@rubytech/create-siteoffice-code 0.1.256

package/payload/platform/services/claude-session-manager/dist/session-sidecar.d.ts

@@ -0,0 +1,91 @@
+import type { Logger, Role, Channel } from './types.js';
+export interface SessionSidecar {
+    senderId: string;
+    role: Role;
+    channel: Channel;
+    /** Operator-facing iframe URL from the `/remote-control is active` banner.
+     *  Null until url-capture matches; may stay null forever on headless
+     *  spawns (no banner) and on archived rows whose live PTY exited before
+     *  the URL landed. */
+    url: string | null;
+    /** ISO 8601 timestamp from `/spawn`. */
+    startedAt: string;
+    /** Spawn-requested permission mode (e.g. 'default', 'plan', etc.). Null
+     *  when not set. This field carries what the operator asked for at
+     *  spawn time. The binary's actual runtime mode lives in
+     *  `effectivePermissionMode` below. */
+    permissionMode: string | null;
+    /** Task 278 — binary's actual runtime permission mode, as observed via
+     *  the `--debug=auto-mode` capture in `<sessionId>.permission-mode.log`.
+     *  Null at spawn until the first `[auto-mode] verifyAutoModeGateAccess`
+     *  line resolves. Stays null forever on non-auto spawns (no signal
+     *  source for `acceptEdits` / `plan` / `bypassPermissions` on 2.1.150).
+     *  When non-null and `!== permissionMode`, the SessionMetadataPane
+     *  renders a downgrade warning. */
+    effectivePermissionMode: string | null;
+    /** Spawn-requested model (e.g. 'claude-opus-4-7'). Null when not set.
+     *  Note: the wire's `model` field continues to derive from the JSONL
+     *  tail's last assistant turn — this sidecar field records the SPAWN
+     *  REQUEST, not the running model, and exists for self-diagnosis. */
+    model: string | null;
+    /** Hidden spawn — operator sidebar suppresses the row. Known at /spawn
+     *  body parse; never changes for a row's lifetime. */
+    hidden: boolean;
+    /** Specialist agent name from `/spawn` body or resolved agent at PTY
+     *  ready. Null for operator (non-specialist) spawns. */
+    specialist: string | null;
+    /** Task 451 — the systemd transient scope unit token under which this
+     *  PTY runs (unit name is `claude-session-<token>.scope`). Persisted on
+     *  disk so boot-seed can reattach a surviving scope to its row after
+     *  manager restart, even for fresh spawns where the unit token is a
+     *  random UUID that does not match claude's intrinsic sessionId. Null
+     *  on pre-Task-451 sidecars and on any non-scope spawn path. */
+    scopeUnitToken: string | null;
+    /** Task 550 — composer bridge ULIDs (suffix only, no "session_" prefix)
+     *  that have been bound to this conversation across its lifetime. Every
+     *  `/rc-spawn` resume against an existing JSONL learns a new bridge ULID
+     *  from the PID file once claude registers with the composer; the
+     *  http-server appends it here so a future composer-URL → row lookup is
+     *  a direct match. Defaults to `[]` on pre-Task-550 sidecars (missing
+     *  key). Append-only, duplicates suppressed. */
+    bridgeIds: string[];
+}
+export interface SidecarReadOutcome {
+    sidecar: SessionSidecar | null;
+    /** Why `sidecar` is null when null. Lets callers and the watcher's
+     *  boot-seed log line distinguish "no sidecar on disk" from "sidecar
+     *  unparseable" — both yield null fields on the row, but the latter
+     *  signals a write defect worth investigating. */
+    outcome: 'ok' | 'missing' | 'parse-failed';
+    /** File size in bytes when present; 0 otherwise. */
+    bytes: number;
+}
+/** Read a sidecar from disk. Returns `outcome: 'missing'` when the file
+ *  is absent; `outcome: 'parse-failed'` when it exists but cannot be
+ *  parsed as the expected shape. The caller (watcher row builder) stamps
+ *  null fields on the row in both cases and the boot-seed log line
+ *  surfaces the mismatch. */
+export declare function readSidecar(path: string, logger: Logger): SidecarReadOutcome;
+/** Write a sidecar atomically: tmp file in the same directory, then
+ *  rename. Throws if the directory cannot be created or the rename
+ *  fails — the spawn route translates this to a loud 500 rather than
+ *  launching a metadata-less PTY. */
+export declare function writeSidecar(path: string, sidecar: SessionSidecar, logger: Logger): void;
+/** Read-modify-write update. Returns true when the field was written;
+ *  false when the sidecar is missing or unparseable (caller may choose
+ *  to log; we don't write a fresh sidecar from a partial update because
+ *  the other fields would be invented). Single-writer assumption applies
+ *  — concurrent updates may race and lose the latest value. */
+export declare function updateSidecar(path: string, patch: Partial<SessionSidecar>, logger: Logger): boolean;
+/** Task 550 — append a bridge ULID suffix to `bridgeIds` on the sidecar.
+ *  Read-modify-write; the atomic rename pattern matches the rest of this
+ *  module. Returns `'ok'` when written, `'duplicate'` when the suffix was
+ *  already present (no write performed), and `'no-sidecar'` when the
+ *  sidecar is missing or unparseable (caller logs and skips — legacy
+ *  rows without a sidecar are out of scope per the task brief).
+ *  Single-writer assumption is shared with url-capture's updateSidecar:
+ *  both are read-modify-write and could race, but they touch disjoint
+ *  fields, so the rename-loses-write window is the existing limitation
+ *  rather than a new one. */
+export declare function appendBridgeId(path: string, bridgeSuffix: string, logger: Logger): 'ok' | 'duplicate' | 'no-sidecar';
+//# sourceMappingURL=session-sidecar.d.ts.map

