@rubytech/create-sitedesk-code 0.1.340

package/payload/platform/services/claude-session-manager/dist/sidecar-store.js

@@ -0,0 +1,118 @@
+// Task 902 — the one per-session sidecar store that scope-record and
+// reseat-ledger both build on. Each store keeps a `<sessionsDir>/<id><suffix>`
+// JSON file and shares the same mechanics: a path builder, an atomic
+// tmp-write + rename (best-effort tmp cleanup on failure), a suffix-matched
+// directory scan, and an `existsSync` + `unlink` clear. Before this helper the
+// two stores were near-verbatim copies that had already begun to drift in how
+// they scanned the directory; collapsing them puts any future fix to
+// partial-write handling or tmp-file cleanup in one place.
+//
+// The helper does NO logging. It returns results, and each store's thin
+// wrapper owns its own log lines — the two stores log with different prefixes
+// and different per-record detail, so unifying the messages here would change
+// operator-greppable output. The wrappers keep their exact strings.
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+function escapeRegExp(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+export function createSidecarStore(config) {
+    const { suffix, validate } = config;
+    const suffixRe = new RegExp(`${escapeRegExp(suffix)}$`);
+    function pathFor(sessionsDir, id) {
+        return join(sessionsDir, `${id}${suffix}`);
+    }
+    function write(sessionsDir, id, record) {
+        mkdirSync(sessionsDir, { recursive: true });
+        const path = pathFor(sessionsDir, id);
+        const tmp = `${path}.tmp.${process.pid}`;
+        try {
+            writeFileSync(tmp, JSON.stringify(record), 'utf8');
+            renameSync(tmp, path);
+            return { ok: true };
+        }
+        catch (error) {
+            try {
+                if (existsSync(tmp))
+                    unlinkSync(tmp);
+            }
+            catch { /* best-effort */ }
+            return { ok: false, error };
+        }
+    }
+    function readFileAt(path) {
+        let raw;
+        try {
+            raw = readFileSync(path, 'utf8');
+        }
+        catch {
+            return null;
+        }
+        try {
+            return validate(JSON.parse(raw));
+        }
+        catch {
+            return null;
+        }
+    }
+    function read(sessionsDir, id) {
+        return readFileAt(pathFor(sessionsDir, id));
+    }
+    function readAll(sessionsDir, onSkip) {
+        let names;
+        try {
+            // `withFileTypes` + `isFile` so a sub-directory whose name happens to
+            // match the suffix is ignored before any read is attempted — never read
+            // as a record, never reported via onSkip.
+            names = readdirSync(sessionsDir, { withFileTypes: true })
+                .filter((entry) => entry.isFile())
+                .map((entry) => entry.name);
+        }
+        catch {
+            return [];
+        }
+        const out = [];
+        for (const name of names) {
+            if (!suffixRe.test(name))
+                continue;
+            const path = join(sessionsDir, name);
+            let raw;
+            try {
+                raw = readFileSync(path, 'utf8');
+            }
+            catch {
+                onSkip?.(name, 'unreadable');
+                continue;
+            }
+            let parsed;
+            try {
+                parsed = JSON.parse(raw);
+            }
+            catch {
+                onSkip?.(name, 'unreadable');
+                continue;
+            }
+            const record = validate(parsed);
+            if (record)
+                out.push(record);
+            else
+                onSkip?.(name, 'invalid');
+        }
+        return out;
+    }
+    function clear(sessionsDir, id) {
+        const path = pathFor(sessionsDir, id);
+        try {
+            if (existsSync(path)) {
+                unlinkSync(path);
+                return { ok: true, removed: true };
+            }
+            return { ok: true, removed: false };
+        }
+        catch (error) {
+            return { ok: false, error };
+        }
+    }
+    return { pathFor, write, read, readAll, clear };
+}
+//# sourceMappingURL=sidecar-store.js.map

