cc-viewer 1.7.2 → 1.7.4

package/server/lib/session-start-bridge.js

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+/**
+ * session-start-bridge.js — SessionStart hook bridge for conversation-switch
+ * signals (in-terminal /resume, and future /clear / compact interest).
+ *
+ * Called by Claude Code whenever a session (re)starts: source is one of
+ * "startup" | "resume" | "clear" | "compact". The one that matters today is
+ * `resume` — an in-terminal /resume switches the running process to a PAST
+ * conversation while the wire session_id may stay the same, so without this
+ * signal cc-viewer keeps writing the resumed conversation into the OLD
+ * session dir and the [对话] panel never switches. The bridge forwards the
+ * hook payload to cc-viewer's /api/session-start-notify; the server gates on
+ * source and tells the V2Writer to re-bind routing (see v2-writer.js
+ * beginResumeSwitch).
+ *
+ * Hook config in ~/.claude/settings.json (injected by ensure-hooks.js, tagged
+ * `# cc-viewer-managed`):
+ *   "hooks": {
+ *     "SessionStart": [{ "hooks": [{ "type": "command",
+ *       "command": "[ -n \"$CCVIEWER_PORT\" ] && node /path/to/session-start-bridge.js || true # cc-viewer-managed" }] }]
+ *   }
+ *
+ * Output contract (same as turn-end-bridge.js): NOTHING on stdout — Claude
+ * Code interprets SessionStart hook stdout as context-injection JSON
+ * (hookSpecificOutput.additionalContext), and any stray bytes would pollute
+ * the conversation. Optional stderr only when CCVIEWER_DEBUG=1. Always exit 0
+ * so a failed notify never blocks Claude Code's hook chain.
+ */
+
+import { readFileSync } from 'node:fs';
+import http from 'node:http';
+import https from 'node:https';
+
+const debug = (msg) => {
+  if (process.env.CCVIEWER_DEBUG === '1') {
+    try { process.stderr.write(`[session-start-bridge] ${msg}\n`); } catch { /* ignore */ }
+  }
+};
+
+const port = process.env.CCVIEWER_PORT;
+const rawProtocol = process.env.CCVIEWER_PROTOCOL;
+const isHttps = rawProtocol === 'https';
+const httpClient = isHttps ? https : http;
+
+// cc-viewer not running — exit silently (stdout must stay clean, see header).
+if (!port) {
+  debug('CCVIEWER_PORT unset — exit silently');
+  process.exit(0);
+}
+
+// Drain stdin best-effort. Claude Code passes the hook JSON payload
+// ({session_id, transcript_path, source, cwd, ...}); capped to 64 KB to
+// defang any malformed huge payload.
+let stdinData = '';
+try {
+  const buf = readFileSync(0);
+  stdinData = (buf.length > 64 * 1024 ? buf.slice(0, 64 * 1024) : buf).toString('utf-8');
+} catch { /* stdin may not be piped — fine, still notify */ }
+let sessionId = null;
+let transcriptPath = null;
+let source = null;
+let cwd = null;
+try {
+  const parsed = JSON.parse(stdinData);
+  sessionId = parsed?.session_id || null;
+  transcriptPath = parsed?.transcript_path || null;
+  source = parsed?.source || null;
+  cwd = parsed?.cwd || null;
+} catch { /* fine — the server tolerates missing fields */ }
+debug(`payload source=${source} session_id=${sessionId} transcript=${transcriptPath}`);
+
+const internalToken = process.env.CCVIEWER_INTERNAL_TOKEN || '';
+const body = JSON.stringify({ source, sessionId, transcriptPath, cwd, ts: Date.now() });
+const reqOpts = {
+  hostname: '127.0.0.1',
+  port: parseInt(port, 10),
+  path: '/api/session-start-notify',
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Content-Length': Buffer.byteLength(body),
+    // Same anti-spoof header as turn-end-bridge: matched against the server's
+    // per-startup INTERNAL_TOKEN, env-leaked only to the claude child.
