for richer turn/sizeBytes data than
+        // /list provides; otherwise the payload is identical to /list.
+        let payload = toPayload(row);
+        const candidatePath = row.state === 'archived'
+            ? jsonlPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true })
+            : jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
+        if (existsSync(candidatePath)) {
+            const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, deps.jsonlReadMaxBytes, deps.logger, deps.userTitleStore);
+            if (enriched) {
+                payload = {
+                    ...payload,
+                    lastMessageAt: enriched.lastMessageAt,
+                    turnCount: enriched.turnCount,
+                    capped: enriched.capped,
+                    sizeBytes: enriched.sizeBytes,
+                    model: enriched.model,
+                    displayName: enriched.displayName,
+                    titleSource: enriched.titleSource,
+                };
             }
-            payload = { ...base, lastMessageAt, turnCount, capped, sizeBytes, model };
-        }
-        else {
-            payload = toArchivedPayload(row, '');
         }
         deps.logger(`meta sessionId=${row.sessionId.slice(0, 8)} fields=${Object.keys(payload).length} ms=${Date.now() - start}`);
         timed(deps.logger, 'GET', `/${id}/meta`, 200, Date.now() - start);
@@ -948,19 +1015,14 @@ export function buildHttpApp(deps) {
         const slugDir = join(claudeStateRoot(), 'projects', slug);
         const archiveDir = join(slugDir, 'archive');
         const fileName = `${row.sessionId}.jsonl`;
-        // Task 258 — refuse archive whenever any alive PTY would append to the
-        // canonical jsonl for this row. After the derived-state refactor the
-        // path is computed from sessionId + spawnCwd: every StoredSession has
-        // exactly one effective path, and the live writer is the StoredSession
-        // whose path equals the candidate.
-        const candidateJsonl = join(slugDir, fileName);
-        const aliveOnPath = deps.store.all().find((s) => {
-            if (s.exited)
-                return false;
-            return jsonlPathForSessionId(deps.spawnCwd, s.sessionId) === candidateJsonl;
-        });
-        if (aliveOnPath) {
-            deps.logger(`archive-refused sessionId=${row.sessionId.slice(0, 8)} reason=pty-alive-jsonl-write store-key=${aliveOnPath.sessionId.slice(0, 8)}`);
+        // Task 260 — refuse archive whenever an alive PTY exists for this
+        // row in the manager's tracker map. Earlier this walked every
+        // store entry to find one whose derived path equaled the candidate
+        // — that loop was redundant because the JSONL basename IS the
+        // sessionId, so the only relevant check is "is this sessionId
+        // tracker alive?". `isLive` answers in O(1).
+        if (mode === 'archive' && isLive(row.sessionId)) {
+            deps.logger(`archive-refused sessionId=${row.sessionId.slice(0, 8)} reason=pty-alive`);
             timed(deps.logger, 'POST', `/${id}/archive`, 409, Date.now() - start);
             return c.json({ error: 'pty-still-alive', detail: 'end the session before archiving' }, 409);
         }
@@ -981,7 +1043,29 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', `/${id}/archive`, 500, Date.now() - start);
             return c.json({ error: 'archive-failed', detail: msg }, 500);
         }
-        deps.logger(`archive sessionId=${row.sessionId.slice(0, 8)} from=${basename(fromJsonl)} to=${join(mode === 'archive' ? 'archive' : '.', basename(toJsonl))}`);
+        // Task 260 — the sidecar travels with the JSONL. Best-effort: an
+        // orphan sidecar at the source path is self-healing (the next
+        // bootSeed indexes the row with null fields and the operator
+        // re-archives), but the orphan is itself a regression signal the
+        // log line surfaces.