package/payload/platform/services/claude-session-manager/dist/session-sidecar.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sidecar.d.ts","sourceRoot":"","sources":["../src/session-sidecar.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEvD,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;IAChB;;;0BAGsB;IACtB,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAA;IACjB;;;2CAGuC;IACvC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;;;;uCAMmC;IACnC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;IACtC;;;yEAGqE;IACrE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB;0DACsD;IACtD,MAAM,EAAE,OAAO,CAAA;IACf;4DACwD;IACxD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;;;oEAKgE;IAChE,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B;;;;;;oDAMgD;IAChD,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAA;IAC9B;;;sDAGkD;IAClD,OAAO,EAAE,IAAI,GAAG,SAAS,GAAG,cAAc,CAAA;IAC1C,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAA;CACd;AAMD;;;;6BAI6B;AAC7B,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,kBAAkB,CA+B5E;AAED;;;qCAGqC;AACrC,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAiBxF;AAED;;;;+DAI+D;AAC/D,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,OAAO,CAAC,cAAc,CAAC,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAmBT;AAED;;;;;;;;;6BAS6B;AAC7B,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,GACb,IAAI,GAAG,WAAW,GAAG,YAAY,CAmBnC"}

package/payload/platform/services/claude-session-manager/dist/session-sidecar.js

@@ -0,0 +1,232 @@
+// Spawn-metadata sidecar (Task 260). Disk is the only source of truth for
+// row metadata. The sidecar carries everything the manager learned at
+// `/spawn` time that the JSONL transcript itself does not record:
+// `senderId`, `role`, `channel`, `url`, `startedAt`, `permissionMode`,
+// `model`, `hidden`, `specialist`. The watcher reads it when building
+// rows; the http-server writes it on `/spawn`; url-capture updates the
+// `url` field once the `/remote-control` banner lands.
+//
+// Location: `<projectsDir>/<sessionId>.meta.json` for live rows;
+// `<projectsDir>/archive/<sessionId>.meta.json` for archived rows. The
+// pair (sidecar + JSONL) moves together on `/archive` and `/unarchive`.
+//
+// Atomic write: write to `<path>.tmp.<pid>.<ts>`, then `rename` to the
+// final path. POSIX guarantees rename atomicity on the same filesystem,
+// so a crash mid-write leaves the prior file (if any) intact; the tmp
+// file is the only leak, and a stale `.tmp.*` is harmless because the
+// watcher and route code only read the canonical path.
+//
+// Single-writer pattern. Only two write sites exist today: the spawn
+// route (one `writeSidecar` per `/spawn`) and url-capture (one
+// `updateSidecar({url})` per session). No concurrent writers race; a
+// future caller that adds a third writer must reason about the
+// read-modify-write window in `updateSidecar`.
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+function shortId(sessionId) {
+    return sessionId.slice(0, 8);
+}
+/** Read a sidecar from disk. Returns `outcome: 'missing'` when the file
+ *  is absent; `outcome: 'parse-failed'` when it exists but cannot be
+ *  parsed as the expected shape. The caller (watcher row builder) stamps
+ *  null fields on the row in both cases and the boot-seed log line
+ *  surfaces the mismatch. */
+export function readSidecar(path, logger) {
+    if (!existsSync(path)) {
+        logger(`[session-sidecar] read sessionId=${basenameShort(path)} outcome=missing bytes=0`);
+        return { sidecar: null, outcome: 'missing', bytes: 0 };
+    }
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        logger(`[session-sidecar] read sessionId=${basenameShort(path)} outcome=parse-failed bytes=0`);
+        return { sidecar: null, outcome: 'parse-failed', bytes: 0 };
+    }
+    const bytes = Buffer.byteLength(raw, 'utf8');
+    if (raw.length === 0) {
+        logger(`[session-sidecar] read sessionId=${basenameShort(path)} outcome=parse-failed bytes=0`);
+        return { sidecar: null, outcome: 'parse-failed', bytes: 0 };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        logger(`[session-sidecar] read sessionId=${basenameShort(path)} outcome=parse-failed bytes=${bytes}`);
+        return { sidecar: null, outcome: 'parse-failed', bytes };
+    }
+    const sidecar = parseSidecar(parsed);
+    if (!sidecar) {
+        logger(`[session-sidecar] read sessionId=${basenameShort(path)} outcome=parse-failed bytes=${bytes}`);
+        return { sidecar: null, outcome: 'parse-failed', bytes };
+    }
+    logger(`[session-sidecar] read sessionId=${basenameShort(path)} outcome=ok bytes=${bytes}`);
+    return { sidecar, outcome: 'ok', bytes };
+}
+/** Write a sidecar atomically: tmp file in the same directory, then
+ *  rename. Throws if the directory cannot be created or the rename
+ *  fails — the spawn route translates this to a loud 500 rather than
+ *  launching a metadata-less PTY. */
+export function writeSidecar(path, sidecar, logger) {
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true });
+    const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+    const json = JSON.stringify(sidecar, null, 2);
+    const bytes = Buffer.byteLength(json, 'utf8');
+    try {
+        writeFileSync(tmp, json, 'utf8');
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        // Best-effort tmp cleanup; the throw still propagates.
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+    logger(`[session-sidecar] write sessionId=${basenameShort(path)} senderId=${shortId(sidecar.senderId)} role=${sidecar.role} channel=${sidecar.channel} bytes=${bytes} path=${path}`);
+}
+/** Read-modify-write update. Returns true when the field was written;
+ *  false when the sidecar is missing or unparseable (caller may choose