+    ...(internalToken ? { 'X-CCViewer-Internal': internalToken } : {}),
+  },
+  // Keep the timeout snappy so a stale cc-viewer never blocks the Claude Code
+  // hook chain for a noticeable beat.
+  timeout: 500,
+};
+if (isHttps) {
+  // Loopback HTTPS is typically self-signed; validation would reject.
+  reqOpts.rejectUnauthorized = false;
+}
+
+let exited = false;
+const finish = (reason) => {
+  if (exited) return;
+  exited = true;
+  if (reason) debug(reason);
+  process.exit(0);
+};
+
+let req;
+try {
+  req = httpClient.request(reqOpts, (res) => {
+    res.resume();
+    res.on('end', () => finish(`POST done (status=${res.statusCode})`));
+  });
+  req.on('error', (err) => finish(`POST error: ${err?.message}`));
+  req.on('timeout', () => { try { req.destroy(); } catch { /* ignore */ } finish('POST timeout'); });
+  // Wrap the synchronous write/end so an immediate EPIPE never bubbles into
+  // Claude Code's transcript (same defensive shape as turn-end-bridge).
+  try {
+    req.write(body);
+    req.end();
+  } catch (err) {
+    finish(`req.write threw: ${err?.message}`);
+  }
+} catch (err) {
+  finish(`request() threw: ${err?.message}`);
+}

package/server/lib/settings-merge.js

@@ -0,0 +1,170 @@
+import { readFileSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+// Settings files are tiny in practice; this caps a hostile `--settings /dev/zero`
+// (a never-EOF read that would hang the server event loop) or a huge-file read.
+const MAX_SETTINGS_FILE_BYTES = 1024 * 1024;
+
+// Merges a user-supplied `--settings` launch arg into cc-viewer's injected settings
+// object, so the final claude argv carries a SINGLE `--settings` flag.
+//
+// Why: claude's argv parser is last-wins for duplicate `--settings` (empirically
+// verified on 2.1.212 — not documented). cc-viewer prepends its injected flag before
+// user args, so a user-supplied `--settings` used to silently clobber the injected
+// env.ANTHROPIC_BASE_URL proxy override (breaking capture) and the CCV_IM_DENY
+// permissions.deny hardening. Merging keeps both: injected keys win, everything
+// else the user set rides along.
+//
+// Parse rules pinned by experiments against claude 2.1.212:
+// - Tokens after a literal `--` are prompt text, never flags → scan stops there.
+// - `--settings <next>` consumes the next token as its value unconditionally, even
+//   an option-like one (`--settings --print` → claude reads "--print" as a settings
+//   path and hard-errors). The helper mirrors that consumption.
+// - A trailing valueless `--settings` makes claude exit with "argument missing" →
+//   left in place so claude surfaces its own usage error, exactly as pre-fix.
+// - An empty `--settings=` does NOT error but still clobbers earlier `--settings`
+//   flags via last-wins (the most dangerous form) → always stripped.
+//
+// Known accepted limitation (shared with withDefaultThinkingDisplay / hasArg): a
+// literal "--settings" appearing before `--` as ANOTHER value-flag's argument
+// (e.g. `--append-system-prompt "--settings"`) is indistinguishable without a full
+// claude flag table. Probability negligible; bounded by the stop-at-`--` rule.
+
+const FLAG = '--settings';
+
+function stripBom(s) {
+  return s.charCodeAt(0) === 0xFEFF ? s.slice(1) : s;
+}
+
+function isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
+
+// Remove C0 control chars (and DEL) so a value/reason echoed into the embedded xterm
+// (via emitSpawnNotice) or a log line cannot inject ANSI escape sequences — the raw
+// user value and a JSON.parse SyntaxError can both carry ESC bytes.
