@wrongstack/core 0.302.0 → 0.302.2

package/dist/session-catalog/project-server.js

@@ -0,0 +1,1838 @@
+#!/usr/bin/env node
+
+// src/session-catalog/project-server.ts
+import { randomBytes as randomBytes2, randomUUID as randomUUID2 } from "node:crypto";
+import * as fs3 from "node:fs";
+import * as fsp from "node:fs/promises";
+import * as net from "node:net";
+import * as path3 from "node:path";
+
+// src/security/file-permissions.ts
+import { chmod } from "node:fs/promises";
+var SECRET_FILE_MODE = 384;
+async function restrictFilePermissions(filePath, opts) {
+  const label = opts?.label ?? "file-permissions";
+  const warn = opts?.warn ?? ((msg) => console.warn(msg));
+  if (process.platform === "win32") {
+    try {
+      const { execFile } = await import("node:child_process");
+      const { promisify } = await import("node:util");
+      const execFileAsync = promisify(execFile);
+      const user = windowsAccountName();
+      if (!user) {
+        warn(
+          `[${label}] Could not determine the current Windows user for ${filePath}; skipping icacls hardening.`
+        );
+        return;
+      }
+      await execFileAsync("icacls", [filePath, "/inheritance:r", "/grant:r", `${user}:(F)`], {
+        windowsHide: true
+      });
+    } catch {
+      warn(
+        `[${label}] Could not restrict permissions on ${filePath} \u2014 it may be readable by other users on this system.`
+      );
+    }
+  } else {
+    try {
+      await chmod(filePath, SECRET_FILE_MODE);
+    } catch {
+    }
+  }
+}
+function windowsAccountName() {
+  const username = process.env.USERNAME || process.env.USER;
+  if (!username || username.includes("\0")) return void 0;
+  const domain = process.env.USERDOMAIN;
+  if (domain && !domain.includes("\0")) return `${domain}\\${username}`;
+  return username;
+}
+
+// src/utils/atomic-write.ts
+import {
+  createPersistencePrimitives
+} from "@wrongstack/persistence";
+
+// src/types/errors.ts
+var ERROR_CODES = {
+  // Provider
+  PROVIDER_RATE_LIMITED: "PROVIDER_RATE_LIMITED",
+  PROVIDER_AUTH_FAILED: "PROVIDER_AUTH_FAILED",
+  PROVIDER_OVERLOADED: "PROVIDER_OVERLOADED",
+  PROVIDER_INVALID_REQUEST: "PROVIDER_INVALID_REQUEST",
+  PROVIDER_SERVER_ERROR: "PROVIDER_SERVER_ERROR",
+  PROVIDER_NETWORK_ERROR: "PROVIDER_NETWORK_ERROR",
+  PROVIDER_CONTEXT_OVERFLOW: "PROVIDER_CONTEXT_OVERFLOW",
+  // Tool
+  TOOL_NOT_FOUND: "TOOL_NOT_FOUND",
+  TOOL_PERMISSION_DENIED: "TOOL_PERMISSION_DENIED",
+  TOOL_EXECUTION_FAILED: "TOOL_EXECUTION_FAILED",
+  TOOL_TIMEOUT: "TOOL_TIMEOUT",
+  TOOL_INPUT_INVALID: "TOOL_INPUT_INVALID",
+  // Config
+  CONFIG_INVALID: "CONFIG_INVALID",
+  CONFIG_NOT_FOUND: "CONFIG_NOT_FOUND",
+  CONFIG_PARSE_FAILED: "CONFIG_PARSE_FAILED",
+  CONFIG_MIGRATION_NEEDED: "CONFIG_MIGRATION_NEEDED",
+  // Plugin
+  PLUGIN_LOAD_FAILED: "PLUGIN_LOAD_FAILED",
+  PLUGIN_API_MISMATCH: "PLUGIN_API_MISMATCH",
+  PLUGIN_MISSING_DEPENDENCY: "PLUGIN_MISSING_DEPENDENCY",
+  // Agent
+  AGENT_ITERATION_LIMIT: "AGENT_ITERATION_LIMIT",
+  AGENT_CONTEXT_OVERFLOW: "AGENT_CONTEXT_OVERFLOW",
+  AGENT_ABORTED: "AGENT_ABORTED",
+  AGENT_RUN_FAILED: "AGENT_RUN_FAILED",
+  // Session
+  SESSION_NOT_FOUND: "SESSION_NOT_FOUND",
+  SESSION_CORRUPTED: "SESSION_CORRUPTED",
+  SESSION_WRITE_FAILED: "SESSION_WRITE_FAILED",
+  // Container / Registry
+  CONTAINER_TOKEN_ALREADY_BOUND: "CONTAINER_TOKEN_ALREADY_BOUND",
+  CONTAINER_TOKEN_NOT_BOUND: "CONTAINER_TOKEN_NOT_BOUND",
+  CONTAINER_CIRCULAR_DEPENDENCY: "CONTAINER_CIRCULAR_DEPENDENCY",
+  REGISTRY_DUPLICATE: "REGISTRY_DUPLICATE",
+  REGISTRY_NOT_FOUND: "REGISTRY_NOT_FOUND",
+  REGISTRY_INVALID: "REGISTRY_INVALID",
+  // File system
+  FS_READ_FAILED: "FS_READ_FAILED",
+  FS_WRITE_FAILED: "FS_WRITE_FAILED",
+  FS_MKDIR_FAILED: "FS_MKDIR_FAILED",
+  FS_DELETE_FAILED: "FS_DELETE_FAILED",
+  FS_ATOMIC_WRITE_FAILED: "FS_ATOMIC_WRITE_FAILED",
+  // SDD (Spec-Driven Development)
+  SDD_VALIDATION_FAILED: "SDD_VALIDATION_FAILED",
+  SDD_PARSE_FAILED: "SDD_PARSE_FAILED",
+  SDD_INVALID_STATE: "SDD_INVALID_STATE",
+  SDD_NOT_READY: "SDD_NOT_READY",
+  // General
+  VALIDATION_ERROR: "VALIDATION_ERROR",
+  PARSE_FAILED: "PARSE_FAILED",
+  UNKNOWN: "UNKNOWN"
+};
+var WrongStackError = class extends Error {
+  code;
+  subsystem;
+  severity;
+  recoverable;
+  context;
+  constructor(opts) {
+    super(opts.message, { cause: opts.cause });
+    this.name = "WrongStackError";
+    this.code = opts.code;
+    this.subsystem = opts.subsystem;
+    this.severity = opts.severity ?? "error";
+    this.recoverable = opts.recoverable ?? false;
+    this.context = opts.context;
+  }
+  /**
+   * Render a one-line user-facing description.
+   * Subclasses should override for domain-specific formatting.
+   */
+  describe() {
+    const ctx = this.context ? ` ${formatContext(this.context)}` : "";
+    return `${this.code}: ${this.message}${ctx}`;
+  }
+};
+function formatContext(ctx) {
+  const parts = Object.entries(ctx).filter(([, v]) => v !== void 0).slice(0, 3).map(([k, v]) => `${k}=${String(v)}`);
+  return parts.length > 0 ? `[${parts.join(" ")}]` : "";
+}
+var FsError = class extends WrongStackError {
+  path;
+  constructor(opts) {
+    super({
+      message: opts.message,
+      code: opts.code,
+      subsystem: "fs",
+      severity: "error",
+      recoverable: opts.code !== ERROR_CODES.FS_READ_FAILED,
+      context: { path: opts.path, ...opts.context },
+      cause: opts.cause
+    });
+    this.name = "FsError";
+    this.path = opts.path;
+  }
+};
+
+// src/utils/atomic-write.ts
+var primitives = createPersistencePrimitives({
+  createLockTimeoutError: ({ targetPath, timeoutMs }) => new FsError({
+    message: `Timed out waiting for file lock: ${targetPath}`,
+    code: "FS_ATOMIC_WRITE_FAILED",
+    path: targetPath,
+    context: { timeoutMs }
+  })
+});
+var atomicWrite = primitives.atomicWrite;
+var atomicReplaceWithWriter = primitives.atomicReplaceWithWriter;
+var ensureDir = primitives.ensureDir;
+var withFileLock = primitives.withFileLock;
+
+// src/utils/perf-profile.ts
+var daemonDefaults = false;
+function useDaemonPerfDefaults() {
+  daemonDefaults = true;
+}
+
+// src/session-catalog/endpoint.ts
+import { createHash } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+
+// src/utils/socket-path.ts
+import {
+  assertUnixSocketPathWithinLimit,
+  checkUnixSocketPath,
+  unixSocketPathLimit
+} from "@wrongstack/persistence";
+
+// src/session-catalog/protocol.ts
+var SESSION_CATALOG_PROTOCOL_VERSION = 1;
+var SESSION_CATALOG_MAX_FRAME_CHARS = 4 * 1024 * 1024;
+var SESSION_CATALOG_DEFAULT_LEASE_MS = 3e4;
+var SESSION_CATALOG_DEFAULT_RESERVATION_MS = 15e3;
+var SESSION_CATALOG_MAX_AGENTS = 128;
+function encodeSessionCatalogMessage(message) {
+  return `${JSON.stringify(message)}
+`;
+}
+
+// src/session-catalog/endpoint.ts
+var SESSION_CATALOG_METADATA_FILE = ".session-catalog-server.json";
+function normalizedPath(value) {
+  const resolved = path.resolve(value);
+  return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}
+function sessionCatalogProjectServerKey(projectDir) {
+  return createHash("sha256").update(normalizedPath(projectDir)).digest("hex").slice(0, 24);
+}
+function sessionCatalogProjectServerEndpoint(projectDir) {
+  const key = sessionCatalogProjectServerKey(projectDir);
+  if (process.platform === "win32") {
+    return `\\\\.\\pipe\\wrongstack-session-catalog-v${SESSION_CATALOG_PROTOCOL_VERSION}-${key}`;
+  }
+  return path.join(os.tmpdir(), `wssc-v${SESSION_CATALOG_PROTOCOL_VERSION}`, `${key}.sock`);
+}
+function sessionCatalogProjectServerMetadataPath(projectDir) {
+  return path.join(projectDir, SESSION_CATALOG_METADATA_FILE);
+}
+function ensureSessionCatalogSocketDirectory(endpoint2) {
+  if (process.platform === "win32") return;
+  assertUnixSocketPathWithinLimit(endpoint2, "session-catalog");
+  fs.mkdirSync(path.dirname(endpoint2), { recursive: true, mode: 448 });
+}
+
+// src/session-catalog/store.ts
+import { createHash as createHash2, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import * as fs2 from "node:fs";
+import * as path2 from "node:path";
+
+// src/coordination/sqlite-mailbox-schema.ts
