@rubytech/create-sitedesk-code 0.1.340

package/payload/platform/scripts/logs-read.test.sh

@@ -0,0 +1,159 @@
+#!/usr/bin/env bash
+# bash harness for logs-read.sh single-shape resolution.
+#
+# Covers the three cases the new contract demands:
+#   1. sessionKey-named file present → bytes returned, exit 0.
+#   2. No file → exit 1 + missing-on-resolve appended to server.log.
+#   3. Ambiguous prefix (multiple matches) → exit 1, never picks silently.
+#
+# MIRROR: see platform/ui/app/lib/logs-read-resolve.ts for the canonical
+# single-shape contract and its TS unit tests.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+LOGS_READ="$SCRIPT_DIR/logs-read.sh"
+if [[ ! -x "$LOGS_READ" ]]; then
+  echo "FATAL: $LOGS_READ not executable" >&2
+  exit 1
+fi
+
+SESSION_KEY="8c264cfb-441f-48bf-9811-9fa3ad3b51dc"
+FILE_NAME="claude-agent-stream-${SESSION_KEY}.log"
+
+PASS=0
+FAIL=0
+
+setup_install_tree() {
+  local root="$1"
+  mkdir -p "$root/platform/scripts"
+  mkdir -p "$root/data/accounts/acct-test/logs"
+  mkdir -p "$HOME/.$(basename "$root")/logs"
+  ln -sf "$LOGS_READ" "$root/platform/scripts/logs-read.sh"
+  echo "$root/platform/scripts/logs-read.sh"
+}
+
+cleanup_install_tree() {
+  local root="$1"
+  rm -rf "$root"
+  rm -rf "$HOME/.$(basename "$root")"
+}
+
+run_case() {
+  local name="$1"
+  shift
+  echo ""
+  echo "=== CASE: $name ==="
+  if "$@"; then
+    PASS=$((PASS + 1))
+    echo "PASS: $name"
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: $name"
+  fi
+}
+
+# --- Case 1: sessionKey-named file present → exit 0 ---
+case_file_present() {
+  local root="/tmp/maxy-logs-read-test-1-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  echo "sessionkey-content-sentinel" > "$logdir/$FILE_NAME"
+
+  local stdout stderr rc
+  stdout=$("$script" "$SESSION_KEY" system 2>/tmp/maxy-logs-read-stderr-1-$$) || rc=$?
+  rc=${rc:-0}
+  stderr=$(cat /tmp/maxy-logs-read-stderr-1-$$)
+  rm -f /tmp/maxy-logs-read-stderr-1-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 0 ]]; then
+    echo "  expected exit 0, got $rc"
+    return 1
+  fi
+  if [[ "$stdout" != *"sessionkey-content-sentinel"* ]]; then
+    echo "  stdout missing sentinel"
+    return 1
+  fi
+  if [[ "$stderr" != *"matched=1"* ]]; then
+    echo "  stderr missing matched=1: $stderr"
+    return 1
+  fi
+  return 0
+}
+
+# --- Case 2: no file → exit 1 + missing-on-resolve in server.log ---
+case_missing() {
+  local root="/tmp/maxy-logs-read-test-2-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local server_log="$HOME/.$(basename "$root")/logs/server.log"
+  : > "$server_log"
+
+  local rc=0
+  "$script" "$SESSION_KEY" system >/dev/null 2>/tmp/maxy-logs-read-stderr-2-$$ || rc=$?