package/payload/platform/services/claude-session-manager/dist/sidecar-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sidecar-store.js","sourceRoot":"","sources":["../src/sidecar-store.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,+EAA+E;AAC/E,qEAAqE;AACrE,4EAA4E;AAC5E,+EAA+E;AAC/E,8EAA8E;AAC9E,qEAAqE;AACrE,2DAA2D;AAC3D,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,8EAA8E;AAC9E,oEAAoE;AACpE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACjH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AA+BhC,SAAS,YAAY,CAAC,CAAS;IAC7B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAI,MAMrC;IACC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAA;IACnC,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IAEvD,SAAS,OAAO,CAAC,WAAmB,EAAE,EAAU;QAC9C,OAAO,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;IAC5C,CAAC;IAED,SAAS,KAAK,CAAC,WAAmB,EAAE,EAAU,EAAE,MAAS;QACvD,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACrC,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAA;QACxC,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAA;YAClD,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;YACrB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBAAC,IAAI,UAAU,CAAC,GAAG,CAAC;oBAAE,UAAU,CAAC,GAAG,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACxE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,SAAS,UAAU,CAAC,IAAY;QAC9B,IAAI,GAAW,CAAA;QACf,IAAI,CAAC;YACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IAED,SAAS,IAAI,CAAC,WAAmB,EAAE,EAAU;QAC3C,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAA;IAC7C,CAAC;IAED,SAAS,OAAO,CACd,WAAmB,EACnB,MAA8D;QAE9D,IAAI,KAAe,CAAA;QACnB,IAAI,CAAC;YACH,sEAAsE;YACtE,wEAAwE;YACxE,0CAA0C;YAC1C,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;iBACtD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;iBACjC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAA;QACX,CAAC;QACD,MAAM,GAAG,GAAQ,EAAE,CAAA;QACnB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;YACpC,IAAI,GAAW,CAAA;YACf,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;gBAC5B,SAAQ;YACV,CAAC;YACD,IAAI,MAAe,CAAA;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,EAAE,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA;gBAC5B,SAAQ;YACV,CAAC;YACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YAC/B,IAAI,MAAM;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;;gBACvB,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAChC,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,SAAS,KAAK,CAAC,WAAmB,EAAE,EAAU;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAA;QACrC,IAAI,CAAC;YACH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrB,UAAU,CAAC,IAAI,CAAC,CAAA;gBAChB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;YACpC,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;QACrC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;AACjD,CAAC"}

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.d.ts

@@ -0,0 +1,28 @@
+import type { Channel } from './types.js';
+export interface BucketLimit {
+    cap: number;
+    windowMs: number;
+}
+export interface PublicSpawnLimits {
+    /** Per-(senderId, channel) bucket. Required: every channel has a cap. */
+    perChannel: Record<Channel, BucketLimit>;
+    /** Cross-channel bucket keyed on senderId alone. */
+    global: BucketLimit;
+}
+export type AdmitDecision = {
+    admitted: true;
+} | {
+    admitted: false;
+    scope: 'channel' | 'global';
+    cap: number;
+    windowMs: number;
+};
+export interface RateLimiter {
+    /** Try to admit one spawn. Mutates state on `admitted: true`. */
+    admit(senderId: string, channel: Channel, now?: number): AdmitDecision;
+    /** Test-only: clear all buckets. */
+    reset(): void;
+}
+export declare function createSpawnRateLimiter(limits: PublicSpawnLimits): RateLimiter;
+export declare const DEFAULT_PUBLIC_SPAWN_LIMITS: PublicSpawnLimits;
+//# sourceMappingURL=spawn-rate-limiter.d.ts.map

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-rate-limiter.d.ts","sourceRoot":"","sources":["../src/spawn-rate-limiter.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACxC,oDAAoD;IACpD,MAAM,EAAE,WAAW,CAAA;CACpB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAClB;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AASnF,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,aAAa,CAAA;IACtE,oCAAoC;IACpC,KAAK,IAAI,IAAI,CAAA;CACd;AASD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAiD7E;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAYzC,CAAA"}