+import { createRequire } from "node:module";
+
+// src/utils/sqlite-warning.ts
+var SQLITE_EXPERIMENTAL_WARNING_RE = /sqlite is an experimental feature/i;
+function isSqliteExperimentalWarning(warning, rest) {
+  const message = typeof warning === "string" ? warning : warning instanceof Error ? warning.message : "";
+  const typeOrOptions = rest[0];
+  const warningType = typeof warning === "string" ? typeof typeOrOptions === "string" ? typeOrOptions : typeof typeOrOptions === "object" && typeOrOptions !== null && "type" in typeOrOptions && typeof typeOrOptions.type === "string" ? typeOrOptions.type : "" : warning instanceof Error ? warning.name : "";
+  const warningCode = typeof warning === "string" ? typeof typeOrOptions === "object" && typeOrOptions !== null && "code" in typeOrOptions && typeof typeOrOptions.code === "string" ? typeOrOptions.code : typeof rest[1] === "string" ? rest[1] : "" : warning instanceof Error && "code" in warning && typeof warning.code === "string" ? warning.code : "";
+  return SQLITE_EXPERIMENTAL_WARNING_RE.test(message) && (warningType === "ExperimentalWarning" || warningCode === "ExperimentalWarning");
+}
+function withSqliteExperimentalWarningSuppressed(run) {
+  const originalEmitWarning = process.emitWarning;
+  const forwardWarning = originalEmitWarning.bind(process);
+  process.emitWarning = ((warning, ...rest) => {
+    if (isSqliteExperimentalWarning(warning, rest)) return;
+    forwardWarning(warning, ...rest);
+  });
+  try {
+    return run();
+  } finally {
+    process.emitWarning = originalEmitWarning;
+  }
+}
+
+// src/coordination/sqlite-mailbox-schema.ts
+var DatabaseSyncCtor;
+function loadDatabaseSync() {
+  if (DatabaseSyncCtor) return DatabaseSyncCtor;
+  return withSqliteExperimentalWarningSuppressed(() => {
+    const require2 = createRequire(import.meta.url);
+    DatabaseSyncCtor = require2("node:sqlite").DatabaseSync;
+    return DatabaseSyncCtor;
+  });
+}
+
+// src/security/secret-scrubber.ts
+var PATTERNS = [
+  // Anchored at the start where possible so partial matches inside larger
+  // strings don't trigger false positives.
+  {
+    type: "anthropic_key",
+    regex: /(?<![A-Za-z0-9])sk-ant-api\d+-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g,
+    anchor: "sk-ant-"
+  },
+  { type: "openai_key", regex: /(?<![A-Za-z0-9])sk-(?:proj-)?[A-Za-z0-9_-]{20,}(?![A-Za-z0-9])/g, anchor: "sk-" },
+  { type: "github_pat", regex: /(?<![A-Za-z0-9])ghp_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g, anchor: "ghp_" },
+  { type: "github_pat_v2", regex: /(?<![A-Za-z0-9])github_pat_[A-Za-z0-9_]{50,}(?![A-Za-z0-9])/g, anchor: "github_pat_" },
+  { type: "aws_access_key", regex: /(?<![A-Za-z0-9])AKIA[0-9A-Z]{16}(?![A-Za-z0-9])/g, anchor: "AKIA" },
+  { type: "gcp_key", regex: /(?<![A-Za-z0-9])AIza[0-9A-Za-z_-]{35}(?![A-Za-z0-9])/g, anchor: "AIza" },
+  { type: "slack_token", regex: /(?<![A-Za-z0-9-])xox[abpos]-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g, anchor: "xox" },
+  {
+    type: "stripe_key",
+    regex: /(?<![A-Za-z0-9])sk_(?:live|test)_[A-Za-z0-9]{24,}(?![A-Za-z0-9])/g,
+    anchor: "sk_"
+  },
+  {
+    type: "twilio_sid",
+    regex: /(?<![A-Za-z0-9])AC[a-f0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "AC"
+  },
+  {
+    type: "telegram_bot_token",
+    // Telegram tokens are of the form  bot<digits>:<alphanum>  in URL paths
+    regex: /\/bot\d+:[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "/bot"
+  },
+  {
+    type: "jwt",
+    // Anchored: look for literal "eyJ" which is unambiguous for JWT header
+    regex: /(?<![A-Za-z0-9/+=])eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}(?![A-Za-z0-9/+=])/g,
+    anchor: "eyJ"
+  },
+  {
+    type: "private_key",
+    // Anchored: start must be BEGIN, end must be END with no extra dashes after END
+    regex: /(?:^|\n)-----BEGIN (?:RSA|EC|OPENSSH|DSA|PGP)? ?PRIVATE KEY-----[\s\S]*?-----END[^-]*-----(?:\n|$)/g,
+    anchor: "-----BEGIN"
+  },
+  { type: "mongodb_uri", regex: /mongodb(?:\+srv)?:\/\/[^\s"'`]+/g, anchor: "mongodb" },
+  { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g, anchor: "postgres" },
+  { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g, anchor: "mysql://" },
+  { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g, anchor: "redis://" },
+  // AI/ML provider keys — modern LLM services with well-known prefixes
+  {
+    type: "huggingface_token",
+    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g,
+    anchor: "hf_"
+  },
+  {
+    type: "replicate_token",
+    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "r8_"
+  },
+  {
+    type: "perplexity_key",
+    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "pplx-"
+  },
+  {
+    type: "groq_key",
+    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "gsk_"
+  },
+  {
+    type: "bearer_token",
+    // Anchored with alternation instead of negative lookahead — avoids V8
+    // backtracking risk on adversarial input. Bounded at 512 chars.
+    // Min 12 chars: some OAuth providers issue shorter-lived tokens (< 20
+    // chars). A 12-char base64 string has ~71 bits of entropy — above the
+    // threshold where random strings are unlikely to produce false matches.
+    // The trailing boundary is a NON-consuming lookahead: two adjacent bearer
+    // tokens sharing a single delimiter (`Bearer a… Bearer b…`) must both be
+    // redacted. A consuming trailing delimiter would eat the separator the
+    // next match needs for its leading anchor, leaking the second token.
+    regex: /(?:^|[^A-Za-z0-9_.~+/-])Bearer\s+[A-Za-z0-9._~+/-]{12,512}=*(?=$|[^A-Za-z0-9_.~+/-])/g,
+    anchor: "Bearer"
+  },
+  {
+    type: "high_entropy_env",
+    // Anchored with alternation instead of lookbehind to avoid backtracking.
+    // Value bounded at 512 chars.
+    // The trailing boundary is a NON-consuming lookahead so two secrets
+    // separated by a single delimiter (one space OR one newline, e.g.
+    // `printenv` / `.env` dumps: `API_KEY=… \n SESSION_TOKEN=…`) are BOTH
+    // redacted. A consuming trailing `\s` would swallow the separator the
+    // next match needs for its leading anchor, so every other secret would
+    // leak in plaintext.
+    // The leading delimiter is CAPTURED (group 1) and re-emitted by the
+    // replacement so the separator between adjacent secrets is preserved
+    // rather than collapsed. Capture groups are therefore: 1=leading
+    // delimiter, 2=key name, 3=value.
+    regex: /(^|\s)([A-Z_]{4,}(?:KEY|TOKEN|SECRET|PASSWORD|PWD))\s*[:=]\s*['"]?([A-Za-z0-9_/+=-]{20,512})['"]?(?=\s|$)/g,
+    anchor: ["KEY", "TOKEN", "SECRET", "PASSWORD", "PWD"]
+  },
+  // ── Ported from packages/plugins credential-patterns.ts (WS-034) ─────────
+  // The plugin runtime carried 37 patterns while this scrubber — the one that
+  // guards session JSONL, chronicle, HQ broadcast, WebUI events and the auth
+  // audit — carried 22. The plugin side already had a parity test; it just did
+  // not cover core. Most consequential: WrongStack mints `gho_` tokens itself
+  // in the Copilot OAuth flow, and `gh[ousr]_` was absent here.
+  {
+    type: "github_oauth_token",
+    regex: /(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36,}(?![A-Za-z0-9])/g,
+    anchor: ["gho_", "ghu_", "ghs_", "ghr_"]
+  },
+  {
+    type: "gitlab_pat",
+    regex: /(?<![A-Za-z0-9])glpat-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glpat-"
+  },
+  {
+    type: "gitlab_runner_token",
+    regex: /(?<![A-Za-z0-9])glrt-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "glrt-"
+  },
+  {
+    type: "npm_token",
+    regex: /(?<![A-Za-z0-9])npm_[A-Za-z0-9]{36}(?![A-Za-z0-9])/g,
+    anchor: "npm_"
+  },
+  {
+    type: "slack_app_token",
+    regex: /(?<![A-Za-z0-9-])xapp-\d-[A-Za-z0-9-]{10,}(?![A-Za-z0-9-])/g,
+    anchor: "xapp-"
+  },
+  {
+    type: "slack_webhook",
+    regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9_-]+\/B[A-Za-z0-9_-]+\/[A-Za-z0-9]{16,}/g,
+    anchor: "hooks.slack.com"
+  },
+  {
+    type: "sendgrid_key",
+    regex: /(?<![A-Za-z0-9])SG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "SG."