+  local stderr
+  stderr=$(cat /tmp/maxy-logs-read-stderr-2-$$)
+  rm -f /tmp/maxy-logs-read-stderr-2-$$
+  local server_log_contents
+  server_log_contents=$(cat "$server_log" 2>/dev/null || echo "")
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 1 ]]; then
+    echo "  expected exit 1, got $rc"
+    return 1
+  fi
+  if [[ "$stderr" != *"reason=file-not-found"* ]]; then
+    echo "  stderr missing reason=file-not-found: $stderr"
+    return 1
+  fi
+  if [[ "$server_log_contents" != *"missing-on-resolve"* ]]; then
+    echo "  server.log missing missing-on-resolve emission: $server_log_contents"
+    return 1
+  fi
+  if [[ "$server_log_contents" != *"surface=logs-read-sh"* ]]; then
+    echo "  server.log emission missing surface tag"
+    return 1
+  fi
+  return 0
+}
+
+# --- Case 3: ambiguous prefix → exit 1 without picking ---
+case_ambiguous() {
+  local root="/tmp/maxy-logs-read-test-3-$$"
+  local script
+  script=$(setup_install_tree "$root")
+  local logdir="$root/data/accounts/acct-test/logs"
+  echo "a" > "$logdir/claude-agent-stream-deadbeef-aaaa.log"
+  echo "b" > "$logdir/claude-agent-stream-deadbeef-bbbb.log"
+
+  local rc=0
+  "$script" "deadbeef" system >/dev/null 2>/tmp/maxy-logs-read-stderr-3-$$ || rc=$?
+  local stderr
+  stderr=$(cat /tmp/maxy-logs-read-stderr-3-$$)
+  rm -f /tmp/maxy-logs-read-stderr-3-$$
+
+  cleanup_install_tree "$root"
+
+  if [[ $rc -ne 1 ]]; then
+    echo "  expected exit 1, got $rc"
+    return 1
+  fi
+  if [[ "$stderr" != *"reason=ambiguous-prefix"* ]]; then
+    echo "  stderr missing ambiguous-prefix trailer: $stderr"
+    return 1
+  fi
+  return 0
+}
+
+run_case "sessionKey file present → exit 0" case_file_present
+run_case "no file → exit 1 + missing-on-resolve" case_missing
+run_case "ambiguous prefix → exit 1, refuses to pick" case_ambiguous
+
+echo ""
+echo "================================================"
+echo " Passed: $PASS / Failed: $FAIL"
+echo "================================================"
+[[ $FAIL -eq 0 ]]

package/payload/platform/scripts/prompt-optimiser-audit.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# prompt-optimiser-audit.sh — reconcile per-turn directive-injection breadcrumbs
+# against the stored content files (Task 746). A missing content write emits no
+# error on its own, so this standing check is the leak detector: for each
+# session it prints
+#   [prompt-optimiser-audit] session=<id> injected=<N> stored=<M>
+# where N is the count of breadcrumb injection lines and M is the count of
+# content files. N != M is the leak signature. Every breadcrumb whose file=
+# path is absent on disk is named on its own `missing-file=` line.
+#
+# Usage:
+#   prompt-optimiser-audit.sh [--log-dir <dir>] [<session_id>]
+# With no <session_id> it walks every session that appears in the breadcrumb
+# log. --log-dir overrides the resolved account logs dir (used by tests); the
+# default resolves the single account's logs dir, the same dir the hook writes.
+#
+# Exit codes:
+#   0  every reported session reconciles (injected == stored)
+#   1  at least one session leaks (injected != stored)
+#   2  no log dir could be resolved
+set -uo pipefail
+
+LOG_DIR=""
+SESSION=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --log-dir) LOG_DIR="$2"; shift 2 ;;
+    *) SESSION="$1"; shift ;;
+  esac
+done
+
+# Resolve the account logs dir when not overridden: {installDir}/data/accounts/*/logs.
+if [ -z "$LOG_DIR" ]; then
+  SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+  PLATFORM_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
+  INSTALL_DIR="$(dirname "$PLATFORM_ROOT")"
+  for d in "$INSTALL_DIR"/data/accounts/*/logs; do
+    [ -d "$d" ] && LOG_DIR="$d" && break
+  done
+fi
+if [ -z "$LOG_DIR" ] || [ ! -d "$LOG_DIR" ]; then
+  echo "[prompt-optimiser-audit] no-log-dir resolved=${LOG_DIR:-<none>}" >&2
+  exit 2
+fi
+
+CRUMB="$LOG_DIR/prompt-optimiser-directive.log"
+STORE_ROOT="$LOG_DIR/prompt-optimiser-directives"
+
+# Sessions to report: the explicit arg, else every distinct non-"?" session in
+# the breadcrumb log (the breadcrumb's session= is always the last field).