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.js

@@ -0,0 +1,77 @@
+// in-memory leaky-bucket throttle for `POST /spawn role=public`.
+//
+// Two buckets fire on each admit attempt: one keyed `(senderId, channel)` to
+// stop a single sender from flooding one channel, and one keyed `senderId`
+// alone to stop the same sender from working around the per-channel cap by
+// rotating channels. First bucket to trip wins; `scope` in the result names
+// which one so the 429 body and log line can tell them apart.
+//
+// Out of scope (per task): persistence across manager restarts, cross-process
+// coordination. Restarts wipe the buckets; the manager is single-process per
+// brand on the Pi.
+function evict(stamps, cutoff) {
+    // Stamps are pushed in monotonic order; drop the prefix older than cutoff.
+    let i = 0;
+    while (i < stamps.length && stamps[i] <= cutoff)
+        i++;
+    return i === 0 ? stamps : stamps.slice(i);
+}
+export function createSpawnRateLimiter(limits) {
+    const state = {
+        byChannel: new Map(),
+        byGlobal: new Map(),
+    };
+    return {
+        admit(senderId, channel, now = Date.now()) {
+            const channelLimit = limits.perChannel[channel];
+            const channelKey = `${senderId}|${channel}`;
+            const channelCutoff = now - channelLimit.windowMs;
+            const channelStamps = evict(state.byChannel.get(channelKey) ?? [], channelCutoff);
+            if (channelStamps.length >= channelLimit.cap) {
+                // Persist the eviction so the map doesn't accumulate stale entries.
+                state.byChannel.set(channelKey, channelStamps);
+                return {
+                    admitted: false,
+                    scope: 'channel',
+                    cap: channelLimit.cap,
+                    windowMs: channelLimit.windowMs,
+                };
+            }
+            const globalCutoff = now - limits.global.windowMs;
+            const globalStamps = evict(state.byGlobal.get(senderId) ?? [], globalCutoff);
+            if (globalStamps.length >= limits.global.cap) {
+                state.byChannel.set(channelKey, channelStamps);
+                state.byGlobal.set(senderId, globalStamps);
+                return {
+                    admitted: false,
+                    scope: 'global',
+                    cap: limits.global.cap,
+                    windowMs: limits.global.windowMs,
+                };
+            }
+            channelStamps.push(now);
+            globalStamps.push(now);
+            state.byChannel.set(channelKey, channelStamps);
+            state.byGlobal.set(senderId, globalStamps);
+            return { admitted: true };
+        },
+        reset() {
+            state.byChannel.clear();
+            state.byGlobal.clear();
+        },
+    };
+}
+export const DEFAULT_PUBLIC_SPAWN_LIMITS = {
+    // Conservative defaults: 10 spawns / minute per channel; 30 / minute global.
+    // Operators override via brand.json or env. verification fires the
+    // per-channel cap (11 calls, same senderId+channel).
+    perChannel: {
+        browser: { cap: 10, windowMs: 60_000 },
+        whatsapp: { cap: 10, windowMs: 60_000 },
+        telegram: { cap: 10, windowMs: 60_000 },
+        webchat: { cap: 10, windowMs: 60_000 },
+        email: { cap: 10, windowMs: 60_000 },
+    },
+    global: { cap: 30, windowMs: 60_000 },
+};
+//# sourceMappingURL=spawn-rate-limiter.js.map

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-rate-limiter.js","sourceRoot":"","sources":["../src/spawn-rate-limiter.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,mBAAmB;AAkCnB,SAAS,KAAK,CAAC,MAAgB,EAAE,MAAc;IAC7C,2EAA2E;IAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM;QAAE,CAAC,EAAE,CAAA;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,MAAM,KAAK,GAAkB;QAC3B,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,QAAQ,EAAE,IAAI,GAAG,EAAE;KACpB,CAAA;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YACvC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAA;YAC3C,MAAM,aAAa,GAAG,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAA;YACjD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAA;YAEjF,IAAI,aAAa,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;gBAC7C,oEAAoE;gBACpE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;gBAC9C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,SAAS;oBAChB,GAAG,EAAE,YAAY,CAAC,GAAG;oBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;iBAChC,CAAA;YACH,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAA;YACjD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAA;YAE5E,IAAI,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC7C,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;gBAC9C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;gBAC1C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,QAAQ;oBACf,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;oBACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;iBACjC,CAAA;YACH,CAAC;YAED,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;YAC9C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;YAC1C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QACD,KAAK;YACH,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;YACvB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACxB,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,6EAA6E;IAC7E,mEAAmE;IACnE,qDAAqD;IACrD,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACtC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACvC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACvC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACtC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;KACrC;IACD,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CACtC,CAAA"}

package/payload/platform/services/claude-session-manager/dist/specialist-drift.d.ts