+  },
+  {
+    type: "digitalocean_token",
+    regex: /(?<![A-Za-z0-9])dop_v1_[a-f0-9]{64}(?![A-Za-z0-9])/g,
+    anchor: "dop_v1_"
+  },
+  {
+    type: "doppler_token",
+    regex: /(?<![A-Za-z0-9])dp\.(?:pt|st|sa|scim|audit)\.[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "dp."
+  },
+  {
+    type: "shopify_token",
+    regex: /(?<![A-Za-z0-9])shp(?:at|ca|pa|ss)_[a-fA-F0-9]{32}(?![A-Za-z0-9])/g,
+    anchor: "shp"
+  },
+  {
+    type: "docker_pat",
+    regex: /(?<![A-Za-z0-9])dckr_pat_[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "dckr_pat_"
+  },
+  {
+    type: "linear_key",
+    regex: /(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g,
+    anchor: "lin_api_"
+  },
+  {
+    type: "atlassian_token",
+    regex: /(?<![A-Za-z0-9])ATATT3[A-Za-z0-9_\-=]{40,}(?![A-Za-z0-9_\-=])/g,
+    anchor: "ATATT3"
+  },
+  {
+    type: "square_token",
+    regex: /(?<![A-Za-z0-9])(?:sq0(?:atp|csp)-|EAAA)[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: ["sq0atp-", "sq0csp-", "EAAA"]
+  },
+  {
+    type: "google_oauth_client_secret",
+    regex: /(?<![A-Za-z0-9_-])GOCSPX-[A-Za-z0-9_-]{20,}(?![A-Za-z0-9_-])/g,
+    anchor: "GOCSPX-"
+  }
+];
+var SIMPLE_PATTERNS = PATTERNS.filter((p) => p.type !== "high_entropy_env");
+var COMBINED_REGEX = new RegExp(SIMPLE_PATTERNS.map((p) => `(${p.regex.source})`).join("|"), "g");
+var HIGH_ENTROPY_REGEX = PATTERNS.find((p) => p.type === "high_entropy_env").regex;
+var COMBINED_REPLACEMENTS = SIMPLE_PATTERNS.map((p) => `[REDACTED:${p.type}]`);
+var SCRUB_CHUNK_BYTES = 64 * 1024;
+var SCRUB_OVERLAP_BYTES = 1024;
+var PATTERN_ANCHORS = [
+  ...new Set(
+    PATTERNS.flatMap(
+      (pattern) => typeof pattern.anchor === "string" ? [pattern.anchor] : [...pattern.anchor]
+    )
+  )
+];
+var JSON_KEY_ANCHORS = [
+  '"apiKey"',
+  '"api_key"',
+  '"token"',
+  '"secret"',
+  '"password"',
+  '"authorization"',
+  '"bearer"',
+  '"private_key"',
+  '"access_token"',
+  '"refresh_token"',
+  '"client_secret"'
+];
+var ALL_ANCHORS = [...PATTERN_ANCHORS, ...JSON_KEY_ANCHORS];
+function hasCredentialAnchors(text) {
+  for (const anchor of ALL_ANCHORS) {
+    if (text.includes(anchor)) return true;
+  }
+  return false;
+}
+var DefaultSecretScrubber = class {
+  scrub(text) {
+    if (!text) return text;
+    if (!hasCredentialAnchors(text)) return text;
+    if (text.length <= SCRUB_CHUNK_BYTES) {
+      return this.scrubOne(text);
+    }
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+      let end = Math.min(i + SCRUB_CHUNK_BYTES, text.length);
+      if (end < text.length) {
+        const limit = Math.min(end + SCRUB_OVERLAP_BYTES, text.length);
+        let safe = -1;
+        for (let j = end; j < limit; j++) {
+          const ch = text.charCodeAt(j);
+          if (ch === 32 || ch === 9 || ch === 10 || ch === 13) {
+            safe = j;
+            break;
+          }
+        }
+        end = safe === -1 ? end : safe + 1;
+      }
+      out.push(this.scrubOne(text.slice(i, end)));
+      i = end;
+    }
+    return out.join("");
+  }
+  scrubOne(text) {
+    if (!hasCredentialAnchors(text)) return text;
+    let out = text.replace(
+      COMBINED_REGEX,
+      (match, ...groups) => {
+        const idx = groups.findIndex((g) => g !== void 0);
+        if (idx < 0) return match;
+        const replacement = COMBINED_REPLACEMENTS[idx];
+        return replacement !== void 0 ? replacement : match;
+      }
+    );
+    out = out.replace(HIGH_ENTROPY_REGEX, (_match, lead, key, _value) => {
+      return `${lead}${key}=[REDACTED:high_entropy_env]`;
+    });
+    return out;
+  }
+  /**
+   * Recursively scrub every string value in an object/array graph. Secrets can
+   * appear under any key — a URL query param, an `authorization` header, an
+   * arbitrarily-named nested field — so we don't gate recursion on key names.
+   * The per-string `scrub()` fast-path (anchor pre-scan) keeps this cheap: any
+   * value without a credential anchor returns immediately without regex work.
+   */
+  scrubObject(obj) {
+    const seen = /* @__PURE__ */ new WeakSet();
+    const visit = (v) => {
+      if (typeof v === "string") return this.scrub(v);
+      if (v === null || typeof v !== "object") return v;
+      if (seen.has(v)) return v;
+      seen.add(v);
+      if (Array.isArray(v)) return v.map(visit);
+      const out = {};
+      for (const [k, val] of Object.entries(v)) {
+        out[k] = visit(val);
+      }
+      return out;
+    };
+    return visit(obj);
+  }
+};
+
+// src/utils/pid.ts
+function isPidAlive(pid) {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  if (pid === process.pid) return true;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EPERM") return true;
+    return false;
+  }
+}
+
+// src/session-catalog/store.ts
+var SCHEMA_VERSION = 1;
+var MAX_LEASE_MS = 12e4;
+var MAX_RESERVATION_MS = 6e4;
+var MAX_MAINTENANCE_MS = 5 * 6e4;
+var MAX_PAGE = 1e3;
+function hashSecret(secret) {
+  return createHash2("sha256").update(secret).digest("hex");
+}
+function secretMatches(secret, expectedHex) {
+  const actual = Buffer.from(hashSecret(secret), "hex");
+  const expected = Buffer.from(expectedHex, "hex");
+  return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+function boundedMs(value, fallback, max) {
+  return Math.min(max, Math.max(1e3, Number.isFinite(value) ? Math.floor(value) : fallback));
+}
+function parseJson(value) {
+  return JSON.parse(value);
+}
+function conflict(message) {
+  const error = new Error(message);
+  error.name = "SessionOwnershipConflictError";
+  return error;
+}
+function assertId(value, label = "session id") {
+  if (!value || value.length > 256 || value.includes("\\") || value.startsWith("/") || value.includes("..")) {
+    throw new TypeError(`Invalid ${label}`);
+  }
+}
+function boundPresenceValue(value, depth) {
+  if (typeof value === "string") {
+    return value.length <= 6e3 ? value : `${value.slice(0, 5988)}\u2026[truncated]`;
+  }
+  if (value === null || typeof value !== "object") return value;
+  if (depth >= 8) return "[truncated depth]";
+  if (Array.isArray(value)) {
+    return value.slice(0, 64).map((item) => boundPresenceValue(item, depth + 1));
+  }
+  const result = {};
+  for (const [key, item] of Object.entries(value).slice(0, 64)) {
+    result[key] = boundPresenceValue(item, depth + 1);
+  }
+  return result;
+}
+var SessionCatalogStore = class {
+  constructor(projectDir) {
+    this.projectDir = projectDir;
+    this.sessionsDir = path2.join(projectDir, "sessions");
+    fs2.mkdirSync(this.sessionsDir, { recursive: true, mode: 448 });
+    this.databasePath = path2.join(this.sessionsDir, "catalog.sqlite");
+    const Database = loadDatabaseSync();
+    this.db = new Database(this.databasePath);
+    try {
+      this.configureDatabase();
+      this.initialize();
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      if (!/SQLITE_CORRUPT|SQLITE_NOTADB|database disk image is malformed|file is not a database/i.test(
+        message
+      )) {
+        this.db.close();
+        throw error;
+      }
+      this.db.close();
+      const quarantine = `${this.databasePath}.corrupt-${Date.now()}`;
+      try {
+        fs2.renameSync(this.databasePath, quarantine);
+      } catch {
+      }
+      for (const suffix of ["-wal", "-shm"]) {
+        try {
+          fs2.renameSync(`${this.databasePath}${suffix}`, `${quarantine}${suffix}`);
+        } catch {
+        }
+      }
+      this.db = new Database(this.databasePath);
+      this.configureDatabase();
+      this.initialize();
+    }
+    this.reapExpired();
+    const rowCount = Number(
+      this.db.prepare("SELECT COUNT(*) AS count FROM sessions").get().count
+    );
+    if (rowCount === 0 && this.walkFiles(this.sessionsDir, ".jsonl").some((file) => !file.endsWith("_index.jsonl"))) {
+      this.rebuildCatalog();
+    }
+  }
+  projectDir;
+  databasePath;
+  sessionsDir;
+  db;
+  scrubber = new DefaultSecretScrubber();
+  configureDatabase() {
+    this.db.exec(
+      "PRAGMA journal_mode=WAL; PRAGMA foreign_keys=ON; PRAGMA busy_timeout=5000; PRAGMA synchronous=NORMAL;"
+    );
+  }
+  close() {
+    this.db.close();
+  }
+  initialize() {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS catalog_meta (key TEXT PRIMARY KEY, value TEXT NOT NULL);