+sessions() {
+  if [ -n "$SESSION" ]; then
+    echo "$SESSION"; return
+  fi
+  [ -f "$CRUMB" ] || return
+  grep -o 'session=[^ ]*$' "$CRUMB" 2>/dev/null | cut -d= -f2 | grep -v '^?$' | sort -u
+}
+
+rc=0
+while IFS= read -r sid; do
+  [ -n "$sid" ] || continue
+  injected=0
+  # grep -c prints a count AND exits 1 on zero matches, so a `|| echo 0` would
+  # double-emit "0\n0"; capture the count and default an empty/unreadable file.
+  if [ -f "$CRUMB" ]; then
+    injected=$(grep -c "session=$sid\$" "$CRUMB" 2>/dev/null)
+    injected=${injected:-0}
+  fi
+  stored=0
+  [ -d "$STORE_ROOT/$sid" ] && stored=$(find "$STORE_ROOT/$sid" -maxdepth 1 -name '*.txt' 2>/dev/null | wc -l | tr -d ' ')
+  echo "[prompt-optimiser-audit] session=$sid injected=$injected stored=$stored"
+  [ "$injected" != "$stored" ] && rc=1
+  # Name every breadcrumb whose stored file is absent.
+  if [ -f "$CRUMB" ]; then
+    grep "session=$sid\$" "$CRUMB" 2>/dev/null | grep -o 'file=[^ ]*' | cut -d= -f2- | while IFS= read -r f; do
+      [ "$f" = "-" ] && continue
+      [ -e "$f" ] || echo "[prompt-optimiser-audit] session=$sid missing-file=$f"
+    done
+  fi
+done < <(sessions)
+
+exit "$rc"

package/payload/platform/scripts/redact-install-logs.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# Existing-pi install-log redaction.
+#
+# Idempotent one-shot remediation for Pis that completed installation BEFORE
+# the install-log redaction landed at packages/create-maxy-code/src/index.ts:152.
+# Scans every `install-*.log` in the configured logs directory and replaces
+# every literal `set-initial-password ...<secret>` payload with
+# `set-initial-password [REDACTED]`. Re-running the script is safe —
+# already-redacted lines do not match the source pattern, so no further
+# edits occur.
+#
+# Source patterns covered:
+#   1. TS installer (packages/create-maxy-code/src/index.ts:152) — "[ISO] > sudo
+#      neo4j-admin dbms set-initial-password -- <secret>" or any args after
+#      "set-initial-password" (positional or "--" delimited).
+#   2. Legacy bash installer (removed) — "+ sudo neo4j-admin dbms
+#      set-initial-password <secret>" if bash -x had been on. Pattern kept
+#      for historical install logs from before the bash installer's removal.
+#
+# A trailing marker line `[redact-install-logs] redacted=<n> file=<path>` is
+# appended to each modified log so subsequent reads can identify which logs
+# went through the remediation. Files with zero matches are left untouched.
+#
+# Default scan location: $HOME/.maxy/logs (the installer's LOG_DIR). Override
+# with --dir <path> for non-default deployments.
+
+set -euo pipefail
+
+LOG_DIR="${HOME}/.maxy/logs"
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --dir) LOG_DIR="$2"; shift 2 ;;
+    --help|-h)
+      cat <<USAGE
+Usage: redact-install-logs.sh [--dir <log-dir>]
+
+Redacts neo4j set-initial-password secrets from install-*.log files.
+Default --dir: \$HOME/.maxy/logs
+
+Idempotent — safe to re-run.
+USAGE
+      exit 0 ;;
+    *) echo "Unknown arg: $1" >&2; exit 2 ;;
+  esac
+done
+
+if [ ! -d "$LOG_DIR" ]; then
+  echo "[redact-install-logs] log dir not found: $LOG_DIR (nothing to do)"
+  exit 0
+fi
+
+shopt -s nullglob
+TOTAL_FILES=0
+TOTAL_REDACTIONS=0
+
+for f in "$LOG_DIR"/install-*.log; do
+  [ -f "$f" ] || continue
+  TOTAL_FILES=$((TOTAL_FILES + 1))
+
+  # Pattern: any "set-initial-password" line followed by one or more args.