+function stripControls(s) {
+  return String(s).replace(/[\u0000-\u001F\u007F]/g, '');
+}
+
+// Read + parse a user-pointed settings file DEFENSIVELY. The failure reason is echoed
+// into a client-readable surface (the persistent terminal buffer + logs), so it must
+// never disclose file contents or resolved paths — a raw readFileSync/JSON.parse error
+// embeds the leading file bytes and the absolute path, turning the warning into a
+// file-probing oracle. All failures collapse to generic, content-free messages; a
+// statSync isFile()+size gate blocks /dev/zero-style hangs and oversized reads.
+function readSettingsFile(path) {
+  let st;
+  try { st = statSync(path); } catch { throw new Error('settings file not found'); }
+  if (!st.isFile()) throw new Error('settings path is not a regular file');
+  if (st.size > MAX_SETTINGS_FILE_BYTES) throw new Error('settings file too large');
+  let raw;
+  try { raw = stripBom(readFileSync(path, 'utf8')); } catch { throw new Error('settings file could not be read'); }
+  let parsed;
+  try { parsed = JSON.parse(raw); } catch { throw new Error('settings file is not valid JSON'); }
+  if (!isPlainObject(parsed)) throw new Error('settings file must be a JSON object');
+  return parsed;
+}
+
+// Load a --settings value the way claude does: inline JSON when it looks like an
+// object literal, otherwise a settings file path (resolved against the cwd claude
+// itself will run with). Throws on any failure — caller turns that into a warning.
+function loadSettingsValue(value, cwd) {
+  const trimmed = stripBom(value).trim();
+  if (trimmed === '') throw new Error('empty value');
+  if (trimmed.startsWith('{')) {
+    // Inline JSON is the user's own text; echoing it back on failure is not disclosure
+    // (control chars are stripped at the warning surface). File contents are different —
+    // handled by readSettingsFile, which never surfaces them.
+    const parsed = JSON.parse(trimmed);
+    if (!isPlainObject(parsed)) throw new Error('settings must be a JSON object');
+    return parsed;
+  }
+  return readSettingsFile(resolve(cwd, trimmed));
+}
+
+// Shallow top-level merge with two special cases; injected keys win. Deep-merging
+// other keys (hooks, statusLine, ...) would splice into structures the user owns.
+function mergeSettings(userSettings, injectedSettings) {
+  const merged = { ...userSettings };
+  for (const [key, injectedValue] of Object.entries(injectedSettings)) {
+    if (key === 'env' && isPlainObject(merged.env)) {
+      merged.env = { ...merged.env, ...injectedValue };
+    } else if (key === 'permissions' && isPlainObject(merged.permissions)) {
+      const userDeny = Array.isArray(merged.permissions.deny) ? merged.permissions.deny : [];
+      const injectedDeny = Array.isArray(injectedValue.deny) ? injectedValue.deny : [];
+      merged.permissions = {
+        ...merged.permissions,
+        ...injectedValue,
+        deny: [...new Set([...userDeny, ...injectedDeny])],
+      };
+    } else {
+      merged[key] = injectedValue;
+    }
+  }
+  return merged;
+}
+
+/**
+ * Extract any user `--settings` occurrences from launch args and merge the last
+ * one into the injected settings object (injected keys win; permissions.deny is
+ * unioned). Never throws — a value that cannot be loaded is dropped and reported
+ * via `warningDetail` so the caller can surface it (injection must never block spawn).
+ *
+ * @param {unknown} args launch args (user-controlled; may contain non-strings)
+ * @param {object} injectedSettings cc-viewer's settings object (env.ANTHROPIC_BASE_URL, optional permissions.deny)
+ * @param {{cwd?: string}} [opts] base dir for relative settings file paths — must match the cwd claude runs with
+ * @returns {{args: unknown[], settingsJson: string, merged: boolean, warningDetail: {value: string, reason: string}|null}}
+ *   args: input args with consumed `--settings` occurrences removed;
+ *   settingsJson: JSON for the single injected flag (byte-identical to
+ *   JSON.stringify(injectedSettings) when nothing merged);
+ *   merged: whether a user value was folded in; warningDetail: load-failure parts
+ *   ({value, reason}, control-chars stripped) for the caller to render/localize —
+ *   the English sentence lives only in the `cli.settingsMergeFailed` i18n key, so
+ *   there is no duplicated copy here to drift.