+      CREATE TABLE IF NOT EXISTS sessions (
+        session_id TEXT PRIMARY KEY,
+        transcript_relative_path TEXT NOT NULL,
+        summary_relative_path TEXT NOT NULL,
+        summary_json TEXT NOT NULL,
+        transcript_size INTEGER NOT NULL DEFAULT 0,
+        transcript_mtime_ms REAL NOT NULL DEFAULT 0,
+        summary_revision INTEGER NOT NULL DEFAULT 1,
+        indexed_at TEXT NOT NULL,
+        damaged INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE TABLE IF NOT EXISTS session_leases (
+        session_id TEXT PRIMARY KEY,
+        lease_id TEXT NOT NULL UNIQUE,
+        lease_secret_hash TEXT NOT NULL,
+        owner_instance_id TEXT NOT NULL,
+        owner_pid INTEGER NOT NULL,
+        owner_started_at TEXT NOT NULL,
+        entry_json TEXT NOT NULL,
+        agent_revision INTEGER NOT NULL DEFAULT 0,
+        status TEXT NOT NULL,
+        last_heartbeat_at INTEGER NOT NULL,
+        lease_expires_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS resume_reservations (
+        reservation_id TEXT PRIMARY KEY,
+        target_session_id TEXT NOT NULL UNIQUE,
+        requester_instance_id TEXT NOT NULL,
+        current_session_id TEXT,
+        created_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE TABLE IF NOT EXISTS maintenance_leases (
+        session_id TEXT PRIMARY KEY,
+        operation TEXT NOT NULL,
+        holder_id TEXT NOT NULL,
+        lease_id TEXT NOT NULL UNIQUE,
+        acquired_at INTEGER NOT NULL,
+        expires_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_sessions_activity ON sessions(indexed_at DESC);
+      CREATE INDEX IF NOT EXISTS idx_leases_expiry ON session_leases(lease_expires_at);
+      CREATE INDEX IF NOT EXISTS idx_reservations_expiry ON resume_reservations(expires_at);
+      CREATE INDEX IF NOT EXISTS idx_maintenance_expiry ON maintenance_leases(expires_at);
+    `);
+    this.db.prepare("INSERT INTO catalog_meta(key,value) VALUES (?,?) ON CONFLICT(key) DO NOTHING").run("schema_version", String(SCHEMA_VERSION));
+    this.db.prepare("INSERT INTO catalog_meta(key,value) VALUES (?,?) ON CONFLICT(key) DO NOTHING").run("generation", "0");
+    const row = this.db.prepare("SELECT value FROM catalog_meta WHERE key=?").get("schema_version");
+    if (Number(row.value) !== SCHEMA_VERSION)
+      throw new Error(`Unsupported session catalog schema ${row.value}`);
+  }
+  transaction(run) {
+    this.db.exec("BEGIN IMMEDIATE");
+    try {
+      const result = run();
+      this.db.exec("COMMIT");
+      return result;
+    } catch (error) {
+      this.db.exec("ROLLBACK");
+      throw error;
+    }
+  }
+  bumpGeneration() {
+    this.db.prepare("UPDATE catalog_meta SET value=CAST(value AS INTEGER)+1 WHERE key='generation'").run();
+    return this.generation();
+  }
+  generation() {
+    const row = this.db.prepare("SELECT value FROM catalog_meta WHERE key='generation'").get();
+    return Number(row.value) || 0;
+  }
+  reapExpired(now = Date.now()) {
+    this.db.prepare("DELETE FROM resume_reservations WHERE expires_at<=?").run(now);
+    this.db.prepare("DELETE FROM maintenance_leases WHERE expires_at<=?").run(now);
+    const rows = this.db.prepare("SELECT * FROM session_leases WHERE lease_expires_at<=?").all(now);
+    for (const row of rows) {
+      if (!isPidAlive(row.owner_pid)) {
+        this.db.prepare("DELETE FROM session_leases WHERE session_id=? AND lease_id=?").run(row.session_id, row.lease_id);
+      } else if (row.status !== "lost") {
+        this.db.prepare("UPDATE session_leases SET status='lost' WHERE session_id=? AND lease_id=?").run(row.session_id, row.lease_id);
+      }
+    }
+  }
+  maintenanceExists(sessionId) {
+    return Boolean(
+      this.db.prepare("SELECT 1 AS yes FROM maintenance_leases WHERE session_id=? AND expires_at>?").get(sessionId, Date.now())
+    );
+  }
+  leaseRow(sessionId) {
+    return this.db.prepare("SELECT * FROM session_leases WHERE session_id=?").get(sessionId);
+  }
+  verifyCredential(credential) {
+    assertId(credential.sessionId);
+    const row = this.leaseRow(credential.sessionId);
+    if (!row || row.lease_id !== credential.leaseId || row.owner_instance_id !== credential.ownerInstanceId || !secretMatches(credential.leaseSecret, row.lease_secret_hash)) {
+      throw conflict(`Session ${credential.sessionId} lease proof is invalid or no longer owned`);
+    }
+    return row;
+  }
+  createLease(entry, ownerInstanceId, leaseMs) {
+    assertId(entry.sessionId);
+    if (!ownerInstanceId || ownerInstanceId.length > 256)
+      throw new TypeError("Invalid owner instance id");
+    if (!Number.isSafeInteger(entry.pid) || entry.pid <= 0)
+      throw new TypeError("Invalid owner pid");
+    const now = Date.now();
+    const leaseId = randomUUID();
+    const leaseSecret = randomBytes(32).toString("hex");
+    const expiresAt = now + boundedMs(leaseMs, SESSION_CATALOG_DEFAULT_LEASE_MS, MAX_LEASE_MS);
+    this.db.prepare(`INSERT INTO session_leases(
+      session_id,lease_id,lease_secret_hash,owner_instance_id,owner_pid,owner_started_at,
+      entry_json,agent_revision,status,last_heartbeat_at,lease_expires_at
+    ) VALUES (?,?,?,?,?,?,?,?,?,?,?)`).run(
+      entry.sessionId,
+      leaseId,
+      hashSecret(leaseSecret),
+      ownerInstanceId,
+      entry.pid,
+      entry.startedAt,
+      JSON.stringify(entry),
+      0,
+      entry.status,
+      now,
+      expiresAt
+    );
+    return { sessionId: entry.sessionId, leaseId, leaseSecret, ownerInstanceId, expiresAt };
+  }
+  claimNew(entry, ownerInstanceId, leaseMs) {
+    return this.transaction(() => {
+      this.reapExpired();
+      const existing = this.leaseRow(entry.sessionId);
+      if (existing)
+        throw conflict(
+          `Session ${entry.sessionId} is already open in another running wstack (pid ${existing.owner_pid}).`
+        );
+      if (this.maintenanceExists(entry.sessionId))
+        throw conflict(`Session ${entry.sessionId} is under maintenance`);
+      const reserved = this.db.prepare(
+        "SELECT 1 AS yes FROM resume_reservations WHERE target_session_id=? AND expires_at>?"
+      ).get(entry.sessionId, Date.now());
+      if (reserved) throw conflict(`Session ${entry.sessionId} is reserved for resume`);
+      const credential = this.createLease(entry, ownerInstanceId, leaseMs);
+      this.bumpGeneration();
+      return credential;
+    });
+  }
+  reconnectLease(credential) {
+    return this.transaction(() => {
+      const row = this.verifyCredential(credential);
+      if (row.owner_pid !== process.pid && !isPidAlive(row.owner_pid))
+        throw conflict(`Session ${credential.sessionId} owner process is no longer alive`);
+      const expiresAt = Date.now() + SESSION_CATALOG_DEFAULT_LEASE_MS;
+      this.db.prepare(
+        "UPDATE session_leases SET lease_expires_at=?,last_heartbeat_at=?,status=? WHERE session_id=? AND lease_id=?"
+      ).run(
+        expiresAt,
+        Date.now(),
+        row.status === "lost" ? "idle" : row.status,
+        row.session_id,
+        row.lease_id
+      );
+      return { ...credential, expiresAt };
+    });
+  }
+  reserveResume(targetSessionId, requesterInstanceId, currentSessionId, reservationMs) {
+    assertId(targetSessionId);
+    return this.transaction(() => {
+      this.reapExpired();
+      const live = this.leaseRow(targetSessionId);
+      if (live)
+        throw conflict(
+          `Session ${targetSessionId} is already open in another running wstack (pid ${live.owner_pid}).`
+        );
+      if (this.maintenanceExists(targetSessionId))
+        throw conflict(`Session ${targetSessionId} is under maintenance`);
+      const catalog = this.db.prepare("SELECT 1 AS yes FROM sessions WHERE session_id=?").get(targetSessionId);
+      if (!catalog && !fs2.existsSync(this.containedPath(`${targetSessionId}.jsonl`)))
+        throw new Error(`Session not found: ${targetSessionId}`);
+      const reservationId = randomUUID();
+      const now = Date.now();
+      const expiresAt = now + boundedMs(reservationMs, SESSION_CATALOG_DEFAULT_RESERVATION_MS, MAX_RESERVATION_MS);
+      try {
+        this.db.prepare(
+          "INSERT INTO resume_reservations(reservation_id,target_session_id,requester_instance_id,current_session_id,created_at,expires_at) VALUES (?,?,?,?,?,?)"