+  # The replacement keeps the leading prefix (timestamp + cmd up through
+  # set-initial-password and an optional "--") and substitutes everything
+  # after with [REDACTED]. We anchor the replacement only when the remaining
+  # tail is non-empty AND not already "[REDACTED]" — making the script idempotent.
+  REDACTED_THIS_FILE=$(
+    perl -ne '
+      if (/set-initial-password(\s+--)?\s+(\S.*)$/ && $2 ne "[REDACTED]") {
+        print STDOUT "1\n";
+      }
+    ' "$f" | wc -l | tr -d ' '
+  )
+
+  if [ "$REDACTED_THIS_FILE" -gt 0 ]; then
+    perl -i -pe '
+      if (/set-initial-password(\s+--)?\s+(\S.*)$/ && $2 ne "[REDACTED]") {
+        s/set-initial-password(\s+--)?\s+\S.*$/set-initial-password${1} [REDACTED]/;
+      }
+    ' "$f"
+    printf "[redact-install-logs] redacted=%d file=%s\n" "$REDACTED_THIS_FILE" "$f" >> "$f"
+    echo "[redact-install-logs] redacted=$REDACTED_THIS_FILE file=$f"
+    TOTAL_REDACTIONS=$((TOTAL_REDACTIONS + REDACTED_THIS_FILE))
+  fi
+done
+
+echo "[redact-install-logs] summary files_scanned=$TOTAL_FILES total_redactions=$TOTAL_REDACTIONS"
+exit 0

package/payload/platform/scripts/resume-tunnel.sh

@@ -0,0 +1,280 @@
+#!/bin/bash
+# resume-tunnel.sh — Resume the Cloudflare tunnel on brand-service start.
+#
+# Spawns cloudflared into its own transient systemd SERVICE (cloudflared-<brand>.service)
+# under cloudflared.slice, completely decoupled from the brand service's cgroup.
+# A brand-service restart can no longer reap the tunnel (Task 602's cgroup
+# decoupling). The unit is a Restart=always service (Task 757), so systemd
+# resurrects the connector on ANY exit — crash, OOM, manual kill — and the
+# connector runs with --no-autoupdate so it never replaces itself; the binary
+# version is installer-owned. This is still the single spawner: only the unit
+# type changed from a transient --scope (no restart policy) to a supervised
+# --service. No second spawner is introduced.
+#
+# Called as ExecStartPre in maxy.service. All failures exit 0 — this script must
+# never prevent maxy.service from starting.
+#
+# Dependencies: jq, cloudflared, systemd-run, systemctl
+
+set -uo pipefail
+
+# Derive configDir from brand.json. Fall back to .maxy if unreadable.
+CONFIG_DIR=".maxy"
+if [ -n "${MAXY_PLATFORM_ROOT:-}" ] && [ -f "$MAXY_PLATFORM_ROOT/config/brand.json" ]; then
+  BRAND_CONFIG_DIR=$(jq -r '.configDir // empty' "$MAXY_PLATFORM_ROOT/config/brand.json" 2>/dev/null || true)
+  if [ -n "$BRAND_CONFIG_DIR" ]; then
+    CONFIG_DIR="$BRAND_CONFIG_DIR"
+  fi
+fi
+
+STATE_FILE="$HOME/$CONFIG_DIR/cloudflared/tunnel.state"
+LOG_DIR="$HOME/$CONFIG_DIR/logs"
+LOG_FILE="$LOG_DIR/cloudflared.log"
+
+log() {
+  mkdir -p "$LOG_DIR"
+  echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] resume-tunnel: $1" >> "$LOG_FILE"
+}
+
+# Derive brand identifiers + the OAuth cert path up front so every refusal log
+# below can name the brand. BRAND strips the leading dot from CONFIG_DIR
+# (.maxy-code → cloudflared-maxy-code.service). CERT_PATH is the OAuth account
+# cert: it authorises tunnel create/route, NOT tunnel run — a tunnel created via
+# the API-token path runs from its credentials-file with no cert at all.