+ */
+export function mergeSettingsIntoArgs(args, injectedSettings, { cwd = process.cwd() } = {}) {
+  const passthrough = { merged: false, warningDetail: null, settingsJson: JSON.stringify(injectedSettings) };
+  if (!Array.isArray(args)) return { args: [], ...passthrough };
+
+  const cleaned = [];
+  let lastValue = null; // last consumed --settings value (claude is last-wins)
+  for (let i = 0; i < args.length; i++) {
+    const token = args[i];
+    if (typeof token !== 'string') { cleaned.push(token); continue; }
+    if (token === '--') { cleaned.push(...args.slice(i)); break; }
+    if (token.startsWith(FLAG + '=')) {
+      lastValue = token.slice(FLAG.length + 1); // may be '' — still stripped (empty form clobbers via last-wins)
+      continue;
+    }
+    if (token === FLAG) {
+      if (i + 1 >= args.length) { cleaned.push(token); continue; } // trailing valueless: claude errors "argument missing" itself
+      lastValue = args[i + 1];
+      i++;
+      continue;
+    }
+    cleaned.push(token);
+  }
+
+  if (lastValue === null) return { args: cleaned, ...passthrough };
+
+  try {
+    if (typeof lastValue !== 'string') throw new Error('value is not a string');
+    const userSettings = loadSettingsValue(lastValue, cwd);
+    return {
+      args: cleaned,
+      settingsJson: JSON.stringify(mergeSettings(userSettings, injectedSettings)),
+      merged: true,
+      warningDetail: null,
+    };
+  } catch (err) {
+    const shown = typeof lastValue === 'string' ? lastValue : String(lastValue);
+    // Strip control chars: `shown` is raw user input and `err.message` from an inline
+    // JSON.parse can echo user bytes — both flow into the terminal buffer / logs.
+    return {
+      args: cleaned,
+      ...passthrough,
+      warningDetail: { value: stripControls(shown), reason: stripControls(err?.message || err) },
+    };
+  }
+}

package/server/lib/v2/live-feed.js

@@ -22,13 +22,15 @@
 // through log-watcher's processWatchedEntry pipeline — the same enrichment,
 // reconstruction and side-events the v1 tail produced.
 
-import { watch, existsSync, readdirSync, statSync, openSync, readSync, closeSync } from 'node:fs';
+import { watch, existsSync, readdirSync, readFileSync, statSync, openSync, readSync, closeSync } from 'node:fs';
 import { join } from 'node:path';
 import { reportSwallowed } from '../error-report.js';
 import { createIncrementalReconstructor } from '../delta-reconstructor.js';
 import { processWatchedEntry, sendEventToClients, sendEventRawToClients } from '../log-watcher.js';
 import { SessionSynthesizer } from './adapter.js';
 import { isDiscardableSession } from './session-select.js';
+import { isForeignLiveOwned } from './session-owner.js';
+import { isConvertRunning } from './convert-manager.js';
 import { computeCacheLoss } from './meta-rows.js';
 import { classifyRequest } from '../../../src/utils/requestType.js';
 
@@ -38,6 +40,12 @@ const DEFER_MS = 3000;          // synthesizer park deadline (lagging lines)
 const ATTACH_RECENT_MS = 5 * 60 * 1000; // pre-existing dirs considered "live"
 const TICK_RETRY_MS = 250;      // in-process tick raced the first queue drain
 const TICK_RETRY_MAX = 8;
+// Idle cursor eviction: a followed dir whose journal hasn't moved for this
+// long is detached, freeing its synthesizer/reconstructor state (a migration
+// can promote hundreds of dirs at once — holding all of them pins ~the whole
+// project in heap). Re-attach self-heals via the safety poll's mtime-bump
+// scan or the leader's tick() (both suppress history on a seen dir).
+const IDLE_EVICT_MS = 10 * 60 * 1000;
 
 const READ_CHUNK_BYTES = 8 * 1024 * 1024;
 // Node's max string length (~512MiB) — a longer line can never be decoded.