+        ).run(
+          reservationId,
+          targetSessionId,
+          requesterInstanceId,
+          currentSessionId ?? null,
+          now,
+          expiresAt
+        );
+      } catch {
+        throw conflict(`Session ${targetSessionId} is already reserved for resume`);
+      }
+      this.bumpGeneration();
+      return { reservationId, targetSessionId, requesterInstanceId, expiresAt };
+    });
+  }
+  activateReservation(reservation, entry, leaseMs) {
+    return this.transaction(() => {
+      this.reapExpired();
+      const row = this.db.prepare("SELECT * FROM resume_reservations WHERE reservation_id=?").get(reservation.reservationId);
+      if (!row || row.target_session_id !== reservation.targetSessionId || row.requester_instance_id !== reservation.requesterInstanceId || row.expires_at <= Date.now())
+        throw conflict("Resume reservation expired or is not owned by this requester");
+      if (entry.sessionId !== row.target_session_id)
+        throw new TypeError("Reservation target and session entry differ");
+      if (this.leaseRow(entry.sessionId) || this.maintenanceExists(entry.sessionId))
+        throw conflict(`Session ${entry.sessionId} can no longer be activated`);
+      const credential = this.createLease(entry, reservation.requesterInstanceId, leaseMs);
+      this.db.prepare("DELETE FROM resume_reservations WHERE reservation_id=?").run(row.reservation_id);
+      this.bumpGeneration();
+      return credential;
+    });
+  }
+  cancelReservation(reservationId, requesterInstanceId) {
+    this.db.prepare("DELETE FROM resume_reservations WHERE reservation_id=? AND requester_instance_id=?").run(reservationId, requesterInstanceId);
+  }
+  heartbeat(credential, status) {
+    return this.transaction(() => {
+      const row = this.verifyCredential(credential);
+      const expiresAt = Date.now() + SESSION_CATALOG_DEFAULT_LEASE_MS;
+      const nextStatus = status ?? (row.status === "closing" ? "closing" : row.status === "lost" ? "idle" : row.status);
+      const entry = parseJson(row.entry_json);
+      entry.status = nextStatus;
+      entry.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.db.prepare(
+        "UPDATE session_leases SET status=?,entry_json=?,last_heartbeat_at=?,lease_expires_at=? WHERE session_id=? AND lease_id=?"
+      ).run(
+        nextStatus,
+        JSON.stringify(entry),
+        Date.now(),
+        expiresAt,
+        row.session_id,
+        row.lease_id
+      );
+      return { ...credential, expiresAt };
+    });
+  }
+  publishAgents(credential, revision, agents) {
+    if (!Number.isSafeInteger(revision) || revision < 0)
+      throw new TypeError("Invalid presence revision");
+    if (!Array.isArray(agents) || agents.length > SESSION_CATALOG_MAX_AGENTS)
+      throw new TypeError(`Agent snapshot exceeds ${SESSION_CATALOG_MAX_AGENTS} agents`);
+    const boundedAgents = boundPresenceValue(
+      this.scrubber.scrubObject(agents),
+      0
+    );
+    const encoded = JSON.stringify(boundedAgents);
+    if (encoded.length > 1024 * 1024) throw new TypeError("Agent snapshot exceeds 1 MiB");
+    return this.transaction(() => {
+      const row = this.verifyCredential(credential);
+      if (revision <= row.agent_revision) return { accepted: false, revision: row.agent_revision };
+      const entry = parseJson(row.entry_json);
+      entry.agents = boundedAgents;
+      entry.agentCount = boundedAgents.length;
+      entry.status = boundedAgents.some((agent) => agent.status !== "idle") ? "active" : "idle";
+      entry.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
+      this.db.prepare(
+        "UPDATE session_leases SET entry_json=?,agent_revision=?,status=?,last_heartbeat_at=? WHERE session_id=? AND lease_id=?"
+      ).run(
+        JSON.stringify(entry),
+        revision,
+        entry.status,
+        Date.now(),
+        row.session_id,
+        row.lease_id
+      );
+      this.bumpGeneration();
+      return { accepted: true, revision };
+    });
+  }
+  markClosing(credential) {
+    const row = this.verifyCredential(credential);
+    const entry = parseJson(row.entry_json);
+    entry.status = "closing";
+    entry.lastHeartbeatAt = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.prepare(
+      "UPDATE session_leases SET status='closing',entry_json=?,last_heartbeat_at=? WHERE session_id=? AND lease_id=?"
+    ).run(JSON.stringify(entry), Date.now(), row.session_id, row.lease_id);
+    this.bumpGeneration();
+  }
+  release(credential) {
+    this.transaction(() => {
+      const row = this.verifyCredential(credential);
+      this.db.prepare("DELETE FROM session_leases WHERE session_id=? AND lease_id=?").run(row.session_id, row.lease_id);
+      this.bumpGeneration();
+    });
+  }
+  listLive() {
+    this.reapExpired();
+    return this.db.prepare(
+      "SELECT entry_json,status,last_heartbeat_at FROM session_leases ORDER BY last_heartbeat_at DESC"
+    ).all().map((row) => ({
+      ...parseJson(row.entry_json),
+      status: row.status,
+      lastHeartbeatAt: new Date(row.last_heartbeat_at).toISOString()
+    }));
+  }
+  getLive(sessionId) {
+    return this.listLive().find((entry) => entry.sessionId === sessionId) ?? null;
+  }
+  containedPath(relative3) {
+    assertId(relative3.replace(/\.(jsonl|summary\.json)$/, ""), "session path");
+    const root = path2.resolve(this.sessionsDir);
+    const candidate = path2.resolve(root, relative3);
+    const prefix = `${root}${path2.sep}`;
+    if (candidate !== root && !(process.platform === "win32" ? candidate.toLowerCase().startsWith(prefix.toLowerCase()) : candidate.startsWith(prefix)))
+      throw new TypeError("Session path escapes sessions directory");
+    return candidate;
+  }
+  upsertSummary(summary, transcriptRelativePath = `${summary.id}.jsonl`, summaryRelativePath = `${summary.id}.summary.json`) {
+    assertId(summary.id);
+    summary = this.scrubber.scrubObject(summary);
+    const normalizedTranscript = transcriptRelativePath.replaceAll("\\", "/");
+    const normalizedSummary = summaryRelativePath.replaceAll("\\", "/");
+    if (normalizedTranscript !== `${summary.id}.jsonl` || normalizedSummary !== `${summary.id}.summary.json`) {
+      throw new TypeError("Session catalog paths must match the canonical session identity");
+    }
+    transcriptRelativePath = normalizedTranscript;
+    summaryRelativePath = normalizedSummary;
+    const transcript = this.containedPath(transcriptRelativePath);
+    const stat = fs2.existsSync(transcript) ? fs2.statSync(transcript) : void 0;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    return this.transaction(() => {
+      const prior = this.db.prepare("SELECT summary_revision FROM sessions WHERE session_id=?").get(summary.id);
+      const revision = (prior?.summary_revision ?? 0) + 1;
+      this.db.prepare(`INSERT INTO sessions(session_id,transcript_relative_path,summary_relative_path,summary_json,transcript_size,transcript_mtime_ms,summary_revision,indexed_at,damaged)
+        VALUES (?,?,?,?,?,?,?,?,0) ON CONFLICT(session_id) DO UPDATE SET transcript_relative_path=excluded.transcript_relative_path,summary_relative_path=excluded.summary_relative_path,summary_json=excluded.summary_json,transcript_size=excluded.transcript_size,transcript_mtime_ms=excluded.transcript_mtime_ms,summary_revision=excluded.summary_revision,indexed_at=excluded.indexed_at,damaged=0`).run(
+        summary.id,
+        transcriptRelativePath,
+        summaryRelativePath,
+        JSON.stringify(summary),
+        stat?.size ?? 0,
+        stat?.mtimeMs ?? 0,
+        revision,
+        now
+      );
+      this.bumpGeneration();
+      return {
+        ...summary,
+        transcriptRelativePath,
+        summaryRelativePath,
+        transcriptSize: stat?.size ?? 0,
+        transcriptMtimeMs: stat?.mtimeMs ?? 0,
+        summaryRevision: revision,
+        indexedAt: now,
+        damaged: false
+      };
+    });
+  }
+  catalogRecord(row) {
+    return {
+      ...parseJson(row.summary_json),
+      transcriptRelativePath: row.transcript_relative_path,
+      summaryRelativePath: row.summary_relative_path,
+      transcriptSize: row.transcript_size,
+      transcriptMtimeMs: row.transcript_mtime_ms,
+      summaryRevision: row.summary_revision,
+      indexedAt: row.indexed_at,
+      damaged: row.damaged !== 0
+    };
+  }
+  listCatalog(limit = 100, search) {
+    const bounded = Math.min(MAX_PAGE, Math.max(1, Math.floor(limit)));
+    const rows = search?.trim() ? this.db.prepare(
+      "SELECT * FROM sessions WHERE session_id LIKE ? OR json_extract(summary_json,'$.title') LIKE ? OR json_extract(summary_json,'$.name') LIKE ? ORDER BY COALESCE(json_extract(summary_json,'$.lastActivityAt'),json_extract(summary_json,'$.startedAt')) DESC LIMIT ?"
+    ).all(`%${search.trim()}%`, `%${search.trim()}%`, `%${search.trim()}%`, bounded) : this.db.prepare(
+      "SELECT * FROM sessions ORDER BY COALESCE(json_extract(summary_json,'$.lastActivityAt'),json_extract(summary_json,'$.startedAt')) DESC LIMIT ?"