+BRAND="${CONFIG_DIR#.}"
+SERVICE_UNIT="cloudflared-${BRAND}.service"
+CERT_PATH="$HOME/$CONFIG_DIR/cloudflared/cert.pem"
+
+# A configured tunnel (tunnel.state present) that we decline to spawn is logged
+# loudly, so a non-resumable tunnel is visible at the next service start rather
+# than discovered as an outage. "No state file" stays a silent normal boot.
+resume_refused() {
+  log "[tunnel-supervise] op=resume-refused brand=${BRAND} tunnel=${TUNNEL_ID:-unknown} reason=$1"
+}
+
+# No state file — no tunnel configured. Normal boot.
+[ -f "$STATE_FILE" ] || exit 0
+
+log "reading state from $STATE_FILE (configDir=$CONFIG_DIR)"
+
+if ! STATE=$(jq -r '.' "$STATE_FILE" 2>/dev/null); then
+  resume_refused "invalid-state-json"
+  exit 0
+fi
+
+TUNNEL_ID=$(echo "$STATE" | jq -r '.tunnelId // empty')
+DOMAIN=$(echo "$STATE" | jq -r '.domain // empty')
+CONFIG_PATH=$(echo "$STATE" | jq -r '.configPath // empty')
+
+if [ -z "$TUNNEL_ID" ]; then
+  resume_refused "no-tunnel-id"
+  exit 0
+fi
+
+# Task 833 — single-instance enforcement. cloudflared does not hot-reload
+# config.yml; a config change needs a connector restart. resume-tunnel is the
+# single spawner but historically managed only its OWN connector, so a connector
+# started any other way (an unsupervised process from before Task 757, a manual
+# `tunnel run`, a provisioning step that raw-spawned) survived — two connectors
+# on one tunnel, one on stale config, and Cloudflare routes some requests to the
+# stale one → intermittent 404 for any host added after it started. reap_strays
+# guarantees exactly one connector for THIS brand before the spawn/skip decision.
+#
+# Brand isolation: a candidate is reaped only if its argv carries a brand-scoped
+# token — the cert path, config path, or tunnel id, each unique to ~/.<brand>/.
+# A co-resident brand's connector matches none and is never touched. If no brand
+# token is known we skip the reap entirely rather than risk a match-everything.
+KILL_CMD="${RESUME_TUNNEL_KILL_CMD:-kill}"
+
+reap_strays() {
+  local survivor_pid="$1"
+  local match_args=()
+  [ -n "$CERT_PATH" ]   && match_args+=( -e "$CERT_PATH" )
+  [ -n "$CONFIG_PATH" ] && match_args+=( -e "$CONFIG_PATH" )
+  [ -n "$TUNNEL_ID" ]   && match_args+=( -e "$TUNNEL_ID" )
+  if [ "${#match_args[@]}" -eq 0 ]; then
+    log "[tunnel-supervise] op=reap brand=$BRAND found=0 killed=0 survivor=${survivor_pid:-none} (no brand token; skipped)"
+    return 0
+  fi
+
+  local pids
+  pids=$(ps -eo pid=,args= 2>/dev/null \
+    | grep 'cloudflared' \
+    | grep 'tunnel run' \
+    | grep -F "${match_args[@]}" \
+    | awk '{print $1}')
+
+  local found=0 killed=0 pid
+  for pid in $pids; do
+    found=$((found + 1))
+    if [ -n "$survivor_pid" ] && [ "$pid" = "$survivor_pid" ]; then
+      continue
+    fi
+    local victim_cfg victim_tid
+    victim_cfg=$(ps -p "$pid" -o args= 2>/dev/null | sed -n 's/.*--config[ =]\([^ ]*\).*/\1/p')
+    victim_tid=$(grep -E '^tunnel:' "$victim_cfg" 2>/dev/null | head -1 | awk '{print $2}')
+    [ -n "$victim_tid" ] || victim_tid="unknown"
+    log "[tunnel-supervise] op=reap brand=$BRAND target=$pid tunnel=$victim_tid"
+    "$KILL_CMD" -TERM "$pid" 2>/dev/null
+    local waited=0
+    while "$KILL_CMD" -0 "$pid" 2>/dev/null; do
+      if [ "$waited" -ge "${RESUME_TUNNEL_REAP_GRACE:-5}" ]; then
+        "$KILL_CMD" -KILL "$pid" 2>/dev/null
+        break
+      fi
+      sleep 1
+      waited=$((waited + 1))
+    done
+    killed=$((killed + 1))
+  done
+
+  log "[tunnel-supervise] op=reap brand=$BRAND found=$found killed=$killed survivor=${survivor_pid:-none}"
+}
+
+# Determine the supervised survivor before reaping. If the unit is active its
+# MainPID is the connector we keep; every other brand-matched connector is a
+# stray. The service is owned by user-systemd, fully outside the brand service's
+# cgroup. Unlike before, an active unit no longer short-circuits the whole
+# script: the reap runs first so strays die even when the supervised one is up.