@@ -0,0 +1,60 @@
+import type { ToolSurface } from './tool-surface.js';
+/** Claude Code-native tools an agent can call without any MCP server.
+ *  Listed exhaustively rather than guessed — a new CC-native tool added
+ *  upstream forces an explicit ledger update here. Exported so the admin
+ *  operator spawn can union this set into its `--allowed-tools` argv at
+ *  spawn time; Task 579 — without that union, the admin's explicit
+ *  plugin-tool allowlist silently excluded built-in `LS` / `Glob` and
+ *  the seat could not enumerate its own disk. */
+export declare const CC_NATIVE_TOOLS: Set<string>;
+export interface SpecialistDriftDefect {
+    specialistPath: string;
+    specialistName: string;
+    tool: string;
+    reason: 'unknown-plugin-namespace' | 'unknown-tool-in-plugin' | 'malformed-name' | 'brand-excluded-plugin';
+}
+export interface SpecialistDriftResult {
+    /** True when no defect refuses boot. `brand-excluded-plugin` defects do
+     *  not refuse boot — they populate `stripList` and the manager removes
+     *  those tools from the specialist's allowlist at spawn time. Any other
+     *  defect class makes this false. */
+    ok: boolean;
+    /** Defects found, by specialist file. Includes brand-excluded entries
+     *  even though they do not refuse boot — they are the audit trail for
+     *  what the strip-list took out. */
+    defects: SpecialistDriftDefect[];
+    /** Total specialist `.md` files inspected (those with a `tools:` line). */
+    inspected: number;
+    /** Per-specialist set of tool names to remove from `--allowed-tools` at
+     *  spawn time. Keyed by specialist name (the `.md` basename without the
+     *  extension). Populated exclusively by `brand-excluded-plugin` defects;
+     *  any other defect class refuses boot and the manager never reaches a
+     *  spawn that would consult this map. */
+    stripList: ReadonlyMap<string, ReadonlySet<string>>;
+    /** Per-specialist resolved tool surface — keyed by specialist name (the
+     *  `.md` basename), value is the sorted set of tool names declared on the
+     *  specialist's `tools:` line (before any strip-list removal). Populated
+     *  for every specialist with a `tools:` line, regardless of drift outcome.
+     *  Consumed by the manager-boot `[specialist-surface]` standing log so a
+     *  payload-twin or bundle drift that drops a tool from a specialist's
+     *  resolved surface is greppable from server.log without re-running a
+     *  failing brief (Task 565 observability item 1). */
+    surfaces: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Extract the value of the `tools:` line from a YAML frontmatter block.
+ *  Returns the raw value (whitespace-trimmed) or null when no `tools:`
+ *  key appears. The value is the comma-separated tool list Claude Code
+ *  resolves; this module is the single parser of that grammar. */
+export declare function parseSpecialistToolsLine(frontmatter: string): string | null;
+/** Walk one or more directories, classify every specialist `.md` file's
+ *  `tools:` frontmatter, and return drift defects.
+ *
+ *  `excludedPlugins` carries the brand's `plugins.excluded` set (the
+ *  plugin directory names brand.json excludes from this bundle). A tool
+ *  whose namespace appears in that set is classified as
+ *  `brand-excluded-plugin`: it does not refuse boot and lands in
+ *  `stripList` for the spawn path to remove from `--allowed-tools`.
+ *  Defaulted to the empty set so call-sites that don't know about brand
+ *  exclusions keep the legacy strict-boot semantics. */
+export declare function assertSpecialistDrift(agentDirs: readonly string[], toolSurface: ToolSurface, excludedPlugins?: ReadonlySet<string>): SpecialistDriftResult;
+//# sourceMappingURL=specialist-drift.d.ts.map

package/payload/platform/services/claude-session-manager/dist/specialist-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specialist-drift.d.ts","sourceRoot":"","sources":["../src/specialist-drift.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGpD;;;;;;iDAMiD;AACjD,eAAO,MAAM,eAAe,aAmB1B,CAAA;AAiBF,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EACF,0BAA0B,GAC1B,wBAAwB,GACxB,gBAAgB,GAChB,uBAAuB,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;yCAGqC;IACrC,EAAE,EAAE,OAAO,CAAA;IACX;;wCAEoC;IACpC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB;;;;6CAIyC;IACzC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD;;;;;;;yDAOqD;IACrD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;CACnD;AAED;;;kEAGkE;AAClE,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3E;AA+CD;;;;;;;;;wDASwD;AACxD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,WAAW,EAAE,WAAW,EACxB,eAAe,GAAE,WAAW,CAAC,MAAM,CAAa,GAC/C,qBAAqB,CAmDvB"}

package/payload/platform/services/claude-session-manager/dist/specialist-drift.js