+    ).all(bounded);
+    return rows.map((row) => this.catalogRecord(row));
+  }
+  getSummary(sessionId) {
+    const row = this.db.prepare("SELECT * FROM sessions WHERE session_id=?").get(sessionId);
+    return row ? this.catalogRecord(row) : null;
+  }
+  resolveId(query) {
+    const normalized = query.trim();
+    if (!normalized) throw new Error("Session not found: (empty query)");
+    if (this.getSummary(normalized)) return normalized;
+    const rows = this.db.prepare(
+      "SELECT session_id FROM sessions WHERE session_id LIKE ? OR session_id LIKE ? LIMIT 3"
+    ).all(`%/${normalized}`, `${normalized}%`);
+    const ids = [...new Set(rows.map((row) => row.session_id))];
+    if (ids.length === 1) return ids[0];
+    if (ids.length === 0) throw new Error(`Session not found: ${query}`);
+    throw new Error(`Ambiguous session id "${query}": ${ids.join(", ")}`);
+  }
+  async rename(sessionId, name) {
+    const current = this.getSummary(this.resolveId(sessionId));
+    if (!current) throw new Error(`Session not found: ${sessionId}`);
+    const trimmed = name.trim();
+    const summary = { ...current };
+    for (const key of [
+      "transcriptRelativePath",
+      "summaryRelativePath",
+      "transcriptSize",
+      "transcriptMtimeMs",
+      "summaryRevision",
+      "indexedAt",
+      "damaged"
+    ])
+      delete summary[key];
+    const previous = { ...summary };
+    if (trimmed) summary.name = this.scrubber.scrub(trimmed).slice(0, 500);
+    else delete summary.name;
+    const summaryPath = this.containedPath(current.summaryRelativePath);
+    fs2.mkdirSync(path2.dirname(summaryPath), { recursive: true, mode: 448 });
+    await atomicWrite(summaryPath, `${JSON.stringify(summary)}
+`, { mode: 384 });
+    try {
+      return this.upsertSummary(
+        summary,
+        current.transcriptRelativePath,
+        current.summaryRelativePath
+      );
+    } catch (error) {
+      await atomicWrite(summaryPath, `${JSON.stringify(previous)}
+`, { mode: 384 }).catch(
+        () => void 0
+      );
+      throw error;
+    }
+  }
+  acquireMaintenance(sessionId, operation, holderId, leaseMs) {
+    assertId(sessionId);
+    return this.transaction(() => {
+      this.reapExpired();
+      if (this.leaseRow(sessionId)) throw conflict(`Session ${sessionId} is live`);
+      const reservation = this.db.prepare(
+        "SELECT 1 AS yes FROM resume_reservations WHERE target_session_id=? AND expires_at>?"
+      ).get(sessionId, Date.now());
+      if (reservation) throw conflict(`Session ${sessionId} is reserved for resume`);
+      const leaseId = randomUUID();
+      const now = Date.now();
+      const expiresAt = now + boundedMs(leaseMs, 6e4, MAX_MAINTENANCE_MS);
+      try {
+        this.db.prepare(
+          "INSERT INTO maintenance_leases(session_id,operation,holder_id,lease_id,acquired_at,expires_at) VALUES (?,?,?,?,?,?)"
+        ).run(sessionId, operation, holderId, leaseId, now, expiresAt);
+      } catch {
+        throw conflict(`Session ${sessionId} already has maintenance in progress`);
+      }
+      return { sessionId, operation, holderId, leaseId, expiresAt };
+    });
+  }
+  releaseMaintenance(lease) {
+    this.db.prepare("DELETE FROM maintenance_leases WHERE session_id=? AND lease_id=? AND holder_id=?").run(lease.sessionId, lease.leaseId, lease.holderId);
+  }
+  delete(sessionId, lease) {
+    const row = this.db.prepare(
+      "SELECT * FROM maintenance_leases WHERE session_id=? AND lease_id=? AND holder_id=? AND operation=? AND expires_at>?"
+    ).get(sessionId, lease.leaseId, lease.holderId, lease.operation, Date.now());
+    if (!row || lease.operation !== "delete")
+      throw conflict("A valid delete maintenance lease is required");
+    const record = this.getSummary(sessionId);
+    if (!record) throw new Error(`Session not found: ${sessionId}`);
+    const transcript = this.containedPath(record.transcriptRelativePath);
+    const artifacts = [
+      transcript,
+      this.containedPath(record.summaryRelativePath),
+      this.containedPath(`${sessionId}.plan.json`),
+      this.containedPath(`${sessionId}.tasks.json`),
+      this.containedPath(`${sessionId}.todos.json`),
+      path2.join(path2.dirname(transcript), path2.basename(sessionId))
+    ];
+    const trashRoot = path2.join(this.sessionsDir, "_trash", lease.leaseId);
+    fs2.mkdirSync(trashRoot, { recursive: true, mode: 448 });
+    const moved = [];
+    try {
+      artifacts.forEach((artifact, index) => {
+        if (!fs2.existsSync(artifact)) return;
+        const target = path2.join(trashRoot, `${index}-${path2.basename(artifact)}`);
+        fs2.renameSync(artifact, target);
+        moved.push({ from: artifact, to: target });
+      });
+      this.transaction(() => {
+        const current = this.db.prepare(
+          "SELECT 1 AS yes FROM maintenance_leases WHERE session_id=? AND lease_id=? AND holder_id=? AND operation=? AND expires_at>?"
+        ).get(sessionId, lease.leaseId, lease.holderId, "delete", Date.now());
+        if (!current) throw conflict("Delete maintenance lease expired while staging artifacts");
+        this.db.prepare("DELETE FROM sessions WHERE session_id=?").run(sessionId);
+        this.db.prepare("DELETE FROM maintenance_leases WHERE session_id=?").run(sessionId);
+        this.bumpGeneration();
+      });
+    } catch (error) {
+      for (const item of moved.reverse()) {
+        try {
+          fs2.mkdirSync(path2.dirname(item.from), { recursive: true, mode: 448 });
+          fs2.renameSync(item.to, item.from);
+        } catch {
+        }
+      }
+      throw error;
+    }
+    try {
+      fs2.rmSync(trashRoot, { recursive: true, force: true });
+      const trashParent = path2.dirname(trashRoot);
+      if (fs2.readdirSync(trashParent).length === 0) fs2.rmdirSync(trashParent);
+    } catch {
+    }
+  }
+  prune(maxAgeDays, holderId) {
+    if (!Number.isFinite(maxAgeDays) || maxAgeDays < 0) throw new TypeError("Invalid prune age");
+    const cutoff = Date.now() - maxAgeDays * 864e5;
+    const candidates = this.db.prepare("SELECT session_id FROM sessions WHERE transcript_mtime_ms<?").all(cutoff);
+    let deleted = 0;
+    for (const { session_id: id } of candidates) {
+      try {
+        const lease = this.acquireMaintenance(id, "delete", holderId);
+        this.delete(id, lease);
+        deleted++;
+      } catch (error) {
+        if (error.name !== "SessionOwnershipConflictError") throw error;
+      }
+    }
+    return deleted;
+  }
+  rebuildCatalog() {
+    const summaries = this.walkFiles(this.sessionsDir, ".summary.json");
+    const transcripts = this.walkFiles(this.sessionsDir, ".jsonl").filter(
+      (file) => !file.endsWith("_index.jsonl")
+    );
+    const ids = /* @__PURE__ */ new Set();
+    for (const file of [...summaries, ...transcripts]) {
+      const relative3 = path2.relative(this.sessionsDir, file).replaceAll("\\", "/");
+      ids.add(relative3.replace(/\.summary\.json$|\.jsonl$/, ""));
+    }
+    let indexed = 0;
+    let damaged = 0;
+    this.transaction(() => {
+      this.db.prepare("DELETE FROM sessions").run();
+      for (const id of ids) {
+        try {
+          const summaryFile = this.containedPath(`${id}.summary.json`);
+          const summary = fs2.existsSync(summaryFile) ? parseJson(fs2.readFileSync(summaryFile, "utf8")) : this.summarizeTranscript(id);
+          if (!summary || summary.id !== id) throw new Error("summary identity mismatch");
+          const transcript = this.containedPath(`${id}.jsonl`);
+          const stat = fs2.existsSync(transcript) ? fs2.statSync(transcript) : void 0;
+          const now = (/* @__PURE__ */ new Date()).toISOString();
+          this.db.prepare(
+            "INSERT INTO sessions(session_id,transcript_relative_path,summary_relative_path,summary_json,transcript_size,transcript_mtime_ms,summary_revision,indexed_at,damaged) VALUES (?,?,?,?,?,?,?,?,0)"
+          ).run(
+            id,
+            `${id}.jsonl`,
+            `${id}.summary.json`,
+            JSON.stringify(summary),
+            stat?.size ?? 0,
+            stat?.mtimeMs ?? 0,
+            1,
+            now
+          );
+          indexed++;
+        } catch {
+          const now = (/* @__PURE__ */ new Date()).toISOString();
+          const fallback = {
+            id,
+            title: id,
+            startedAt: now,
+            model: "",
+            provider: "",
+            tokenTotal: 0
+          };
+          this.db.prepare(
+            "INSERT INTO sessions(session_id,transcript_relative_path,summary_relative_path,summary_json,summary_revision,indexed_at,damaged) VALUES (?,?,?,?,1,?,1)"
+          ).run(id, `${id}.jsonl`, `${id}.summary.json`, JSON.stringify(fallback), now);
+          damaged++;
+        }
+      }
+      this.db.prepare(
+        "INSERT INTO catalog_meta(key,value) VALUES ('last_reconciliation',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value"
+      ).run((/* @__PURE__ */ new Date()).toISOString());
+      this.bumpGeneration();
+    });
+    return { indexed, damaged };
+  }
+  walkFiles(root, suffix) {
+    const result = [];
+    const visit = (dir) => {
+      for (const entry of fs2.readdirSync(dir, { withFileTypes: true })) {
+        if (entry.isDirectory()) {
+          if (entry.name !== "_cas" && entry.name !== "_trash") visit(path2.join(dir, entry.name));
+        } else if (entry.isFile() && entry.name.endsWith(suffix))
+          result.push(path2.join(dir, entry.name));
+      }
+    };
+    visit(root);
+    return result;
+  }
+  summarizeTranscript(id) {