+ *  to log; we don't write a fresh sidecar from a partial update because
+ *  the other fields would be invented). Single-writer assumption applies
+ *  — concurrent updates may race and lose the latest value. */
+export function updateSidecar(path, patch, logger) {
+    const { sidecar } = readSidecar(path, logger);
+    if (!sidecar)
+        return false;
+    const next = { ...sidecar, ...patch };
+    const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+    const json = JSON.stringify(next, null, 2);
+    const bytes = Buffer.byteLength(json, 'utf8');
+    try {
+        writeFileSync(tmp, json, 'utf8');
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+    for (const [k, v] of Object.entries(patch)) {
+        const display = v === null ? 'null' : typeof v === 'string' ? v : String(v);
+        logger(`[session-sidecar] update sessionId=${basenameShort(path)} field=${k} value=${display} bytes=${bytes}`);
+    }
+    return true;
+}
+/** Task 550 — append a bridge ULID suffix to `bridgeIds` on the sidecar.
+ *  Read-modify-write; the atomic rename pattern matches the rest of this
+ *  module. Returns `'ok'` when written, `'duplicate'` when the suffix was
+ *  already present (no write performed), and `'no-sidecar'` when the
+ *  sidecar is missing or unparseable (caller logs and skips — legacy
+ *  rows without a sidecar are out of scope per the task brief).
+ *  Single-writer assumption is shared with url-capture's updateSidecar:
+ *  both are read-modify-write and could race, but they touch disjoint
+ *  fields, so the rename-loses-write window is the existing limitation
+ *  rather than a new one. */
+export function appendBridgeId(path, bridgeSuffix, logger) {
+    const { sidecar } = readSidecar(path, logger);
+    if (!sidecar)
+        return 'no-sidecar';
+    if (sidecar.bridgeIds.includes(bridgeSuffix))
+        return 'duplicate';
+    const next = { ...sidecar, bridgeIds: [...sidecar.bridgeIds, bridgeSuffix] };
+    const tmp = `${path}.tmp.${process.pid}.${Date.now()}`;
+    const json = JSON.stringify(next, null, 2);
+    const bytes = Buffer.byteLength(json, 'utf8');
+    try {
+        writeFileSync(tmp, json, 'utf8');
+        renameSync(tmp, path);
+    }
+    catch (err) {
+        try {
+            if (existsSync(tmp))
+                unlinkSync(tmp);
+        }
+        catch { /* ignore */ }
+        throw err;
+    }
+    logger(`[session-sidecar] append-bridge sessionId=${basenameShort(path)} bridgeId=${bridgeSuffix} count=${next.bridgeIds.length} bytes=${bytes}`);
+    return 'ok';
+}
+const ROLES = ['admin', 'public'];
+const CHANNELS = ['browser', 'whatsapp', 'telegram', 'webchat', 'email'];
+function parseSidecar(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    if (typeof r.senderId !== 'string' || r.senderId.length === 0)
+        return null;
+    if (typeof r.role !== 'string' || !ROLES.includes(r.role))
+        return null;
+    if (typeof r.channel !== 'string' || !CHANNELS.includes(r.channel))
+        return null;
+    if (typeof r.startedAt !== 'string' || r.startedAt.length === 0)
+        return null;
+    if (typeof r.hidden !== 'boolean')
+        return null;
+    const url = r.url === null ? null : typeof r.url === 'string' ? r.url : undefined;
+    if (url === undefined)
+        return null;
+    const permissionMode = r.permissionMode === null ? null : typeof r.permissionMode === 'string' ? r.permissionMode : undefined;
+    if (permissionMode === undefined)
+        return null;
+    // Task 278 — `effectivePermissionMode` is optional on disk so pre-278
+    // sidecars (no key) load with null. Missing key, JSON null, and
+    // unparseable shape all collapse to null; the field is purely
+    // observational and a missing one is the pre-existing behaviour.
+    const effectivePermissionMode = r.effectivePermissionMode === undefined || r.effectivePermissionMode === null
+        ? null
+        : typeof r.effectivePermissionMode === 'string'
+            ? r.effectivePermissionMode
+            : null;
+    const model = r.model === null ? null : typeof r.model === 'string' ? r.model : undefined;
+    if (model === undefined)
+        return null;
+    const specialist = r.specialist === null ? null : typeof r.specialist === 'string' ? r.specialist : undefined;
+    if (specialist === undefined)
+        return null;
+    // Task 451 — `scopeUnitToken` is optional on disk so pre-451 sidecars
+    // (no key) load with null. Missing key, JSON null, and unparseable shape
+    // all collapse to null; boot-seed treats null as "no reattach hint" and
+    // falls through to the sessionId-direct path or orphan classification.
+    const scopeUnitToken = r.scopeUnitToken === undefined || r.scopeUnitToken === null
+        ? null
+        : typeof r.scopeUnitToken === 'string'
+            ? r.scopeUnitToken
+            : null;
+    // Task 550 — `bridgeIds` is optional on disk so pre-550 sidecars (no key)
+    // load with `[]`. Non-string entries are dropped silently; the file may
+    // have been hand-edited or pre-dates the strict-string contract.
+    const bridgeIds = Array.isArray(r.bridgeIds)
+        ? r.bridgeIds.filter((b) => typeof b === 'string' && b.length > 0)
+        : [];
+    return {
+        senderId: r.senderId,
+        role: r.role,
+        channel: r.channel,
+        url,
+        startedAt: r.startedAt,
+        permissionMode,
+        effectivePermissionMode,
+        model,
+        hidden: r.hidden,
+        specialist,
+        scopeUnitToken,
+        bridgeIds,
+    };
+}
+function basenameShort(path) {
+    const idx = path.lastIndexOf('/');
+    const name = idx === -1 ? path : path.slice(idx + 1);
+    const sid = name.replace(/\.meta\.json$/, '');
+    return shortId(sid);
+}
+//# sourceMappingURL=session-sidecar.js.map