@@ -0,0 +1,203 @@
+// Boot-time drift assertion against specialist `.md` frontmatter.
+//
+// Every specialist subagent declares a `tools:` line in its YAML front-
+// matter (a comma-separated list of fully qualified tool names). The
+// `--allowed-tools` argv that Claude Code resolves for that subagent is
+// derived from this list, so a name that does not correspond to any tool
+// the platform can actually serve becomes a silent "tool not found" the
+// first time the specialist tries to use it — months after the typo or
+// stale-removal landed.
+//
+// This module catches the gap at manager boot. Specialist `tools:` names are
+// the canonical long prefix `mcp__plugin_<plugin>_<server>__<tool>` (Task 502).
+// For every tool name a specialist `.md` declares we verify that it resolves
+// to one of:
+//
+//   - the tool surface `all` set (every tool declared in any
+//     `<plugin>/PLUGIN.md` — both `tools:` entries and `hidden:` names — as
+//     the long canonical name),
+//   - a Claude Code-native tool (Read, Glob, Grep, Write, Bash,
+//     WebSearch, WebFetch, Task, etc.),
+//   - or a third-party MCP-bridge: a `mcp__plugin_*` name whose plugin segment
+//     is NOT a maxy platform plugin (Playwright, etc.) is served by an upstream
+//     bridge whose tool names are upstream-owned and pass unconditionally.
+//
+// A `mcp__plugin_*` name whose plugin segment IS a maxy plugin is validated
+// against `all` like any other maxy tool, so a typo or stale long-prefix name
+// still refuses boot. Anything else is drift, and the manager refuses to boot.
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join, basename } from 'node:path';
+import { MAXY_MCP_PLUGINS } from './canonical-tool-names.generated.js';
+/** Claude Code-native tools an agent can call without any MCP server.
+ *  Listed exhaustively rather than guessed — a new CC-native tool added
+ *  upstream forces an explicit ledger update here. Exported so the admin
+ *  operator spawn can union this set into its `--allowed-tools` argv at
+ *  spawn time; Task 579 — without that union, the admin's explicit
+ *  plugin-tool allowlist silently excluded built-in `LS` / `Glob` and
+ *  the seat could not enumerate its own disk. */
+export const CC_NATIVE_TOOLS = new Set([
+    'Read',
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'Glob',
+    'Grep',
+    'LS',
+    'Bash',
+    'BashOutput',
+    'KillShell',
+    'Skill',
+    'WebSearch',
+    'WebFetch',
+    'Task',
+    'TodoWrite',
+    'NotebookEdit',
+    'NotebookRead',
+    'AskUserQuestion',
+]);
+/** Third-party MCP-bridge prefix. A `mcp__plugin_<plugin>_<server>__<tool>`
+ *  name whose `<plugin>` segment is NOT a maxy platform plugin is served by an
+ *  upstream bridge (Playwright, etc.) whose tool names are upstream-owned and
+ *  not part of the maxy canonical set — those pass unconditionally. A
+ *  `mcp__plugin_*` name whose `<plugin>` IS a maxy plugin (including the graph
+ *  proxy, packaged as the `graph` plugin since Task 502) is validated against
+ *  the `all` surface like any other maxy tool, so a typo or stale long-prefix
+ *  name still refuses boot. */
+const PLUGIN_BRIDGE_PREFIX = 'mcp__plugin_';
+/** Maxy platform plugin directory basenames, derived from the canonical set.
+ *  A long-prefix name `mcp__plugin_<p>_<p>__` is a maxy tool iff `<p>` is in
+ *  this set; anything else under `mcp__plugin_` is a third-party bridge. */
+const MAXY_PLUGIN_SET = new Set(MAXY_MCP_PLUGINS);
+/** Extract the value of the `tools:` line from a YAML frontmatter block.
+ *  Returns the raw value (whitespace-trimmed) or null when no `tools:`
+ *  key appears. The value is the comma-separated tool list Claude Code
+ *  resolves; this module is the single parser of that grammar. */
+export function parseSpecialistToolsLine(frontmatter) {
+    const m = frontmatter.match(/^tools:\s*(.+)$/m);
+    if (!m)
+        return null;
+    return m[1].trim();
+}
+function splitToolList(raw) {
+    return raw
+        .split(',')
+        .map((t) => t.trim())
+        .filter((t) => t.length > 0);
+}
+function classifyTool(tool, allSet, excludedPlugins) {
+    if (CC_NATIVE_TOOLS.has(tool))
+        return 'ok';
+    if (tool.startsWith(PLUGIN_BRIDGE_PREFIX)) {
+        // mcp__plugin_<plugin>_<server>__<tool>. A maxy plugin (plugin === server)
+        // must resolve in the live `all` set; a non-maxy segment is a third-party
+        // bridge (Playwright, etc.) whose tool names are upstream-owned — pass.
+        const m = tool.match(/^mcp__plugin_([A-Za-z0-9-]+)_([A-Za-z0-9-]+)__/);
+        const plugin = m ? m[1] : null;
+        if (plugin && MAXY_PLUGIN_SET.has(plugin)) {
+            if (allSet.has(tool))
+                return 'ok';
+            const hasNamespace = Array.from(allSet).some((t) => t.startsWith(`mcp__plugin_${plugin}_${plugin}__`));
