cc-viewer 1.9.0 → 1.9.2

package/server/lib/v2/resume-list.js

@@ -0,0 +1,150 @@
+// Per-project "recent sessions" list for the /resume hover list (2026-10).
+//
+// Serves the N most-recent sessions of ONE project (the currently-bound one),
+// for the header's current-project hover dropdown. Kept as a pure lib function
+// (no HTTP, no interceptor state) so it is unit-testable with a temp LOG_DIR and
+// an injectable `now` seam — same test posture as listV2LogsPage / deleteLogFiles.
+//
+// Scope: ONLY ccv's own v2 store is listed (sessions ccv actually proxied).
+//
+// Cost shape: a CHEAP meta.json pass per session (startTs + leader), plus a
+// bounded journal head-scan (sessionHasMainOrTeammateReq) that drops quota-probe
+// orphan dirs BEFORE they can occupy a top slot. Candidates are sorted
+// newest-first, sliced to the top `limit`, and only THEN run the EXPENSIVE
+// summarize (journal fold + dir walk + prompts head) via summarizeSessionPage —
+// which shares listV2Sessions' freshness-keyed row cache, so repeat hover-opens
+// are ~1-3ms. Fields the cheap pass cannot supply (sessionUuid from
+// meta.sessionId, running, pinnedId) are read fresh per call for the surviving
+// rows only, never from the cached row.
+
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { sanitizePathComponent } from './layout.js';
+import { listSessionIds } from './replay.js';
+import { summarizeSessionPage } from './session-list.js';
+import { sessionHasMainOrTeammateReq } from './session-select.js';
+import { readPin } from '../session-pin-store.js';
+import { LIVE_SESSION_MTIME_MS } from '../log-file-utils.js';
+import { reportSwallowed } from '@ccv/core/error-report';
+
+/**
+ * Liveness heuristic for the "running" placeholder column. A session is
+ * treated as possibly-live when its journal was appended within
+ * LIVE_SESSION_MTIME_MS. Coarse by design (a background-but-idle >5min session
+ * reads as not-running) — this is a display hint only. `now` is injectable for tests.
+ * @param {string} sessionDir
+ * @param {number} now - ms epoch
+ * @returns {boolean}
+ */
+function isRecentlyActive(sessionDir, now) {
+  try {
+    const st = statSync(join(sessionDir, 'journal.jsonl'));
+    return (now - st.mtimeMs) < LIVE_SESSION_MTIME_MS;
+  } catch { return false; }
+}
+
+/**
+ * List the `limit` most-recent v2 sessions of ONE project under `logDir`,
+ * newest-first. Row shape:
+ *   { source:'ccv', project, file, sessionUuid, startTs, turns, preview, running, pinnedId }
+ * - `project`     — the LOG_DIR subdirectory name (already sanitize-safe).
+ * - `file`        — v2 addressing token `v2:<project>/<dirName>` (dirName is
+ *                   `<ts>_<uuid>` or legacy `<uuid>`), for the existing
+ *                   open-log / live-tail paths.
+ * - `sessionUuid` — the Claude Code session UUID from meta.sessionId (NOT the
+ *                   dir name), the key the client uses to scope a `?sid=` view.
+ * - `pinnedId`    — the project's persisted pin value verbatim (readPin), a
+ *                   ts-based display id. The SERVER cannot map it to this row
+ *                   (the ts stable id is a frontend runtime _timestamp), so the
+ *                   row just carries it through; the CLIENT decides `selected`
+ *                   by comparing against its own session stable ids.
+ * - `running`     — coarse liveness placeholder (see isRecentlyActive).
+ *
+ * @param {string} logDir - LOG_DIR root (e.g. ~/.claude/cc-viewer).
+ * @param {object} [opts]
+ * @param {string} opts.project - the single project to list (required).
+ * @param {number} [opts.limit=10]
+ * @param {number} [opts.now] - ms epoch, injectable for tests.