@@ -149,7 +157,11 @@ export class V2LiveFeed {
    * @param {number} [opts.safetyPollMs] - 0 disables the timer (tests drive
    *   _safetyTick manually)
    * @param {number} [opts.deferMs]
+   * @param {number} [opts.idleEvictMs] - 0 disables idle cursor eviction (tests)
    * @param {Function} [opts.now]
+   * @param {Function} [opts.isConvertRunningFn] - injection seam (tests)
+   * @param {Function} [opts.isForeignLiveOwnedFn] - injection seam (tests):
+   *   (dir) => boolean, defaults to session-owner's isForeignLiveOwned
    */
   constructor(opts = {}) {
     this._clients = opts.clients || [];
@@ -159,7 +171,14 @@ export class V2LiveFeed {
     this._watchImpl = opts.watchImpl || watch;
     this._safetyPollMs = typeof opts.safetyPollMs === 'number' ? opts.safetyPollMs : SAFETY_POLL_MS;
     this._deferMs = typeof opts.deferMs === 'number' ? opts.deferMs : DEFER_MS;
+    this._idleEvictMs = typeof opts.idleEvictMs === 'number' ? opts.idleEvictMs : IDLE_EVICT_MS;
     this._now = opts.now || Date.now;
+    this._isConvertRunning = opts.isConvertRunningFn || isConvertRunning;
+    // Claim owners are compared against THIS process's pid: the feed must
+    // co-reside with its V2Writer in one process (worker_threads would still
+    // share the pid; moving the feed into a forked CHILD process would make
+    // every own dir look foreign and break single-window live-follow).
+    this._isForeignLiveOwned = opts.isForeignLiveOwnedFn || isForeignLiveOwned;
     // Wire v3 (V3.S2): when on, every emitted item ALSO broadcasts a metadata
     // row (v2_requests_delta). Explicit ctor param — this module has no access
     // to the server deps object.
@@ -207,7 +226,12 @@ export class V2LiveFeed {
     if (!this._active || !sessionDir) return;
     let cur = this._sessions.get(sessionDir);
     if (!cur) {
-      cur = this._attach(sessionDir, { suppressExisting: false });
+      // A dir we have ALREADY seen re-attaching through tick() is an idle
+      // eviction (or a watcher loss) resuming — its backlog is history and
+      // must be seeded suppressed, or the re-attach replays the whole session
+      // through the broadcast path (the exact OOM this module was fixed for).
+      // Only a genuinely never-seen dir emits from byte 0.
+      cur = this._attach(sessionDir, { suppressExisting: this._seenDirs.has(sessionDir) });
       if (!cur) {
         if (_retries < TICK_RETRY_MAX) {
           setTimeout(() => this.tick(sessionDir, _retries + 1), TICK_RETRY_MS);
@@ -315,6 +339,16 @@ export class V2LiveFeed {
   _attach(dir, { suppressExisting }) {
     if (this._sessions.has(dir)) return this._sessions.get(dir);
     if (!existsSync(join(dir, 'journal.jsonl'))) return null;
+    // Multi-window isolation: a dir exclusively claimed by ANOTHER live ccv
+    // window (owner.lock, pid-liveness validity) never enters this feed — its
+    // traffic belongs to that window. Checked BEFORE the discard gate so a
+    // foreign dir never lands in _discardGated (whose delete side-effect would
+    // flip suppressExisting to false on a later attach and flood clients with
+    // the whole foreign history). Re-evaluated on every attach attempt — no
+    // persistent gate set — so a dead owner's claim stops mattering the
+    // moment its pid dies. Own dirs (tick path) and unclaimed teammate/IM
+    // dirs pass through untouched.