+SURVIVOR_PID=""
+SERVICE_ACTIVE=0
+if systemctl --user is-active "$SERVICE_UNIT" >/dev/null 2>&1; then
+  SERVICE_ACTIVE=1
+  SURVIVOR_PID=$(systemctl --user show "$SERVICE_UNIT" --property=MainPID --value 2>/dev/null || echo "")
+  [ "$SURVIVOR_PID" = "0" ] && SURVIVOR_PID=""
+fi
+
+# If the unit is active but its MainPID is unresolved (a RestartSec transition:
+# is-active already true while the new MainPID is not yet published), we cannot
+# tell the live supervised connector from a stray — reaping now could SIGKILL the
+# survivor. Skip the reap this cycle; the next brand-service start reaps once
+# MainPID resolves. The connector is up, so there is nothing to spawn either.
+if [ "$SERVICE_ACTIVE" -eq 1 ] && [ -z "$SURVIVOR_PID" ]; then
+  log "[tunnel-supervise] op=reap brand=$BRAND skipped reason=mainpid-unresolved survivor=unknown"
+  log "Tunnel already running (service $SERVICE_UNIT active, MainPID unresolved) — reap skipped, skipping resume"
+  exit 0
+fi
+
+reap_strays "$SURVIVOR_PID"
+
+if [ "$SERVICE_ACTIVE" -eq 1 ]; then
+  log "Tunnel already running (service $SERVICE_UNIT active, MainPID ${SURVIVOR_PID:-unknown}) — strays reaped, skipping resume"
+  exit 0
+fi
+
+CLOUDFLARED_BIN=$(command -v cloudflared 2>/dev/null || true)
+
+if [ -z "$CLOUDFLARED_BIN" ]; then
+  resume_refused "no-cloudflared-binary"
+  exit 0
+fi
+
+# tunnel run authenticates with the per-tunnel credentials-file declared in
+# config.yml (written by `tunnel create`, present in both the OAuth and the
+# API-token models). The OAuth account cert (--origincert) is a create/route
+# credential; tunnel run never needs it. So a tunnel is resumable whenever its
+# config exists AND a usable run credential is present — either cert.pem (OAuth)
+# or the credentials-file the config references (API-token). --origincert is
+# added to the spawn only when cert.pem exists, so a token-created tunnel with
+# no cert resumes too.
+if [ -z "$CONFIG_PATH" ] || [ ! -f "$CONFIG_PATH" ]; then
+  resume_refused "missing-config"
+  exit 0
+fi
+
+CRED_FILE=$(sed -n 's/^[[:space:]]*credentials-file:[[:space:]]*//p' "$CONFIG_PATH" 2>/dev/null | head -1 | tr -d '[:space:]')
+
+if [ ! -f "$CERT_PATH" ] && { [ -z "$CRED_FILE" ] || [ ! -f "$CRED_FILE" ]; }; then
+  resume_refused "missing-run-credential"
+  exit 0
+fi
+
+log "Resuming tunnel $TUNNEL_ID for $DOMAIN..."