+ * @returns {{ items: Array, total: number }}
+ */
+export function listResumeSessions(logDir, { project, limit = 10, now = Date.now() } = {}) {
+  const out = { items: [], total: 0 };
+  if (!project || project !== sanitizePathComponent(project)) return out;
+
+  const projectDir = join(logDir, project);
+  if (!logDir || !existsSync(projectDir)) return out;
+
+  // ── ccv's own v2 store (sessions ccv proxied). Cheap meta.json pass per
+  // session for startTs + leader ordering/filtering, no journal fold.
+  const candidates = [];
+  let sessionIds;
+  try { sessionIds = listSessionIds(projectDir); } catch (err) {
+    reportSwallowed('resume-list.readdir', err, { project });
+    return out;
+  }
+  for (const dirName of sessionIds) {
+    let meta = null;
+    try { meta = JSON.parse(readFileSync(join(projectDir, 'sessions', dirName, 'meta.json'), 'utf-8')); } catch { /* journal is self-describing */ }
+    if (meta && meta.leader) continue; // teammate — folded into its leader's row
+    // Cheap discardable-session pre-check (bounded journal head-scan, early
+    // exit on the first main/teammate req): drops quota-probe orphan dirs
+    // BEFORE they can occupy a top-`limit` slot — without paying the full
+    // summarize (journal fold + dir walk) for every candidate. Same source
+    // predicate as session-list's isDiscardableSession (leader-absent + no
+    // main/teammate req), so a probe is filtered here and the summarize-time
+    // `discard` re-check below becomes a no-op for survivors.
+    if (!sessionHasMainOrTeammateReq(join(projectDir, 'sessions', dirName))) continue;
+    candidates.push({
+      project,
+      projectDir,
+      dirName,
+      startTs: (meta && meta.startTs) || '',
+      sessionUuid: (meta && meta.sessionId) || null,
+    });
+  }
+
+  // Order newest-first, then take the top `limit` BEFORE the expensive
+  // summarize (journal fold + dir walk + prompts head) — so a large history
+  // pays the summarize for at most `limit` rows, not for every session. Rows
+  // dropped by the summarize-time filters (teammate fold / quota-probe orphan /
+  // unreadable) leave their slot empty rather than being back-filled; such rows
+  // are rare and `limit` is small, so the occasional short list is accepted in
+  // exchange for the bounded cost.
+  candidates.sort((a, b) =>
+    b.startTs.localeCompare(a.startTs)
+    || String(b.dirName || '').localeCompare(String(a.dirName || '')));
+  const top = candidates.slice(0, limit);
+
+  const ccvRows = [];
+  for (const c of top) {
+    let s = null;
+    try { s = summarizeSessionPage(c.projectDir, c.dirName); } catch (err) {
+      reportSwallowed('resume-list.summarize', err, { project: c.project, dirName: c.dirName });
+      continue;
+    }
+    if (!s) continue;
+    if (s.leader) continue;
+    if (s.size === 0) continue;
+    if (s.discard) continue; // quota-probe orphans: never listed
+    const sessionDir = join(c.projectDir, 'sessions', c.dirName);
+    ccvRows.push({
+      source: 'ccv',
+      project: c.project,
+      file: `v2:${c.project}/${s.sid}`,
+      sessionUuid: c.sessionUuid,
+      startTs: s.startTs,
+      turns: s.turns,
+      preview: s.preview || [],
+      running: isRecentlyActive(sessionDir, now),
+      // The pin lives at the PROJECT dir and holds a ts-based display id, not a
+      // uuid — pass it through verbatim; the client maps it to a row.
+      pinnedId: readPin(c.projectDir),
+    });
+  }
+
+  // Already newest-first from the candidate sort (the summarize filter only
+  // drops rows, never reorders). total = surviving rows shown (≤ limit).
+  out.total = ccvRows.length;
+  out.items = ccvRows;
+  return out;
+}