+    const file = this.containedPath(`${id}.jsonl`);
+    const lines = fs2.readFileSync(file, "utf8").split(/\r?\n/);
+    let start;
+    let endedAt;
+    let lastActivityAt;
+    let messageCount = 0;
+    let iterationCount = 0;
+    let toolCallCount = 0;
+    let compactionCount = 0;
+    let tokenTotal = 0;
+    for (const line of lines) {
+      if (!line) continue;
+      let event;
+      try {
+        event = parseJson(line);
+      } catch {
+        continue;
+      }
+      lastActivityAt = event.ts;
+      if (event.type === "session_start") start = event;
+      if (event.type === "session_end") endedAt = event.ts;
+      if (event.type === "message_appended" && (event.message.role === "user" || event.message.role === "assistant"))
+        messageCount++;
+      if (event.type === "llm_response") {
+        iterationCount++;
+        tokenTotal += event.usage.input + event.usage.output + (event.usage.cacheRead ?? 0) + (event.usage.cacheWrite ?? 0);
+      }
+      if (event.type === "tool_call_end") toolCallCount++;
+      if (event.type === "compaction") compactionCount++;
+    }
+    if (!start) throw new Error("missing session_start");
+    return {
+      id,
+      title: id,
+      startedAt: start.ts,
+      ...endedAt ? { endedAt } : {},
+      model: start.model,
+      provider: start.provider,
+      tokenTotal,
+      ...lastActivityAt ? { lastActivityAt } : {},
+      messageCount,
+      iterationCount,
+      toolCallCount,
+      compactionCount
+    };
+  }
+  health(base) {
+    this.reapExpired();
+    const count = (table, where = "") => Number(
+      this.db.prepare(`SELECT COUNT(*) AS count FROM ${table} ${where}`).get().count
+    );
+    const reconciliation = this.db.prepare("SELECT value FROM catalog_meta WHERE key='last_reconciliation'").get();
+    return {
+      ...base,
+      catalogRows: count("sessions"),
+      damagedRows: count("sessions", "WHERE damaged<>0"),
+      liveLeases: count("session_leases"),
+      reservations: count("resume_reservations"),
+      maintenanceLeases: count("maintenance_leases"),
+      generation: this.generation(),
+      ...reconciliation ? { lastReconciliation: reconciliation.value } : {}
+    };
+  }
+};
+
+// src/session-catalog/project-server.ts
+function parseArgs(argv) {
+  const values = /* @__PURE__ */ new Map();
+  for (let index = 0; index < argv.length; index++) {
+    const key = argv[index];
+    if (key?.startsWith("--") && argv[index + 1] !== void 0) values.set(key, argv[++index]);
+  }
+  const projectDir = values.get("--project-dir");
+  const projectRoot = values.get("--project-root");
+  if (!projectDir) throw new Error("Session Catalog project server requires --project-dir");
+  if (!projectRoot) throw new Error("Session Catalog project server requires --project-root");
+  return { projectDir: path3.resolve(projectDir), projectRoot: path3.resolve(projectRoot) };
+}
+useDaemonPerfDefaults();
+var parsed = parseArgs(process.argv.slice(2));
+var endpoint = sessionCatalogProjectServerEndpoint(parsed.projectDir);
+var metadataPath = sessionCatalogProjectServerMetadataPath(parsed.projectDir);
+var databasePath = path3.join(parsed.projectDir, "sessions", "catalog.sqlite");
+var startedAt = (/* @__PURE__ */ new Date()).toISOString();
+var instanceId = randomUUID2();
+var authToken = randomBytes2(32).toString("hex");
+var idleInput = Number(process.env["WRONGSTACK_SESSION_CATALOG_IDLE_MS"]);
+var idleMs = Number.isFinite(idleInput) && idleInput >= 100 ? idleInput : 5 * 6e4;
+var disconnectedIdleMs = Math.min(idleMs, 250);
+var serverInfo = {
+  protocolVersion: SESSION_CATALOG_PROTOCOL_VERSION,
+  pid: process.pid,
+  projectDir: parsed.projectDir,
+  projectRoot: parsed.projectRoot,
+  endpoint,
+  databasePath,
+  instanceId,
+  startedAt
+};
+process.title = `wrongstack-session-catalog:${path3.basename(parsed.projectRoot)}`;
+var store;
+var activeRequests = 0;
+var stopping = false;
+var idleTimer;
+var clients = /* @__PURE__ */ new Set();
+var MAX_CLIENTS = 256;
+var eventSequence = 0;
+var metadataReadyResolve;
+var metadataReady = new Promise((resolve4) => {
+  metadataReadyResolve = resolve4;
+});
+function send(state, message) {
+  if (state.socket.destroyed) return;
+  const encoded = encodeSessionCatalogMessage(message);
+  if (encoded.length > SESSION_CATALOG_MAX_FRAME_CHARS || state.socket.writableLength + encoded.length > 8 * 1024 * 1024) {
+    state.socket.destroy(new Error("Session Catalog client write buffer exceeded"));
+    return;
+  }
+  state.socket.write(encoded);
+}
+function requiredStore() {
+  if (!store) throw new Error("Session Catalog store is not ready");
+  return store;
+}
+var OPERATION_KEYS = {
+  ping: [],
+  claim_new: ["entry", "ownerInstanceId", "leaseMs"],
+  reconnect_lease: ["sessionId", "leaseId", "leaseSecret", "ownerInstanceId", "expiresAt"],
+  reserve_resume: ["targetSessionId", "requesterInstanceId", "currentSessionId", "reservationMs"],
+  activate_reservation: ["reservation", "entry", "leaseMs"],
+  cancel_reservation: ["reservationId", "requesterInstanceId"],
+  heartbeat: ["credential", "status"],
+  publish_agents: ["credential", "revision", "agents"],
+  mark_closing: ["credential"],
+  release: ["credential"],
+  list_live: [],
+  get_live: ["sessionId"],
+  subscribe: ["cursor"],
+  unsubscribe: [],
+  upsert_summary: ["summary", "transcriptRelativePath", "summaryRelativePath"],
+  list_catalog: ["limit", "search"],
+  resolve_id: ["query"],
+  get_summary: ["sessionId"],
+  rename: ["sessionId", "name"],
+  acquire_maintenance: ["sessionId", "operation", "holderId", "leaseMs"],
+  release_maintenance: ["lease"],
+  delete: ["sessionId", "lease"],
+  prune: ["maxAgeDays", "holderId"],
+  rebuild_catalog: []
+};
+function validateOperationArgs(op, args) {
+  if (!(op in OPERATION_KEYS)) throw new TypeError(`Unknown Session Catalog operation: ${op}`);
+  if (!args || typeof args !== "object" || Array.isArray(args))
+    throw new TypeError(`Session Catalog ${op} args must be an object`);
+  const allowed = new Set(OPERATION_KEYS[op]);
+  const unknown = Object.keys(args).filter((key) => !allowed.has(key));
+  if (unknown.length > 0)
+    throw new TypeError(`Session Catalog ${op} rejected unknown field(s): ${unknown.join(", ")}`);
+  const record = args;
+  const exact = (value, label, keys) => {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      throw new TypeError(`${label} must be an object`);
+    const permitted = new Set(keys);
+    const extra = Object.keys(value).filter((key) => !permitted.has(key));
+    if (extra.length > 0)
+      throw new TypeError(`${label} rejected unknown field(s): ${extra.join(", ")}`);
+  };
+  const credentialKeys = ["sessionId", "leaseId", "leaseSecret", "ownerInstanceId", "expiresAt"];
+  const reservationKeys = ["reservationId", "targetSessionId", "requesterInstanceId", "expiresAt"];
+  const maintenanceKeys = ["sessionId", "operation", "holderId", "leaseId", "expiresAt"];
+  const entryKeys = [
+    "sessionId",
+    "projectSlug",
+    "projectRoot",
+    "projectName",
+    "workingDir",
+    "clientType",
+    "gitBranch",
+    "status",
+    "pid",
+    "startedAt",
+    "lastHeartbeatAt",
+    "agentCount",
+    "agents",
+    "webuiEndpoint"
+  ];
+  if (record["credential"] !== void 0)
+    exact(record["credential"], `${op}.credential`, credentialKeys);
+  if (record["reservation"] !== void 0)
+    exact(record["reservation"], `${op}.reservation`, reservationKeys);
+  if (record["lease"] !== void 0) exact(record["lease"], `${op}.lease`, maintenanceKeys);
+  if (record["entry"] !== void 0) exact(record["entry"], `${op}.entry`, entryKeys);
+  if (record["entry"] && typeof record["entry"] === "object") {
+    const entry = record["entry"];
+    if (typeof entry["projectRoot"] !== "string" || (process.platform === "win32" ? path3.resolve(entry["projectRoot"]).toLowerCase() !== parsed.projectRoot.toLowerCase() : path3.resolve(entry["projectRoot"]) !== parsed.projectRoot)) {
+      throw new TypeError(`${op}.entry project identity does not match this daemon`);
+    }
+    if (typeof entry["workingDir"] !== "string")
+      throw new TypeError(`${op}.entry workingDir is required`);
+    const relative3 = path3.relative(parsed.projectRoot, path3.resolve(entry["workingDir"]));
+    if (relative3 === ".." || relative3.startsWith(`..${path3.sep}`) || path3.isAbsolute(relative3)) {
+      throw new TypeError(`${op}.entry workingDir is outside the project root`);
+    }
+  }
+}
+async function dispatch(op, args) {
+  const catalog = requiredStore();
+  switch (op) {
+    case "ping": {
+      const memory = process.memoryUsage();
+      const handles = process._getActiveHandles?.().length ?? 0;
+      return catalog.health({
+        ...serverInfo,
+        checkedAt: Date.now(),
+        uptimeMs: Date.now() - Date.parse(startedAt),
+        clients: clients.size,
+        activeRequests,
+        memory,
+        handles
+      });
+    }
+    case "claim_new": {
+      const value = args;
+      return catalog.claimNew(
+        value.entry,
+        value.ownerInstanceId,
+        value.leaseMs
+      );
+    }
+    case "reconnect_lease":
+      return catalog.reconnectLease(
+        args
+      );
+    case "reserve_resume": {
+      const value = args;
+      return catalog.reserveResume(
+        value.targetSessionId,
+        value.requesterInstanceId,
+        value.currentSessionId,
+        value.reservationMs
+      );
+    }
+    case "activate_reservation": {
+      const value = args;
+      return catalog.activateReservation(