package/payload/platform/services/claude-session-manager/dist/session-sidecar.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sidecar.js","sourceRoot":"","sources":["../src/session-sidecar.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,sEAAsE;AACtE,kEAAkE;AAClE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,uDAAuD;AACvD,EAAE;AACF,iEAAiE;AACjE,uEAAuE;AACvE,wEAAwE;AACxE,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,uDAAuD;AACvD,EAAE;AACF,qEAAqE;AACrE,+DAA+D;AAC/D,qEAAqE;AACrE,+DAA+D;AAC/D,+CAA+C;AAE/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkEnC,SAAS,OAAO,CAAC,SAAiB;IAChC,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9B,CAAC;AAED;;;;6BAI6B;AAC7B,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;QACzF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IACxD,CAAC;IACD,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAA;QAC9F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,CAAA;IAC7D,CAAC;IACD,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;QACrG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAA;QACrG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,CAAA;IAC1D,CAAC;IACD,MAAM,CAAC,oCAAoC,aAAa,CAAC,IAAI,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAA;IAC3F,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;AAC1C,CAAC;AAED;;;qCAGqC;AACrC,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAuB,EAAE,MAAc;IAChF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,uDAAuD;QACvD,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,CACJ,qCAAqC,aAAa,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,OAAO,CAAC,IAAI,YAAY,OAAO,CAAC,OAAO,UAAU,KAAK,SAAS,IAAI,EAAE,CAC7K,CAAA;AACH,CAAC;AAED;;;;+DAI+D;AAC/D,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,KAA8B,EAC9B,MAAc;IAEd,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAC1B,MAAM,IAAI,GAAmB,EAAE,GAAG,OAAO,EAAE,GAAG,KAAK,EAAE,CAAA;IACrD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAC,sCAAsC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,OAAO,UAAU,KAAK,EAAE,CAAC,CAAA;IAChH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;6BAS6B;AAC7B,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,YAAoB,EACpB,MAAc;IAEd,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,YAAY,CAAA;IACjC,IAAI,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,WAAW,CAAA;IAChE,MAAM,IAAI,GAAmB,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,GAAG,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,EAAE,CAAA;IAC5F,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;QAChC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,IAAI,UAAU,CAAC,GAAG,CAAC;gBAAE,UAAU,CAAC,GAAG,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;QACnE,MAAM,GAAG,CAAA;IACX,CAAC;IACD,MAAM,CACJ,6CAA6C,aAAa,CAAC,IAAI,CAAC,aAAa,YAAY,UAAU,IAAI,CAAC,SAAS,CAAC,MAAM,UAAU,KAAK,EAAE,CAC1I,CAAA;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,KAAK,GAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;AACtD,MAAM,QAAQ,GAA2B,CAAC,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;AAEhG,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,CAAC,GAAG,GAA8B,CAAA;IACxC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1E,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAY,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9E,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAkB,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1F,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5E,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;IACjF,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAClC,MAAM,cAAc,GAClB,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAA;IACxG,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC7C,sEAAsE;IACtE,gEAAgE;IAChE,8DAA8D;IAC9D,iEAAiE;IACjE,MAAM,uBAAuB,GAC3B,CAAC,CAAC,uBAAuB,KAAK,SAAS,IAAI,CAAC,CAAC,uBAAuB,KAAK,IAAI;QAC3E,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,CAAC,CAAC,uBAAuB,KAAK,QAAQ;YAC7C,CAAC,CAAC,CAAC,CAAC,uBAAuB;YAC3B,CAAC,CAAC,IAAI,CAAA;IACZ,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IACzF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,UAAU,GACd,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5F,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACzC,sEAAsE;IACtE,yEAAyE;IACzE,wEAAwE;IACxE,uEAAuE;IACvE,MAAM,cAAc,GAClB,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI;QACzD,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ;YACpC,CAAC,CAAC,CAAC,CAAC,cAAc;YAClB,CAAC,CAAC,IAAI,CAAA;IACZ,0EAA0E;IAC1E,wEAAwE;IACxE,iEAAiE;IACjE,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1C,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAA;IACN,OAAO;QACL,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,IAAI,EAAE,CAAC,CAAC,IAAY;QACpB,OAAO,EAAE,CAAC,CAAC,OAAkB;QAC7B,GAAG;QACH,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,cAAc;QACd,uBAAuB;QACvB,KAAK;QACL,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU;QACV,cAAc;QACd,SAAS;KACV,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAA;IACpD,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAA;IAC7C,OAAO,OAAO,CAAC,GAAG,CAAC,CAAA;AACrB,CAAC"}