+    if (this._isForeignLiveOwned(dir)) return null;
     // Discardable sessions (quota-probe orphans — no main/teammate req, no
     // meta.leader) are never followed: single choke point, every attach path
     // (_initialScan / _maybeAttachNew / tick / _safetyTick / _rebuildCursor)
@@ -332,6 +366,32 @@ export class V2LiveFeed {
     // not swallow it: cross-process producers (IM worker, second ccv) have no
     // cold-load fallback for a connected client.
     if (this._discardGated.delete(dir)) suppressExisting = false;
+    // Migration output is dead history: converted sessions (meta origin:
+    // 'convert') have no producer and never append again, yet a promote
+    // renames dozens of them into sessions/ at once with fresh birthtimes —
+    // full-history seeding synthesized + JSON-round-tripped every entry of
+    // every promoted session inside the safety-poll/debounce timers (the
+    // 4GB main-thread OOM). Seek their cursors to EOF instead: nothing is
+    // read, cloned, or broadcast; the cold-load channel owns their history.
+    let convertOrigin = false;
+    try {
+      const meta = JSON.parse(readFileSync(join(dir, 'meta.json'), 'utf-8'));
+      convertOrigin = !!meta && meta.origin === 'convert';
+    } catch (err) {
+      // meta.json is written synchronously BEFORE the journal's first async
+      // drain (ensureSessionDirSync), so journal-present + meta-ABSENT is
+      // abnormal. Never fall through to a broadcast replay: mid-conversion
+      // (same-process check — the converter worker runs inside the server
+      // process) the dir is almost certainly a promote in flight — treat as
+      // convert output; a truly missing meta otherwise seeds suppressed (cold
+      // load covers the history). Any OTHER errno is a transient lock on an
+      // EXISTING meta (Windows AV/EBUSY) — keep the caller's suppress verdict:
+      // flipping a fresh live session to suppressed would silently drop its
+      // first turn (review finding).
+      reportSwallowed('v2-live.meta-read', err);
+      if (this._isConvertRunning()) convertOrigin = true;
+      else if (err && err.code === 'ENOENT') suppressExisting = true;
+    }
     const cur = {
       dir,
       synth: new SessionSynthesizer(dir, { deferMs: this._deferMs, now: this._now }),
@@ -348,24 +408,92 @@ export class V2LiveFeed {
       reading: false,
       dirty: false,
       suppress: !!suppressExisting,
+      convertOrigin,
+      // Journal req seqs with no done yet. The journal is only touched at
+      // request start and completion, so a single >10min request would look
+      // "idle" to the mtime-based eviction and get detached mid-flight — its
+      // completion would then re-attach suppressed and never resolve the
+      // already-broadcast placeholder (review finding). Eviction skips
+      // cursors with an open request. A crash orphan (req, no done ever)
+      // pins its one session un-evicted — acceptable: eviction is a memory
+      // optimization, a stuck live card is a correctness bug.
+      openReqs: new Set(),
     };
     this._sessions.set(dir, cur);
     this._seenDirs.set(dir, this._journalMtime(dir));
-    try {
-      cur.watcher = this._watchImpl(dir, () => this._scheduleRead(cur));
-      cur.watcher.on('error', (err) => {
+    if (!convertOrigin) {
+      try {
+        cur.watcher = this._watchImpl(dir, () => this._scheduleRead(cur));
+        cur.watcher.on('error', (err) => {
+          reportSwallowed('v2-live.session-watch', err);
+          try { cur.watcher.close(); } catch { /* already closed */ }
+          cur.watcher = null; // safety poll keeps the cursor alive
+        });
+      } catch (err) {
         reportSwallowed('v2-live.session-watch', err);
-        try { cur.watcher.close(); } catch { /* already closed */ }
-        cur.watcher = null; // safety poll keeps the cursor alive
-      });
-    } catch (err) {
-      reportSwallowed('v2-live.session-watch', err);
+      }
+      this._readCursor(cur); // seed (suppressed history or brand-new content)
+    } else {
+      // No per-dir watcher either: a promote can bring hundreds of dead dirs
+      // at once and each fs.watch costs an fd. The safety poll's unconditional
+      // _readCursor still picks up any (theoretical) append past the seeked
+      // offsets until idle eviction reclaims the cursor.