+        value.reservation,
+        value.entry,
+        value.leaseMs
+      );
+    }
+    case "cancel_reservation": {
+      const value = args;
+      catalog.cancelReservation(value.reservationId, value.requesterInstanceId);
+      return void 0;
+    }
+    case "heartbeat": {
+      const value = args;
+      return catalog.heartbeat(
+        value.credential,
+        value.status
+      );
+    }
+    case "publish_agents": {
+      const value = args;
+      return catalog.publishAgents(
+        value.credential,
+        value.revision,
+        value.agents
+      );
+    }
+    case "mark_closing": {
+      catalog.markClosing(args.credential);
+      return void 0;
+    }
+    case "release": {
+      catalog.release(args.credential);
+      return void 0;
+    }
+    case "list_live":
+      return catalog.listLive();
+    case "get_live":
+      return catalog.getLive(
+        args.sessionId
+      );
+    case "subscribe":
+      return { instanceId, sequence: eventSequence };
+    case "unsubscribe":
+      return void 0;
+    case "upsert_summary": {
+      const value = args;
+      return catalog.upsertSummary(
+        value.summary,
+        value.transcriptRelativePath,
+        value.summaryRelativePath
+      );
+    }
+    case "list_catalog": {
+      const value = args;
+      return catalog.listCatalog(
+        value.limit,
+        value.search
+      );
+    }
+    case "resolve_id":
+      return catalog.resolveId(
+        args.query
+      );
+    case "get_summary":
+      return catalog.getSummary(
+        args.sessionId
+      );
+    case "rename": {
+      const value = args;
+      return await catalog.rename(
+        value.sessionId,
+        value.name
+      );
+    }
+    case "acquire_maintenance": {
+      const value = args;
+      return catalog.acquireMaintenance(
+        value.sessionId,
+        value.operation,
+        value.holderId,
+        value.leaseMs
+      );
+    }
+    case "release_maintenance": {
+      catalog.releaseMaintenance(
+        args.lease
+      );
+      return void 0;
+    }
+    case "delete": {
+      const value = args;
+      catalog.delete(value.sessionId, value.lease);
+      return void 0;
+    }
+    case "prune": {
+      const value = args;
+      return catalog.prune(
+        value.maxAgeDays,
+        value.holderId
+      );
+    }
+    case "rebuild_catalog":
+      return catalog.rebuildCatalog();
+    default:
+      throw new Error(`Unsupported Session Catalog operation: ${String(op)}`);
+  }
+}
+function emitEvent(kind, sessionId) {
+  const event = {
+    instanceId,
+    sequence: ++eventSequence,
+    kind,
+    ...sessionId ? { sessionId } : {},
+    generation: requiredStore().generation(),
+    at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  for (const client of clients) {
+    if (client.subscribed) send(client, { type: "event", event });
+  }
+}
+function eventForOperation(op) {
+  switch (op) {
+    case "claim_new":
+    case "activate_reservation":
+      return "session.claimed";
+    case "publish_agents":
+      return "session.presence_changed";
+    case "mark_closing":
+      return "session.closing";
+    case "release":
+      return "session.released";
+    case "upsert_summary":
+    case "rename":
+      return "session.catalog_changed";
+    case "delete":
+      return "session.deleted";
+    case "rebuild_catalog":
+      return "session.rebuild_completed";
+    default:
+      return void 0;
+  }
+}
+async function handleMessage(state, message) {
+  if (!message || typeof message !== "object" || !Number.isSafeInteger(message.id)) {
+    state.socket.destroy(new Error("Invalid Session Catalog request"));
+    return;
+  }
+  if (message.authToken !== authToken) {
+    send(state, {
+      type: "response",
+      id: message.id,
+      ok: false,
+      error: "Unauthorized Session Catalog request",
+      errorName: "UnauthorizedSessionCatalogRequest"
+    });
+    return;
+  }
+  if (message.type === "shutdown") {
+    send(state, {
+      type: "response",
+      id: message.id,
+      ok: true,
+      result: { stopped: true, pid: process.pid }
+    });
+    setImmediate(() => void stop(message.reason ?? "client shutdown"));
+    return;
+  }
+  if (message.type !== "request" || typeof message.op !== "string") {
+    state.socket.destroy(new Error("Invalid Session Catalog request"));
+    return;
+  }
+  activeRequests++;
+  try {
+    validateOperationArgs(message.op, message.args);
+    if (message.op === "subscribe") state.subscribed = true;
+    if (message.op === "unsubscribe") state.subscribed = false;
+    if (message.op === "rebuild_catalog") emitEvent("session.rebuild_started");
+    const result = await dispatch(message.op, message.args);
+    send(state, { type: "response", id: message.id, ok: true, result });
+    const eventKind = eventForOperation(message.op);
+    if (eventKind) {
+      const args = message.args;
+      const nested = args["entry"];
+      const sessionId = typeof args["sessionId"] === "string" ? args["sessionId"] : typeof nested?.sessionId === "string" ? nested.sessionId : void 0;
+      emitEvent(eventKind, sessionId);
+    }
+  } catch (error) {
+    send(state, {
+      type: "response",
+      id: message.id,
+      ok: false,
+      error: error instanceof Error ? error.message : String(error),
+      ...error instanceof Error && error.name ? { errorName: error.name } : {}
+    });
+  } finally {
+    activeRequests--;
+    scheduleIdleStop();
+  }
+}
+function onData(state, chunk) {
+  state.buffer += chunk;
+  if (state.buffer.length > SESSION_CATALOG_MAX_FRAME_CHARS) {
+    state.socket.destroy(new Error("Session Catalog request exceeded frame limit"));
+    return;
+  }
+  while (true) {
+    const newline = state.buffer.indexOf("\n");
+    if (newline < 0) return;
+    const line = state.buffer.slice(0, newline);
+    state.buffer = state.buffer.slice(newline + 1);
+    if (!line) continue;
+    try {
+      void handleMessage(state, JSON.parse(line));
+    } catch {
+      state.socket.destroy(new Error("Invalid Session Catalog request"));
+      return;
+    }
+  }
+}
+function scheduleIdleStop(emptyIdleMs = idleMs) {
+  if (stopping || clients.size > 0 || activeRequests > 0 || idleTimer) return;
+  const hasLiveLease = requiredStore().listLive().length > 0;
+  idleTimer = setTimeout(
+    () => {
+      idleTimer = void 0;
+      if (requiredStore().listLive().length > 0) scheduleIdleStop(emptyIdleMs);
+      else void stop("idle timeout");
+    },
+    hasLiveLease ? 5e3 : emptyIdleMs
+  );
+  idleTimer.unref?.();
+}
+async function writeMetadata() {
+  await fsp.mkdir(parsed.projectDir, { recursive: true, mode: 448 });
+  const metadata = { ...serverInfo, authToken };
+  await atomicWrite(metadataPath, `${JSON.stringify(metadata, null, 2)}
+`, { mode: 384 });
+  await restrictFilePermissions(metadataPath, { label: "session-catalog-metadata" });
+}
+async function removeOwnedMetadata() {
+  try {
+    const current = JSON.parse(await fsp.readFile(metadataPath, "utf8"));
+    if (current.pid === process.pid && current.instanceId === instanceId)
+      await fsp.rm(metadataPath, { force: true });
+  } catch {
+  }
+}
+async function stop(_reason) {
+  if (stopping) return;
+  stopping = true;
+  if (idleTimer) clearTimeout(idleTimer);
+  for (const state of clients) state.socket.destroy();
+  clients.clear();
+  await new Promise((resolve4) => server.close(() => resolve4()));
+  store?.close();
+  store = void 0;
+  if (process.platform !== "win32") await fsp.rm(endpoint, { force: true }).catch(() => void 0);
+  await removeOwnedMetadata();
+}
+ensureSessionCatalogSocketDirectory(endpoint);
+var server = net.createServer((socket) => {
+  if (stopping) {
+    socket.destroy();
+    return;
+  }
+  if (clients.size >= MAX_CLIENTS) {
+    socket.destroy();
+    return;
+  }
+  if (idleTimer) clearTimeout(idleTimer);
+  idleTimer = void 0;
+  socket.setEncoding("utf8");
+  const state = { socket, buffer: "", subscribed: false };
+  clients.add(state);
+  void metadataReady.then(() => {
+    if (!socket.destroyed) send(state, { type: "hello", ...serverInfo });
+  });
+  socket.on("data", (chunk) => onData(state, chunk));
+  socket.on("close", () => {
+    clients.delete(state);
+    scheduleIdleStop(disconnectedIdleMs);
+  });
+});
+var probing = false;
+function listen() {
+  server.listen(endpoint);
+}
+server.on("error", (error) => {
+  if (error.code === "EADDRINUSE" && process.platform === "win32") {
+    process.exitCode = 0;
+    return;
+  }
+  if (error.code === "EADDRINUSE" && !probing) {
+    probing = true;
+    const probe = net.createConnection(endpoint);
+    probe.once("connect", () => {
+      probe.destroy();
+      process.exitCode = 0;
+    });
+    probe.once("error", () => {
+      probe.destroy();
+      try {
+        fs3.rmSync(endpoint, { force: true });
+      } catch {
+      }
+      probing = false;
+      listen();
+    });
+    return;
+  }
+  process.exitCode = 1;
+});
+server.on("listening", () => {
+  if (process.platform !== "win32") {
+    try {
+      fs3.chmodSync(endpoint, 384);
+    } catch {
+    }
+  }
+  try {
+    store = new SessionCatalogStore(parsed.projectDir);
+    void writeMetadata().then(() => metadataReadyResolve?.()).catch(() => void stop("metadata write failed"));
+  } catch {
+    void stop("catalog open failed");
+    return;
+  }
+  scheduleIdleStop();
+});
+process.once("SIGINT", () => void stop("SIGINT"));
+process.once("SIGTERM", () => void stop("SIGTERM"));
+listen();
+//# sourceMappingURL=project-server.js.map