package/payload/platform/services/claude-session-manager/dist/session-store.d.ts

@@ -0,0 +1,49 @@
+import type { PtyHandle, Role, Channel } from './types.js';
+export interface StoredSession {
+    /** Intrinsic Claude session id (UUID). Stable for the row's lifetime.
+     *  For `/resume` spawns this is the prior canonical id the operator
+     *  pressed Resume on. After Task 258's archive-restore at /resume,
+     *  claude --resume appends to the same canonical jsonl, so the
+     *  StoredSession.sessionId and the on-disk jsonl basename match by
+     *  construction. */
+    sessionId: string;
+    /** "session_<suffix>" form from the PID file. Stable, never null after
+     *  /spawn returns (the spawn promise resolves on PID-file event). */
+    bridgeSessionId: string;
+    /** Suffix-only convenience field (no "session_" prefix). */
+    bridgeSuffix: string;
+    pid: number;
+    /** URL from the `/remote-control` banner. Null until url-capture fires;
+     *  may stay null forever if the banner never lands. The UI tolerates
+     *  null. */
+    url: string | null;
+    startedAt: string;
+    senderId: string;
+    role: Role;
+    channel: Channel;
+    pty: PtyHandle;
+    exited: boolean;
+    /** Task 176 — flipped true when `releasePtyMasterFd` returns
+     *  `master-fd=closed` for this session. Both exit branches set this so
+     *  the second branch (whichever loses the race) can skip a redundant
+     *  `pty.destroy()` that would otherwise throw "socket already
+     *  destroyed" on real node-pty and turn the operator-request log
+     *  line's `master-fd=closed` into a false `master-fd=close-failed`.
+     *  When the first branch's destroy throws (rescued), this stays false
+     *  so the second branch retries — defense in depth. */
+    fdReleased: boolean;
+    hidden: boolean;
+    specialist: string | null;
+}
+export declare class SessionStore {
+    private readonly bySessionId;
+    add(s: StoredSession): void;
+    get(sessionId: string): StoredSession | undefined;
+    remove(sessionId: string): StoredSession | undefined;
+    listBySender(senderId: string, opts?: {
+        includeHidden?: boolean;
+    }): StoredSession[];
+    all(): StoredSession[];
+    size(): number;
+}
+//# sourceMappingURL=session-store.d.ts.map

package/payload/platform/services/claude-session-manager/dist/session-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE1D,MAAM,WAAW,aAAa;IAC5B;;;;;wBAKoB;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB;yEACqE;IACrE,eAAe,EAAE,MAAM,CAAA;IACvB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,EAAE,MAAM,CAAA;IACX;;gBAEY;IACZ,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,CAAA;IACV,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,SAAS,CAAA;IACd,MAAM,EAAE,OAAO,CAAA;IACf;;;;;;;2DAOuD;IACvD,UAAU,EAAE,OAAO,CAAA;IACnB,MAAM,EAAE,OAAO,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmC;IAE/D,GAAG,CAAC,CAAC,EAAE,aAAa,GAAG,IAAI;IAI3B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIjD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAOpD,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,aAAa,EAAE;IAWvF,GAAG,IAAI,aAAa,EAAE;IAItB,IAAI,IAAI,MAAM;CAGf"}