+      this._seekCursorsToEof(cur);
     }
-    this._readCursor(cur); // seed (suppressed history or brand-new content)
     cur.suppress = false;
     return cur;
   }
 
+  /** Position every cursor of a session at the current end of its file —
+   *  attach without reading: nothing existing is synthesized or emitted, only
+   *  bytes appended AFTER this point would flow. Enumerates ALL conv epoch
+   *  files up front so pre-existing epochs can't be replayed from 0 later. */
+  _seekCursorsToEof(cur) {
+    const sizeOf = (p) => {
+      try { return statSync(p).size; } catch (err) {
+        if (err && err.code === 'ENOENT') return 0; // missing file: offset 0 IS its EOF
+        // Any other stat failure must never seed offset 0 — that re-arms the
+        // full replay this seek exists to prevent. Park the cursor past any
+        // real size; a later successful read sees size < offset and rebuilds.
+        reportSwallowed('v2-live.seek-stat', err);
+        return Number.MAX_SAFE_INTEGER;
+      }
+    };
+    cur.journal.offset = sizeOf(cur.journal.path);
+    cur.responses.offset = sizeOf(cur.responses.path);
+    for (const { key, path } of this._enumerateConvFiles(cur.dir)) {
+      cur.convFiles.set(path, { key, path, offset: sizeOf(path) });
+    }
+  }
+
+  /** Enumerate a session's conversation epoch files as [{key, path}], epochs
+   *  numerically ordered within each conv key — the single home of the
+   *  two-level conversations/<key>/e<N>.jsonl walk (shared by the EOF-seek
+   *  attach and the incremental reader; review dedup). NB: file order is NOT
+   *  guaranteed to be globally seq-ordered (a pre-fix writer restart appended
+   *  newer seqs into an older epoch file) — the synthesizer's ingestConvLine
+   *  keeps its event window seq-sorted on insert, so consumers only need a
+   *  stable feed order. */
+  _enumerateConvFiles(dir) {
+    const convRoot = join(dir, 'conversations');
+    const out = [];
+    let keys = [];
+    try {
+      keys = readdirSync(convRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    } catch {
+      return out; // no conversations dir yet
+    }
+    for (const key of keys) {
+      let files = [];
+      try {
+        files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f));
+      } catch { continue; }
+      files.sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
+      for (const f of files) out.push({ key, path: join(convRoot, key, f) });
+    }
+    return out;
+  }
+
   _closeCursor(cur) {
     if (cur.debounce) { clearTimeout(cur.debounce); cur.debounce = null; }
     if (cur.watcher) { try { cur.watcher.close(); } catch { /* already closed */ } cur.watcher = null; }
@@ -405,7 +533,11 @@ export class V2LiveFeed {
           try { line = JSON.parse(raw); } catch (err) {
             reportSwallowed('v2-live.journal-parse', new Error(`${cur.dir}: ${err.message}`));
           }
-          if (line) cur.synth.ingestJournalLine(line);
+          if (line) {
+            if (line.ph === 'req') cur.openReqs.add(line.seq);
+            else if (line.ph === 'done') cur.openReqs.delete(line.seq);
+            cur.synth.ingestJournalLine(line);
+          }
         }
         this._emitDrained(cur);
       } while (cur.dirty);
@@ -415,44 +547,22 @@ export class V2LiveFeed {
   }
 
   _feedConvFiles(cur) {
-    const convRoot = join(cur.dir, 'conversations');
-    if (!existsSync(convRoot)) return;
-    let keys = [];
-    try {
-      keys = readdirSync(convRoot, { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
-    } catch {
-      return;
-    }
-    for (const key of keys) {
-      let files = [];
-      try {
-        files = readdirSync(join(convRoot, key)).filter((f) => /^e\d+\.jsonl$/.test(f));
-      } catch {
-        continue;
+    for (const { key, path } of this._enumerateConvFiles(cur.dir)) {
+      let fc = cur.convFiles.get(path);
+      if (!fc) {
+        fc = { key, path, offset: 0 };
+        cur.convFiles.set(path, fc);
       }
-      // Numeric epoch order. NB: file order is NOT guaranteed to be globally
-      // seq-ordered (a pre-fix writer restart appended newer seqs into an
-      // older epoch file) — the synthesizer's ingestConvLine keeps its event
-      // window seq-sorted on insert, so feed order only needs to be stable.