+
+# Capture log byte offset before spawning so the verification poll only
+# matches lines written by THIS invocation, not lines from a prior run.
+mkdir -p "$LOG_DIR"
+LOG_OFFSET=$(wc -c < "$LOG_FILE" 2>/dev/null | awk '{print $1+0}' || echo 0)
+
+# Spawn into a SUPERVISED transient service under cloudflared.slice (Task 757).
+# Unlike a --scope (no restart policy), a Restart=always service is resurrected
+# by systemd on ANY exit — crash, OOM, manual kill. --no-autoupdate stops the
+# connector replacing its own binary, so the version stays installer-owned.
+# StartLimitIntervalSec/StartLimitBurst trip a genuinely broken binary to
+# `failed` instead of looping forever (5 starts within 300s → failed).
+# A service's stdout/stderr go to the journal, not this shell, so route them to
+# LOG_FILE via StandardOutput/StandardError=append so the verification gate
+# below and the operator's cloudflared.log keep working. systemd-run returns
+# once the unit is active (it does not block for the process lifetime), so there
+# is no shell child to background. --quiet suppresses systemd-run's "Running as
+# unit:" line; the trailing redirect only captures any error output it prints.
+# Build the connector argv. --origincert is included only for an OAuth tunnel
+# (cert.pem present); a token-created tunnel runs from its credentials-file
+# alone. The array is always non-empty, so it expands safely under `set -u`.
+CONNECTOR_ARGS=( "$CLOUDFLARED_BIN" --no-autoupdate )
+[ -f "$CERT_PATH" ] && CONNECTOR_ARGS+=( --origincert "$CERT_PATH" )
+CONNECTOR_ARGS+=( --config "$CONFIG_PATH" tunnel run )
+
+systemd-run \
+  --user \
+  --quiet \
+  --unit="$SERVICE_UNIT" \
+  --slice=cloudflared \
+  -p Restart=always \
+  -p RestartSec=2 \
+  -p StartLimitIntervalSec=300 \
+  -p StartLimitBurst=5 \
+  -p TimeoutStopSec=15 \
+  -p "StandardOutput=append:$LOG_FILE" \
+  -p "StandardError=append:$LOG_FILE" \
+  -- \
+  "${CONNECTOR_ARGS[@]}" \
+  >> "$LOG_FILE" 2>&1
+
+# Log spawn receipt so the operator can distinguish the supervised path from legacy nohup.
+SERVICE_PID=$(systemctl --user show "$SERVICE_UNIT" --property=MainPID --value 2>/dev/null || echo "unknown")
+log "spawned service=$SERVICE_UNIT slice=cloudflared main-pid=$SERVICE_PID"
+
+# Post-spawn connection verification gate.
+# Polls only new log content (from LOG_OFFSET onwards) to avoid false positives
+# from "Registered tunnel connection" lines written by a prior run.
+# Overridable via RESUME_TUNNEL_VERIFY_DEADLINE for testing.
+# On failure: log explicit ERROR and exit 0 — must not block brand-service start.
+VERIFY_DEADLINE="${RESUME_TUNNEL_VERIFY_DEADLINE:-20}"
+VERIFY_START=$(date +%s)
+VERIFIED=0
+while true; do
+  if tail -c "+$((LOG_OFFSET + 1))" "$LOG_FILE" 2>/dev/null | grep -q "Registered tunnel connection"; then
+    VERIFIED=1
+    break
+  fi
+  NOW=$(date +%s)
+  ELAPSED=$(( NOW - VERIFY_START ))
+  if [ "$ELAPSED" -ge "$VERIFY_DEADLINE" ]; then
+    break
+  fi
+  sleep 1
+done
+
+if [ "$VERIFIED" -eq 1 ]; then
+  ELAPSED=$(( $(date +%s) - VERIFY_START ))
+  CONN_COUNT=$(tail -c "+$((LOG_OFFSET + 1))" "$LOG_FILE" 2>/dev/null | grep -c "Registered tunnel connection" || echo "?")