package/payload/platform/services/claude-session-manager/dist/session-store.js

@@ -0,0 +1,52 @@
+// In-memory PTY-handle store. The canonical row index lives in the
+// fs-watcher; row state is derived from disk on demand (Task 258). This
+// store only tracks the live PTY handles the manager itself spawned —
+// they aren't on disk. Lookups by alternative identifiers (bridgeSuffix,
+// pid, bridgeSessionId) go through the watcher first to resolve to the
+// canonical sessionId; the store is then keyed solely on sessionId.
+//
+// Lifecycle:
+//   - pty-spawner awaits the PID-file CREATE event from the watcher
+//     before returning a /spawn response. The store row is registered at
+//     that point with sessionId known and bridgeSessionId carried from
+//     the PID file. By the time /spawn returns, sessionId is final.
+//   - URL capture continues in parallel; the row's `url` field is
+//     mutated in place when the URL banner fires (may arrive before or
+//     after the PID-file event; both orderings are safe).
+//   - The jsonl path is derived from sessionId + spawnCwd at every read
+//     site — never stored. Task 258 deleted the stored field.
+export class SessionStore {
+    bySessionId = new Map();
+    add(s) {
+        this.bySessionId.set(s.sessionId, s);
+    }
+    get(sessionId) {
+        return this.bySessionId.get(sessionId);
+    }
+    remove(sessionId) {
+        const s = this.bySessionId.get(sessionId);
+        if (!s)
+            return undefined;
+        this.bySessionId.delete(sessionId);
+        return s;
+    }
+    listBySender(senderId, opts = {}) {
+        const includeHidden = opts.includeHidden === true;
+        const out = [];
+        for (const s of this.bySessionId.values()) {
+            if (s.senderId !== senderId)
+                continue;
+            if (!includeHidden && s.hidden)
+                continue;
+            out.push(s);
+        }
+        return out;
+    }
+    all() {
+        return [...this.bySessionId.values()];
+    }
+    size() {
+        return this.bySessionId.size;
+    }
+}
+//# sourceMappingURL=session-store.js.map

package/payload/platform/services/claude-session-manager/dist/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../src/session-store.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,EAAE;AACF,aAAa;AACb,oEAAoE;AACpE,yEAAyE;AACzE,uEAAuE;AACvE,oEAAoE;AACpE,kEAAkE;AAClE,uEAAuE;AACvE,0DAA0D;AAC1D,wEAAwE;AACxE,8DAA8D;AAyC9D,MAAM,OAAO,YAAY;IACN,WAAW,GAAG,IAAI,GAAG,EAAyB,CAAA;IAE/D,GAAG,CAAC,CAAgB;QAClB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAA;IACtC,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAA;QACxB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAClC,OAAO,CAAC,CAAA;IACV,CAAC;IAED,YAAY,CAAC,QAAgB,EAAE,OAAoC,EAAE;QACnE,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,KAAK,IAAI,CAAA;QACjD,MAAM,GAAG,GAAoB,EAAE,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBAAE,SAAQ;YACrC,IAAI,CAAC,aAAa,IAAI,CAAC,CAAC,MAAM;gBAAE,SAAQ;YACxC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACb,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,GAAG;QACD,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,CAAA;IACvC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,IAAI,CAAA;IAC9B,CAAC;CACF"}

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.d.ts

@@ -0,0 +1,28 @@
+import type { Channel } from './types.js';
+export interface BucketLimit {
+    cap: number;
+    windowMs: number;
+}
+export interface PublicSpawnLimits {
+    /** Per-(senderId, channel) bucket. Required: every channel has a cap. */
+    perChannel: Record<Channel, BucketLimit>;
+    /** Cross-channel bucket keyed on senderId alone. */
+    global: BucketLimit;
+}
+export type AdmitDecision = {
+    admitted: true;
+} | {
+    admitted: false;
+    scope: 'channel' | 'global';
+    cap: number;
+    windowMs: number;
+};
+export interface RateLimiter {
+    /** Try to admit one spawn. Mutates state on `admitted: true`. */
+    admit(senderId: string, channel: Channel, now?: number): AdmitDecision;
+    /** Test-only: clear all buckets. */
+    reset(): void;
+}
+export declare function createSpawnRateLimiter(limits: PublicSpawnLimits): RateLimiter;
+export declare const DEFAULT_PUBLIC_SPAWN_LIMITS: PublicSpawnLimits;
+//# sourceMappingURL=spawn-rate-limiter.d.ts.map

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-rate-limiter.d.ts","sourceRoot":"","sources":["../src/spawn-rate-limiter.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEzC,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,yEAAyE;IACzE,UAAU,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACxC,oDAAoD;IACpD,MAAM,EAAE,WAAW,CAAA;CACpB;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,GAClB;IAAE,QAAQ,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAA;AASnF,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,aAAa,CAAA;IACtE,oCAAoC;IACpC,KAAK,IAAI,IAAI,CAAA;CACd;AASD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAiD7E;AAED,eAAO,MAAM,2BAA2B,EAAE,iBAYzC,CAAA"}