+            if (hasNamespace)
+                return 'unknown-tool-in-plugin';
+            // Brand-excluded: the brand's `plugins.excluded` list names this plugin,
+            // so the absence is intentional. The template that declared the tool is
+            // brand-agnostic; the manager strips it from the allowlist at spawn time.
+            if (excludedPlugins.has(plugin))
+                return 'brand-excluded-plugin';
+            return 'unknown-plugin-namespace';
+        }
+        return 'ok';
+    }
+    if (allSet.has(tool))
+        return 'ok';
+    // Remaining `mcp__<x>__` shapes are short-prefix names. Since Task 502 the
+    // admin + specialist surfaces are long-prefix only, so a short maxy name is
+    // drift (it must be the canonical long name); a non-maxy short namespace is
+    // unknown. Brand-excluded short names are tolerated for the strip-list path.
+    const mcpMatch = tool.match(/^mcp__([^_]+(?:_[^_]+)*)__/);
+    if (!mcpMatch)
+        return 'malformed-name';
+    const ns = mcpMatch[1];
+    if (excludedPlugins.has(ns))
+        return 'brand-excluded-plugin';
+    return 'unknown-plugin-namespace';
+}
+/** Walk one or more directories, classify every specialist `.md` file's
+ *  `tools:` frontmatter, and return drift defects.
+ *
+ *  `excludedPlugins` carries the brand's `plugins.excluded` set (the
+ *  plugin directory names brand.json excludes from this bundle). A tool
+ *  whose namespace appears in that set is classified as
+ *  `brand-excluded-plugin`: it does not refuse boot and lands in
+ *  `stripList` for the spawn path to remove from `--allowed-tools`.
+ *  Defaulted to the empty set so call-sites that don't know about brand
+ *  exclusions keep the legacy strict-boot semantics. */
+export function assertSpecialistDrift(agentDirs, toolSurface, excludedPlugins = new Set()) {
+    const defects = [];
+    const stripList = new Map();
+    const surfaces = new Map();
+    let inspected = 0;
+    for (const dir of agentDirs) {
+        let entries;
+        try {
+            entries = readdirSync(dir);
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries.sort()) {
+            const fullPath = join(dir, entry);
+            let st;
+            try {
+                st = statSync(fullPath);
+            }
+            catch {
+                continue;
+            }
+            if (!st.isFile())
+                continue;
+            if (!entry.endsWith('.md'))
+                continue;
+            // Convention: top-level agent files like `valuer.md` are specialists.
+            // IDENTITY.md/SOUL.md/AGENTS.md/LEARNINGS.md are sub-agent prompts
+            // for non-specialist subagent roles (buyer-enquiry, etc.) and live
+            // inside a sub-directory — they are not specialists themselves and
+            // the directory iteration above already skips them.
+            const upperBaseName = basename(entry, '.md').toUpperCase();
+            if (upperBaseName === 'IDENTITY' || upperBaseName === 'SOUL' || upperBaseName === 'AGENTS' || upperBaseName === 'LEARNINGS')
+                continue;
+            const raw = readFileSync(fullPath, 'utf-8');
+            const fmMatch = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+            if (!fmMatch)
+                continue;
+            const toolsLine = parseSpecialistToolsLine(fmMatch[1]);
+            if (!toolsLine)
+                continue;
+            inspected += 1;
+            const specialistName = basename(entry, '.md');
+            const declaredTools = splitToolList(toolsLine);
+            surfaces.set(specialistName, new Set([...declaredTools].sort()));
+            for (const tool of declaredTools) {
+                const verdict = classifyTool(tool, toolSurface.all, excludedPlugins);
+                if (verdict === 'ok')
+                    continue;
+                defects.push({ specialistPath: fullPath, specialistName, tool, reason: verdict });
+                if (verdict === 'brand-excluded-plugin') {
+                    let set = stripList.get(specialistName);
+                    if (!set) {
+                        set = new Set();
+                        stripList.set(specialistName, set);
+                    }
+                    set.add(tool);
+                }
+            }
+        }
+    }
+    // Boot proceeds when every defect is brand-excluded (or there are
+    // none). A single non-brand-excluded defect refuses boot — the manager
+    // logs each and exits non-zero, matching the prior strict contract for
+    // typos / missing plugins / malformed names.
+    const ok = defects.every((d) => d.reason === 'brand-excluded-plugin');
+    return { ok, defects, inspected, stripList, surfaces };
+}
+//# sourceMappingURL=specialist-drift.js.map