+  log "tunnel verified service=$SERVICE_UNIT connections=$CONN_COUNT ms=$(( ELAPSED * 1000 ))"
+else
+  log "ERROR: tunnel service started but no edge connection within ${VERIFY_DEADLINE}s — service=$SERVICE_UNIT"
+fi
+
+# Update state file: keep pid/startedAt for observability, add serviceUnit as control signal.
+NEW_STATE=$(echo "$STATE" | jq \
+  --arg unit "$SERVICE_UNIT" \
+  --argjson ts "$(date +%s)000" \
+  '.serviceUnit = $unit | .startedAt = $ts' 2>/dev/null || echo "")
+
+if [ -n "$NEW_STATE" ] && echo "$NEW_STATE" > "$STATE_FILE.tmp" 2>/dev/null && mv "$STATE_FILE.tmp" "$STATE_FILE" 2>/dev/null; then
+  :
+else
+  rm -f "$STATE_FILE.tmp" 2>/dev/null
+  log "WARNING: tunnel started but failed to update state file"
+fi
+
+exit 0

package/payload/platform/scripts/rss-sampler.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+# Standing RSS sampler — Task 600.
+# Reads /proc/meminfo and per-claude.exe /proc/<pid>/status every 30s.
+# Appends one structured line per cycle to LOG_PATH.
+# Caps log at LOG_MAX_BYTES (default 10485760 = 10MB).
+
+set -euo pipefail
+
+LOG_PATH="${LOG_PATH:-/tmp/rss-sampler.log}"
+LOG_MAX_BYTES="${LOG_MAX_BYTES:-10485760}"
+INTERVAL="${INTERVAL:-30}"
+
+while true; do
+  # Read /proc/meminfo for MemTotal and MemAvailable (in kB)
+  mem_total_kb=0
+  mem_available_kb=0
+  while IFS=': ' read -r key val _unit; do
+    case "$key" in
+      MemTotal)     mem_total_kb="$val" ;;
+      MemAvailable) mem_available_kb="$val" ;;
+    esac
+  done < /proc/meminfo
+  mem_total_mb=$(( mem_total_kb / 1024 ))
+  mem_available_mb=$(( mem_available_kb / 1024 ))
+
+  # Find all claude.exe PIDs
+  mapfile -t pids < <(pgrep -x "claude.exe" 2>/dev/null || true)
+  claude_count="${#pids[@]}"
+  aggregate_rss_mb=0
+  pid_pairs=""
+
+  for pid in "${pids[@]}"; do
+    rss_kb=0
+    if [[ -r "/proc/${pid}/status" ]]; then
+      rss_kb=$(grep -m1 '^VmRSS:' "/proc/${pid}/status" 2>/dev/null | awk '{print $2}' || echo 0)
+    fi
+    rss_mb=$(( rss_kb / 1024 ))
+    aggregate_rss_mb=$(( aggregate_rss_mb + rss_mb ))
+    pid_pairs="${pid_pairs:+$pid_pairs,}${pid}:${rss_mb}"
+  done
+
+  ts=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+  line="${ts}  MemTotalMB=${mem_total_mb} MemAvailableMB=${mem_available_mb}  claude_count=${claude_count}  aggregate_rss_mb=${aggregate_rss_mb}  pids=${pid_pairs:-none}"
+  echo "$line" >> "$LOG_PATH"
+
+  # Cap log at LOG_MAX_BYTES: drop oldest half when threshold is exceeded
+  if [[ -f "$LOG_PATH" ]]; then
+    actual_bytes=$(wc -c < "$LOG_PATH")
+    if (( actual_bytes > LOG_MAX_BYTES )); then
+      total_lines=$(wc -l < "$LOG_PATH")
+      keep_lines=$(( total_lines / 2 ))
+      tmp_file="${LOG_PATH}.tmp"
+      tail -n "$keep_lines" "$LOG_PATH" > "$tmp_file" && mv "$tmp_file" "$LOG_PATH"
+    fi
+  fi
+
+  sleep "$INTERVAL"
+done