+        let sidecarMoved = false;
+        try {
+            const fromSidecar = mode === 'archive'
+                ? sidecarPathForSessionId(deps.spawnCwd, row.sessionId)
+                : sidecarPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true });
+            const toSidecar = mode === 'archive'
+                ? sidecarPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true })
+                : sidecarPathForSessionId(deps.spawnCwd, row.sessionId);
+            if (existsSync(fromSidecar)) {
+                renameSync(fromSidecar, toSidecar);
+                sidecarMoved = true;
+            }
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            deps.logger(`archive-sidecar-move-failed sessionId=${row.sessionId.slice(0, 8)} mode=${mode} message=${msg}`);
+        }
+        deps.logger(`[archive] sessionId=${row.sessionId.slice(0, 8)} mode=${mode} from=${basename(fromJsonl)} to=${join(mode === 'archive' ? 'archive' : '.', basename(toJsonl))} sidecar-moved=${sidecarMoved}`);
         timed(deps.logger, 'POST', `/${id}/archive`, 200, Date.now() - start);
         return c.json({ ok: true, mode }, 200);
     });
@@ -1008,7 +1092,11 @@ export function buildHttpApp(deps) {
             return c.json({ error: 'invalid-json-body' }, 400);
         }
         const row = resolveRow(deps.watcher, id);
-        const sessionId = row?.sessionId ?? (deps.store.get(id)?.sessionId);
+        // Task 260 — rename resolves via the watcher row index. The live
+        // tracker is no longer a secondary lookup surface — the watcher's
+        // PID-file event indexes every live session, so a sessionId that
+        // names no row also names no live PTY.
+        const sessionId = row?.sessionId;
         if (!sessionId) {
             timed(deps.logger, 'POST', `/${id}/rename`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
@@ -1037,12 +1125,28 @@ export function buildHttpApp(deps) {
             return c.json({ error: 'invalid-session-id' }, 400);
         }
         const row = resolveRow(deps.watcher, id);
-        if (!row && !deps.store.get(id)) {
+        if (!row && !isLive(id)) {
             timed(deps.logger, 'POST', `/${id}/stop`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }
         const sessionId = row?.sessionId ?? id;
-        await stopSession({ store: deps.store, killGraceMs: deps.killGraceMs, logger: deps.logger }, sessionId);
+        const outcome = await stopSession({
+            killGraceMs: deps.killGraceMs,
+            logger: deps.logger,
+            runSystemctl: deps.runSystemctl,
+        }, sessionId);
+        // Task 250 — surface scope-stop failures as 500 so the operator sees
+        // the End-click fail when systemd cannot stop the unit. ok and
+        // already-gone collapse to 204 (idempotent); no-store-entry is the
+        // archived-row path that auto-archive triggers (no PTY to stop).
+        if (outcome.scopeOutcome === 'error') {
+            timed(deps.logger, 'POST', `/${sessionId}/stop`, 500, Date.now() - start);
+            return c.json({
+                error: 'scope-stop-failed',
+                exitCode: outcome.exitCode,
+                detail: 'systemctl --user stop returned a non-zero exit code for the session\'s scope unit',
+            }, 500);
+        }
         timed(deps.logger, 'POST', `/${sessionId}/stop`, 204, Date.now() - start);
         return c.body(null, 204);
     });
@@ -1056,27 +1160,40 @@ export function buildHttpApp(deps) {
         }
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
-        if (deps.store.get(sessionId)) {
+        if (isLive(sessionId)) {
             deps.logger(`delete-rejected sessionId=${sessionId.slice(0, 8)} reason=pty-still-alive`);
             timed(deps.logger, 'DELETE', `/${id}`, 409, Date.now() - start);
             return c.json({ error: 'pty-still-alive', detail: 'stop the session before deleting' }, 409);
         }
-        const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
-        if (!row || !existsSync(jsonlPath)) {
+        // Task 260 — purge from BOTH locations: a row may have its JSONL
+        // at the top level (live or just-ended) or under archive/ (archived).