package/payload/platform/services/claude-session-manager/dist/specialist-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"specialist-drift.js","sourceRoot":"","sources":["../src/specialist-drift.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,qEAAqE;AACrE,wEAAwE;AACxE,yEAAyE;AACzE,wEAAwE;AACxE,uEAAuE;AACvE,wBAAwB;AACxB,EAAE;AACF,6EAA6E;AAC7E,gFAAgF;AAChF,6EAA6E;AAC7E,aAAa;AACb,EAAE;AACF,6DAA6D;AAC7D,4EAA4E;AAC5E,gCAAgC;AAChC,gEAAgE;AAChE,wCAAwC;AACxC,+EAA+E;AAC/E,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAE/E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAC7D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAEtE;;;;;;iDAMiD;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS;IAC7C,MAAM;IACN,OAAO;IACP,MAAM;IACN,WAAW;IACX,MAAM;IACN,MAAM;IACN,IAAI;IACJ,MAAM;IACN,YAAY;IACZ,WAAW;IACX,OAAO;IACP,WAAW;IACX,UAAU;IACV,MAAM;IACN,WAAW;IACX,cAAc;IACd,cAAc;IACd,iBAAiB;CAClB,CAAC,CAAA;AAEF;;;;;;;+BAO+B;AAC/B,MAAM,oBAAoB,GAAG,cAAc,CAAA;AAE3C;;4EAE4E;AAC5E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAS,gBAAgB,CAAC,CAAA;AA0CzD;;;kEAGkE;AAClE,MAAM,UAAU,wBAAwB,CAAC,WAAmB;IAC1D,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;AAChC,CAAC;AAED,SAAS,YAAY,CACnB,IAAY,EACZ,MAA2B,EAC3B,eAAoC;IAEpC,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC1C,2EAA2E;QAC3E,0EAA0E;QAC1E,wEAAwE;QACxE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAA;QACtE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAC9B,IAAI,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,IAAI,CAAA;YACjC,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACjD,CAAC,CAAC,UAAU,CAAC,eAAe,MAAM,IAAI,MAAM,IAAI,CAAC,CAClD,CAAA;YACD,IAAI,YAAY;gBAAE,OAAO,wBAAwB,CAAA;YACjD,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,OAAO,uBAAuB,CAAA;YAC/D,OAAO,0BAA0B,CAAA;QACnC,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,6EAA6E;IAC7E,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ;QAAE,OAAO,gBAAgB,CAAA;IACtC,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;IACtB,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;QAAE,OAAO,uBAAuB,CAAA;IAC3D,OAAO,0BAA0B,CAAA;AACnC,CAAC;AAED;;;;;;;;;wDASwD;AACxD,MAAM,UAAU,qBAAqB,CACnC,SAA4B,EAC5B,WAAwB,EACxB,kBAAuC,IAAI,GAAG,EAAE;IAEhD,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAA;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAA;IACvD,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,OAAiB,CAAA;QACrB,IAAI,CAAC;YAAC,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAQ;QAAC,CAAC;QACrD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;YACjC,IAAI,EAA+B,CAAA;YACnC,IAAI,CAAC;gBAAC,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,SAAQ;YAAC,CAAC;YAClD,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE;gBAAE,SAAQ;YAC1B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,SAAQ;YACpC,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,mEAAmE;YACnE,oDAAoD;YACpD,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;YAC1D,IAAI,aAAa,KAAK,UAAU,IAAI,aAAa,KAAK,MAAM,IAAI,aAAa,KAAK,QAAQ,IAAI,aAAa,KAAK,WAAW;gBAAE,SAAQ;YACrI,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;YAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;YACxD,IAAI,CAAC,OAAO;gBAAE,SAAQ;YACtB,MAAM,SAAS,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;YACtD,IAAI,CAAC,SAAS;gBAAE,SAAQ;YACxB,SAAS,IAAI,CAAC,CAAA;YACd,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YAC7C,MAAM,aAAa,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;YAC9C,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YAChE,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;gBACjC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;gBACpE,IAAI,OAAO,KAAK,IAAI;oBAAE,SAAQ;gBAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAA;gBACjF,IAAI,OAAO,KAAK,uBAAuB,EAAE,CAAC;oBACxC,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;oBACvC,IAAI,CAAC,GAAG,EAAE,CAAC;wBACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAA;wBACf,SAAS,CAAC,GAAG,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;oBACpC,CAAC;oBACD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACf,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,kEAAkE;IAClE,uEAAuE;IACvE,uEAAuE;IACvE,6CAA6C;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAA;IACrE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;AACxD,CAAC"}