-      files.sort((a, b) => Number(a.match(/\d+/)[0]) - Number(b.match(/\d+/)[0]));
-      for (const f of files) {
-        const p = join(convRoot, key, f);
-        let fc = cur.convFiles.get(p);
-        if (!fc) {
-          fc = { key, path: p, offset: 0 };
-          cur.convFiles.set(p, fc);
+      const lines = readNewLines(fc);
+      if (lines === null) { this._rebuildCursor(cur); return; }
+      for (const raw of lines) {
+        let ev = null;
+        try { ev = JSON.parse(raw); } catch (err) {
+          reportSwallowed('v2-live.conv-parse', new Error(`${cur.dir}/${key}: ${err.message}`));
         }
-        const lines = readNewLines(fc);
-        if (lines === null) { this._rebuildCursor(cur); return; }
-        for (const raw of lines) {
-          let ev = null;
-          try { ev = JSON.parse(raw); } catch (err) {
-            reportSwallowed('v2-live.conv-parse', new Error(`${cur.dir}/${key}: ${err.message}`));
-          }
-          if (ev) {
-            cur.synth.ingestConvLine(key, ev);
-            if (this._wireV3 && !cur.suppress) this._forwardNative(cur, 'conv', key, raw);
-          }
+        if (ev) {
+          cur.synth.ingestConvLine(key, ev);
+          if (this._wireV3 && !cur.suppress) this._forwardNative(cur, 'conv', key, raw);
         }
       }
     }
@@ -622,7 +732,38 @@ export class V2LiveFeed {
     if (!this._active) return;
     this._armRootWatcher(); // re-arm after errors / late directory creation
     // Attached sessions: unconditional slow re-read (fs.watch is lossy).
+    // Idle eviction first: a cursor whose journal has not moved for
+    // _idleEvictMs is detached, releasing its synthesizer/reconstructor/
+    // _v3PrevMain retained state (post-migration this is ~the whole project).
+    // _seenDirs keeps the mtime, so the existing mtime-bump scan below (or the
+    // leader's tick(), now suppress-on-seen) re-attaches on real new activity.
     for (const cur of [...this._sessions.values()]) {
+      // Multi-window isolation: an ATTACHED dir can turn foreign-owned after
+      // the fact — an unowned (dead-owner) dir followed since startup gets
+      // adopted by another window's `ccv -c`. The attach-time gate can't see
+      // that, so re-check here and detach before the unconditional re-read
+      // would stream the adopter's traffic into this window (bounded to one
+      // safety-poll period). _seenDirs keeps the current mtime so a later
+      // ownership release (owner exits) plus new activity re-attaches through
+      // the normal mtime-bump path below.
+      if (this._isForeignLiveOwned(cur.dir)) {
+        this._closeCursor(cur);
+        this._sessions.delete(cur.dir);
+        this._seenDirs.set(cur.dir, this._journalMtime(cur.dir));
+        continue;
+      }
+      // openReqs guard: never evict mid-flight — a long request keeps the
+      // journal mtime frozen between its req and done lines, and evicting
+      // then would strand its already-broadcast placeholder (see openReqs).
+      if (this._idleEvictMs > 0 && cur.openReqs.size === 0) {
+        const mtime = this._journalMtime(cur.dir);
+        if (mtime > 0 && this._now() - mtime > this._idleEvictMs) {
+          this._closeCursor(cur);
+          this._sessions.delete(cur.dir);
+          this._seenDirs.set(cur.dir, mtime);
+          continue;
+        }
+      }
       this._readCursor(cur);
     }
     // Unattached dirs: attach brand-new ones (missed root events) and