+        const topJsonl = jsonlPathForSessionId(deps.spawnCwd, sessionId);
+        const archivedJsonl = jsonlPathForSessionId(deps.spawnCwd, sessionId, { archived: true });
+        const topSidecar = sidecarPathForSessionId(deps.spawnCwd, sessionId);
+        const archivedSidecar = sidecarPathForSessionId(deps.spawnCwd, sessionId, { archived: true });
+        const hasTop = existsSync(topJsonl);
+        const hasArchived = existsSync(archivedJsonl);
+        if (!row || (!hasTop && !hasArchived)) {
             timed(deps.logger, 'DELETE', `/${id}`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }
         const subdir = join(claudeStateRoot(), 'projects', projectSlugForCwd(deps.spawnCwd), sessionId);
         let bytes = 0;
         try {
-            bytes = existsSync(jsonlPath) ? statSync(jsonlPath).size : 0;
+            bytes = hasTop ? statSync(topJsonl).size : hasArchived ? statSync(archivedJsonl).size : 0;
         }
         catch {
             // size is informational
         }
         try {
-            if (existsSync(jsonlPath))
-                rmSync(jsonlPath);
+            if (hasTop)
+                rmSync(topJsonl);
+            if (hasArchived)
+                rmSync(archivedJsonl);
+            if (existsSync(topSidecar))
+                rmSync(topSidecar);
+            if (existsSync(archivedSidecar))
+                rmSync(archivedSidecar);
             if (existsSync(subdir))
                 rmSync(subdir, { recursive: true, force: true });
         }
@@ -1100,15 +1217,6 @@ export function buildHttpApp(deps) {
         const id = c.req.param('sessionId');
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
-        const s = deps.store.get(sessionId);
-        if (!s) {
-            timed(deps.logger, 'POST', `/${id}/input`, 404, Date.now() - start);
-            return c.json({ error: 'session-not-found' }, 404);
-        }
-        if (s.exited) {
-            timed(deps.logger, 'POST', `/${id}/input`, 410, Date.now() - start);
-            return c.json({ error: 'session-exited' }, 410);
-        }
         let body;
         try {
             body = await c.req.json();
@@ -1121,50 +1229,42 @@ export function buildHttpApp(deps) {
             timed(deps.logger, 'POST', `/${id}/input`, 400, Date.now() - start);
             return c.json({ error: 'text-required' }, 400);
         }
-        const bytes = Buffer.byteLength(body.text, 'utf8');
-        // Task 122: multi-line `text` must arrive at the TUI as one submitted
-        // turn, not as keystrokes. Claude's TUI treats embedded `\n` typed via
-        // `pty.write` as a bracketed-paste boundary that buffers and never
-        // submits. Wrapping the bytes in DEC bracketed-paste markers
-        // (\e[200~ ... \e[201~) and then sending `\r` makes the TUI treat the
-        // payload as a single paste followed by an explicit submit keystroke.
-        // Single-line text keeps the previous typed-keystroke path byte-for-byte
-        // so the Sidebar timestamp stimulus is unchanged.