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.js

@@ -0,0 +1,77 @@
+// in-memory leaky-bucket throttle for `POST /spawn role=public`.
+//
+// Two buckets fire on each admit attempt: one keyed `(senderId, channel)` to
+// stop a single sender from flooding one channel, and one keyed `senderId`
+// alone to stop the same sender from working around the per-channel cap by
+// rotating channels. First bucket to trip wins; `scope` in the result names
+// which one so the 429 body and log line can tell them apart.
+//
+// Out of scope (per task): persistence across manager restarts, cross-process
+// coordination. Restarts wipe the buckets; the manager is single-process per
+// brand on the Pi.
+function evict(stamps, cutoff) {
+    // Stamps are pushed in monotonic order; drop the prefix older than cutoff.
+    let i = 0;
+    while (i < stamps.length && stamps[i] <= cutoff)
+        i++;
+    return i === 0 ? stamps : stamps.slice(i);
+}
+export function createSpawnRateLimiter(limits) {
+    const state = {
+        byChannel: new Map(),
+        byGlobal: new Map(),
+    };
+    return {
+        admit(senderId, channel, now = Date.now()) {
+            const channelLimit = limits.perChannel[channel];
+            const channelKey = `${senderId}|${channel}`;
+            const channelCutoff = now - channelLimit.windowMs;
+            const channelStamps = evict(state.byChannel.get(channelKey) ?? [], channelCutoff);
+            if (channelStamps.length >= channelLimit.cap) {
+                // Persist the eviction so the map doesn't accumulate stale entries.
+                state.byChannel.set(channelKey, channelStamps);
+                return {
+                    admitted: false,
+                    scope: 'channel',
+                    cap: channelLimit.cap,
+                    windowMs: channelLimit.windowMs,
+                };
+            }
+            const globalCutoff = now - limits.global.windowMs;
+            const globalStamps = evict(state.byGlobal.get(senderId) ?? [], globalCutoff);
+            if (globalStamps.length >= limits.global.cap) {
+                state.byChannel.set(channelKey, channelStamps);
+                state.byGlobal.set(senderId, globalStamps);
+                return {
+                    admitted: false,
+                    scope: 'global',
+                    cap: limits.global.cap,
+                    windowMs: limits.global.windowMs,
+                };
+            }
+            channelStamps.push(now);
+            globalStamps.push(now);
+            state.byChannel.set(channelKey, channelStamps);
+            state.byGlobal.set(senderId, globalStamps);
+            return { admitted: true };
+        },
+        reset() {
+            state.byChannel.clear();
+            state.byGlobal.clear();
+        },
+    };
+}
+export const DEFAULT_PUBLIC_SPAWN_LIMITS = {
+    // Conservative defaults: 10 spawns / minute per channel; 30 / minute global.
+    // Operators override via brand.json or env. verification fires the
+    // per-channel cap (11 calls, same senderId+channel).
+    perChannel: {
+        browser: { cap: 10, windowMs: 60_000 },
+        whatsapp: { cap: 10, windowMs: 60_000 },
+        telegram: { cap: 10, windowMs: 60_000 },
+        webchat: { cap: 10, windowMs: 60_000 },
+        email: { cap: 10, windowMs: 60_000 },
+    },
+    global: { cap: 30, windowMs: 60_000 },
+};
+//# sourceMappingURL=spawn-rate-limiter.js.map

package/payload/platform/services/claude-session-manager/dist/spawn-rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spawn-rate-limiter.js","sourceRoot":"","sources":["../src/spawn-rate-limiter.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,2EAA2E;AAC3E,4EAA4E;AAC5E,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,6EAA6E;AAC7E,mBAAmB;AAkCnB,SAAS,KAAK,CAAC,MAAgB,EAAE,MAAc;IAC7C,2EAA2E;IAC3E,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM;QAAE,CAAC,EAAE,CAAA;IACpD,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAyB;IAC9D,MAAM,KAAK,GAAkB;QAC3B,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,QAAQ,EAAE,IAAI,GAAG,EAAE;KACpB,CAAA;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YACvC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;YAC/C,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAA;YAC3C,MAAM,aAAa,GAAG,GAAG,GAAG,YAAY,CAAC,QAAQ,CAAA;YACjD,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAA;YAEjF,IAAI,aAAa,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,EAAE,CAAC;gBAC7C,oEAAoE;gBACpE,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;gBAC9C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,SAAS;oBAChB,GAAG,EAAE,YAAY,CAAC,GAAG;oBACrB,QAAQ,EAAE,YAAY,CAAC,QAAQ;iBAChC,CAAA;YACH,CAAC;YAED,MAAM,YAAY,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAA;YACjD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,YAAY,CAAC,CAAA;YAE5E,IAAI,YAAY,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAC7C,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;gBAC9C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;gBAC1C,OAAO;oBACL,QAAQ,EAAE,KAAK;oBACf,KAAK,EAAE,QAAQ;oBACf,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG;oBACtB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ;iBACjC,CAAA;YACH,CAAC;YAED,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvB,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACtB,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;YAC9C,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAA;YAC1C,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAA;QAC3B,CAAC;QACD,KAAK;YACH,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAA;YACvB,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;QACxB,CAAC;KACF,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,2BAA2B,GAAsB;IAC5D,6EAA6E;IAC7E,mEAAmE;IACnE,qDAAqD;IACrD,UAAU,EAAE;QACV,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACtC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACvC,QAAQ,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACvC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;QACtC,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;KACrC;IACD,MAAM,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;CACtC,CAAA"}

package/payload/platform/services/claude-session-manager/dist/specialist-drift.d.ts