package/payload/platform/services/claude-session-manager/dist/stuck-turn.d.ts

@@ -0,0 +1,70 @@
+import type { Logger } from './types.js';
+export interface StuckTurnVerdict {
+    /** True only when the loop owes the model a call, inbound is queued, and the
+     *  freeze is older than the threshold. */
+    wedged: boolean;
+    /** ms epoch of the last agent-progress record (assistant turn, or a
+     *  tool_result-carrying user record). Null when no progress record is in the
+     *  tail window — in which case `wedged` is always false (safe default). */
+    lastProgressTs: number | null;
+    /** ms epoch of the first `queue-operation:enqueue` after the last progress
+     *  record — the oldest still-pending inbound, and the age baseline for the
+     *  wedge. Null when no pending enqueue is present or its timestamp is
+     *  unparseable; in that case the wedge cannot be aged and `wedged` is false
+     *  (safe default — we never recycle on an inbound we can't prove has waited). */
+    oldestPendingEnqueueTs: number | null;
+    /** Count of `queue-operation:enqueue` records appearing after the last
+     *  progress record (inbound queued with no agent progress since). */
+    pendingQueued: number;
+    /** The last assistant record emitted tool_use block(s) with no later
+     *  progress record — a tool is legitimately running, so this is NOT a wedge. */
+    toolInFlight: boolean;
+}
+/** Pure wedge classifier. Walks records in file order; see `StuckTurnVerdict`. */
+export declare function classifyStuckTurn(records: ReadonlyArray<Record<string, unknown>>, opts: {
+    now: number;
+    thresholdMs: number;
+}): StuckTurnVerdict;
+/** Read the last `TAIL_READ_BYTES` of a JSONL and parse complete records.
+ *  Drops a leading partial line. Returns [] on any read/parse failure.
+ *
+ *  Bound: when the last progress record precedes more than this many bytes of
+ *  queued-inbound rows, it falls off-window and the classifier safe-defaults to
+ *  not-wedged. Robustness for that very-large-JSONL case is tracked separately
+ *  (.tasks/978). */
+export declare function readJsonlTailRecords(path: string, tailBytes?: number): Record<string, unknown>[];
+/** One eligible session for a watchdog tick: a live channel session whose
+ *  process is alive. The watch reads its JSONL, classifies, and recycles. */
+export interface StuckTurnCandidate {
+    sessionId: string;
+    jsonlPath: string;
+}
+export interface StuckTurnWatchDeps {
+    /** Eligible sessions this tick — live channel sessions with a living pid. */
+    candidates: () => StuckTurnCandidate[];
+    /** SIGTERM the wedged session's rc scope (clean exit 143; next inbound
+     *  rc-spawns --resume and drains). Fire-and-forget; failures logged by the
+     *  callee. */
+    recycle: (sessionId: string) => void;
+    thresholdMs: number;
+    intervalMs: number;
+    /** A session recycled within this window is not re-flagged or re-recycled.
+     *  A recycle (SIGTERM the scope) is async and the row stays live until the
+     *  process exits and its pid file disappears — without a cooldown a slow or
+     *  failed stop re-fires every tick. Default 5 min. */
+    recycleCooldownMs?: number;
+    logger: Logger;
+    now?: () => number;
+    /** Injectable tail reader for tests. */
+    readTail?: (path: string) => Record<string, unknown>[];
+}
+export interface StuckTurnWatch {
+    start(): void;
+    stop(): void;
+    tickOnce(): {
+        scanned: number;
+        wedged: number;
+    };
+}
+export declare function createStuckTurnWatch(deps: StuckTurnWatchDeps): StuckTurnWatch;
+//# sourceMappingURL=stuck-turn.d.ts.map

package/payload/platform/services/claude-session-manager/dist/stuck-turn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stuck-turn.d.ts","sourceRoot":"","sources":["../src/stuck-turn.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAExC,MAAM,WAAW,gBAAgB;IAC/B;8CAC0C;IAC1C,MAAM,EAAE,OAAO,CAAA;IACf;;+EAE2E;IAC3E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;;qFAIiF;IACjF,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC;yEACqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB;oFACgF;IAChF,YAAY,EAAE,OAAO,CAAA;CACtB;AAiCD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC/C,IAAI,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzC,gBAAgB,CAuClB;AAID;;;;;;oBAMoB;AACpB,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,SAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAoCzG;AAED;6EAC6E;AAC7E,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,kBAAkB,EAAE,CAAA;IACtC;;kBAEc;IACd,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB;;;0DAGsD;IACtD,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;CACvD;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,IAAI,IAAI,CAAA;IACb,IAAI,IAAI,IAAI,CAAA;IACZ,QAAQ,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;CAChD;AAID,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,kBAAkB,GAAG,cAAc,CA+D7E"}