-        const multiline = body.text.includes('\n');
-        const submitMode = multiline ? 'bracketed-paste' : 'typed';
-        try {
-            if (multiline) {
-                s.pty.write(`\x1b[200~${body.text}\x1b[201~\r`);
+        const channel = row?.channel ?? null;
+        const result = writeInputToPty(sessionId, body.text, deps.logger, channel);
+        if (!result.ok) {
+            if (result.error === 'not-found') {
+                timed(deps.logger, 'POST', `/${id}/input`, 404, Date.now() - start);
+                return c.json({ error: 'session-not-found' }, 404);
             }
-            else {
-                s.pty.write(body.text + '\r');
+            if (result.error === 'exited') {
+                timed(deps.logger, 'POST', `/${id}/input`, 410, Date.now() - start);
+                return c.json({ error: 'session-exited' }, 410);
             }
-        }
-        catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            deps.logger(`input-failed pid=${s.pid} sessionId=${sessionId} message=${msg}`);
             timed(deps.logger, 'POST', `/${id}/input`, 500, Date.now() - start);
-            return c.json({ error: 'pty-write-failed', detail: msg }, 500);
+            return c.json({ error: 'pty-write-failed', detail: result.detail }, 500);
         }
-        deps.logger(`input pid=${s.pid} sessionId=${sessionId} bytes=${bytes} channel=${s.channel} multiline=${multiline} submit-mode=${submitMode}`);
         timed(deps.logger, 'POST', `/${id}/input`, 200, Date.now() - start);
-        return c.json({ ok: true, bytes }, 200);
+        return c.json({ ok: true, bytes: result.bytes }, 200);
     });
     app.get('/:sessionId/log', (c) => {
         const start = Date.now();
         const id = c.req.param('sessionId');
         const row = resolveRow(deps.watcher, id);
         const sessionId = row?.sessionId ?? id;
-        const s = deps.store.get(sessionId);
-        // Task 258 — /log reads the transcript at the derived canonical path.
-        // 404 when there's no row AND no live session at this id; 202 pending
-        // when a live PTY hasn't flushed its first turn yet (no jsonl on disk).
-        if (!s && !row) {
+        const live = isLive(sessionId);
+        // Task 260 — /log reads from whichever location holds the JSONL
+        // right now: top level for live + recently-ended rows, archive
+        // subdir for archived rows. 404 when there's no row AND no live
+        // PTY for this id; 202 pending when a live PTY hasn't flushed
+        // its first turn yet (no JSONL on disk in either location).
+        if (!live && !row) {
             timed(deps.logger, 'GET', `/${id}/log`, 404, Date.now() - start);
             return c.json({ error: 'session-not-found' }, 404);
         }
-        const jsonlPath = jsonlPathForSessionId(deps.spawnCwd, sessionId);
-        if (s && !existsSync(jsonlPath)) {
+        const topJsonl = jsonlPathForSessionId(deps.spawnCwd, sessionId);
+        const archivedJsonl = jsonlPathForSessionId(deps.spawnCwd, sessionId, { archived: true });
+        const jsonlPath = existsSync(topJsonl) ? topJsonl : archivedJsonl;
+        if (live && !existsSync(topJsonl) && !existsSync(archivedJsonl)) {
             timed(deps.logger, 'GET', `/${id}/log`, 202, Date.now() - start);
             return c.json({ jsonlPath: null, exists: false, sizeBytes: 0, pending: true }, 202);
         }
@@ -1238,7 +1338,12 @@ export function buildHttpApp(deps) {
                 }
                 position = initialSize;
             }
-            deps.logger(`log-follow-open sessionId=${sessionId} initialBytes=${position} pid=${s?.pid ?? 'null'}`);
+            // Task 260 — prefer the row's PID (watcher-derived) but fall back
+            // to the live tracker if the row hasn't been populated yet (the
+            // pre-first-turn window during which the watcher's PID-file event
+            // has not fired against the row builder).
+            const followPid = row?.pid ?? getPtyTrackerForTests(sessionId)?.pid ?? null;
+            deps.logger(`log-follow-open sessionId=${sessionId} initialBytes=${position} pid=${followPid ?? 'null'}`);
             let active = true;
             out.onAbort(() => {
                 active = false;
@@ -1270,7 +1375,7 @@ export function buildHttpApp(deps) {
             deps.logger(`log-follow-close sessionId=${sessionId} reason=${closeReason} linesStreamed=${linesStreamed} ms=${Date.now() - followStreamStart}`);
         });
     });
-    app.get('/healthz', (c) => c.json({ ok: true, sessions: deps.store.size() }));
+    app.get('/healthz', (c) => c.json({ ok: true, sessions: livePtyCount() }));
     return app;
 }
 //# sourceMappingURL=http-server.js.map