@@ -0,0 +1,60 @@
+import type { ToolSurface } from './tool-surface.js';
+/** Claude Code-native tools an agent can call without any MCP server.
+ *  Listed exhaustively rather than guessed — a new CC-native tool added
+ *  upstream forces an explicit ledger update here. Exported so the admin
+ *  operator spawn can union this set into its `--allowed-tools` argv at
+ *  spawn time; Task 579 — without that union, the admin's explicit
+ *  plugin-tool allowlist silently excluded built-in `LS` / `Glob` and
+ *  the seat could not enumerate its own disk. */
+export declare const CC_NATIVE_TOOLS: Set<string>;
+export interface SpecialistDriftDefect {
+    specialistPath: string;
+    specialistName: string;
+    tool: string;
+    reason: 'unknown-plugin-namespace' | 'unknown-tool-in-plugin' | 'malformed-name' | 'brand-excluded-plugin';
+}
+export interface SpecialistDriftResult {
+    /** True when no defect refuses boot. `brand-excluded-plugin` defects do
+     *  not refuse boot — they populate `stripList` and the manager removes
+     *  those tools from the specialist's allowlist at spawn time. Any other
+     *  defect class makes this false. */
+    ok: boolean;
+    /** Defects found, by specialist file. Includes brand-excluded entries
+     *  even though they do not refuse boot — they are the audit trail for
+     *  what the strip-list took out. */
+    defects: SpecialistDriftDefect[];
+    /** Total specialist `.md` files inspected (those with a `tools:` line). */
+    inspected: number;
+    /** Per-specialist set of tool names to remove from `--allowed-tools` at
+     *  spawn time. Keyed by specialist name (the `.md` basename without the
+     *  extension). Populated exclusively by `brand-excluded-plugin` defects;
+     *  any other defect class refuses boot and the manager never reaches a
+     *  spawn that would consult this map. */
+    stripList: ReadonlyMap<string, ReadonlySet<string>>;
+    /** Per-specialist resolved tool surface — keyed by specialist name (the
+     *  `.md` basename), value is the sorted set of tool names declared on the
+     *  specialist's `tools:` line (before any strip-list removal). Populated
+     *  for every specialist with a `tools:` line, regardless of drift outcome.
+     *  Consumed by the manager-boot `[specialist-surface]` standing log so a
+     *  payload-twin or bundle drift that drops a tool from a specialist's
+     *  resolved surface is greppable from server.log without re-running a
+     *  failing brief (Task 565 observability item 1). */
+    surfaces: ReadonlyMap<string, ReadonlySet<string>>;
+}
+/** Extract the value of the `tools:` line from a YAML frontmatter block.
+ *  Returns the raw value (whitespace-trimmed) or null when no `tools:`
+ *  key appears. The value is the comma-separated tool list Claude Code
+ *  resolves; this module is the single parser of that grammar. */
+export declare function parseSpecialistToolsLine(frontmatter: string): string | null;
+/** Walk one or more directories, classify every specialist `.md` file's
+ *  `tools:` frontmatter, and return drift defects.
+ *
+ *  `excludedPlugins` carries the brand's `plugins.excluded` set (the
+ *  plugin directory names brand.json excludes from this bundle). A tool
+ *  whose namespace appears in that set is classified as
+ *  `brand-excluded-plugin`: it does not refuse boot and lands in
+ *  `stripList` for the spawn path to remove from `--allowed-tools`.
+ *  Defaulted to the empty set so call-sites that don't know about brand
+ *  exclusions keep the legacy strict-boot semantics. */
+export declare function assertSpecialistDrift(agentDirs: readonly string[], toolSurface: ToolSurface, excludedPlugins?: ReadonlySet<string>): SpecialistDriftResult;
+//# sourceMappingURL=specialist-drift.d.ts.map

package/payload/platform/services/claude-session-manager/dist/specialist-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"specialist-drift.d.ts","sourceRoot":"","sources":["../src/specialist-drift.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAGpD;;;;;;iDAMiD;AACjD,eAAO,MAAM,eAAe,aAmB1B,CAAA;AAiBF,MAAM,WAAW,qBAAqB;IACpC,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EACF,0BAA0B,GAC1B,wBAAwB,GACxB,gBAAgB,GAChB,uBAAuB,CAAA;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC;;;yCAGqC;IACrC,EAAE,EAAE,OAAO,CAAA;IACX;;wCAEoC;IACpC,OAAO,EAAE,qBAAqB,EAAE,CAAA;IAChC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAA;IACjB;;;;6CAIyC;IACzC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;IACnD;;;;;;;yDAOqD;IACrD,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;CACnD;AAED;;;kEAGkE;AAClE,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI3E;AA+CD;;;;;;;;;wDASwD;AACxD,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,WAAW,EAAE,WAAW,EACxB,eAAe,GAAE,WAAW,CAAC,MAAM,CAAa,GAC/C,qBAAqB,CAmDvB"}