package/server/lib/v2/session-select.js

@@ -23,7 +23,7 @@ import { existsSync, readFileSync, openSync, readSync, closeSync } from 'node:fs
 import { join } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { listSessionIds } from './replay.js';
-import { isSupportedWireFormat } from './layout.js';
+import { isSupportedWireFormat, normalizeSessionCwd } from './layout.js';
 import { isForeignLiveOwned } from './session-owner.js';
 
 /**
@@ -261,12 +261,21 @@ export function isDiscardableSession(dir, meta) {
  * (getLiveLogSource fallback, _resolveAdoption) pass true; default false keeps
  * the raw picker semantics for everything else.
  * @param {string} projectDir - absolute LOG_DIR/<project>
- * @param {{excludeDir?: string, skipForeignLive?: boolean}} [opts]
+ * @param {{excludeDir?: string, skipForeignLive?: boolean, instanceKey?: string, targetCwd?: string}} [opts]
+ *   `instanceKey` (multi-instance, 2026-10-06): when set, only consider session dirs whose
+ *   meta.json `instance` matches it — so two concurrent same-cwd instances (sharing one
+ *   basename project dir but distinct session dirs) each resolve to THEIR OWN latest session.
+ *   Dirs with no `instance` (legacy / external producers) are EXCLUDED under this filter.
+ *   `targetCwd` (same-name isolation, 2026-10-07): when set WITH `instanceKey`, scopes the
+ *   cross-instance FALLBACK pool to sessions stamped with this cwd (or with NO meta.cwd —
+ *   keep-missing). Applies ONLY to the fallback pool, never the instance filter; an empty
+ *   value disables the cwd filter. No effect without `instanceKey`.
  * @returns {{dir:string, sessionId:string}|null}
  */
-export function latestMainSession(projectDir, { excludeDir = '', skipForeignLive = false } = {}) {
+export function latestMainSession(projectDir, { excludeDir = '', skipForeignLive = false, instanceKey = '', targetCwd = '' } = {}) {
   if (!projectDir) return null;
-  const candidates = []; // { dir, sessionId, startTs }
+  const instanceCandidates = []; // session dirs stamped with the requested instanceKey
+  const projectCandidates = [];  // every eligible session dir of the project (any/no instance)
   for (const name of listSessionIds(projectDir)) {
     const dir = join(projectDir, 'sessions', name);
     if (excludeDir && dir === excludeDir) continue;
@@ -282,24 +291,64 @@ export function latestMainSession(projectDir, { excludeDir = '', skipForeignLive
     // folds in its siblings when rendered, so a teammate dir loaded directly
     // renders wrong. Keep only main (leader-less) sessions.
     if (meta.leader) continue;
-    candidates.push({ dir, sessionId: meta.sessionId || '', startTs: meta.startTs || '' });
+    const cand = {
+      dir,
+      sessionId: meta.sessionId || '',
+      startTs: meta.startTs || '',
+      // Same-name isolation (2026-10-07): the session's owning cwd (absent on legacy
+      // dirs → null). Read once here from the already-parsed meta; used ONLY to scope
+      // the cross-instance fallback pool below, never the instance filter. Normalized
+      // with the SAME lexical normalizer the writer/read side use, so the comparison
+      // stays symmetric even when a raw cwd carries `.`/`..`/duplicate separators.
+      metaCwd: (typeof meta.cwd === 'string' && meta.cwd) ? normalizeSessionCwd(meta.cwd) : null,
+    };
+    projectCandidates.push(cand);
+    if (instanceKey && meta.instance === instanceKey) instanceCandidates.push(cand);
   }
-  // Newest first, then return the first that actually has a main turn — skipping
-  // a not-yet-activated newest session (the refresh-bug fix).
-  candidates.sort((a, b) => (a.startTs < b.startTs ? 1 : a.startTs > b.startTs ? -1 : 0));
-  for (const c of candidates) {
-    if (sessionHasMainTurn(c.dir)) return { dir: c.dir, sessionId: c.sessionId };
+  const byNewest = (a, b) => (a.startTs < b.startTs ? 1 : a.startTs > b.startTs ? -1 : 0);
+  const newestWithMainTurn = (list) => {
+    const sorted = [...list].sort(byNewest);
+    for (const c of sorted) { if (sessionHasMainTurn(c.dir)) return c; }
+    return null;
+  };
+  // Multi-instance (2026-10-06): "show the instance's session when it has content, else fall
+  // back to the project's latest session WITH content" (user-pinned). An instance that exists
+  // but has only sub/system requests (no user main turn — a freshly-spawned same-cwd twin, or
+  // one rebuilt by a server restart) must NOT blank the view with its empty shell, and must
+  // NOT hard-error as "not found" either. Scope: instance-with-content → that; else → the
+  // project's newest content-bearing session (the history the user actually wants back).
+  if (instanceKey) {
+    const own = newestWithMainTurn(instanceCandidates);
+    if (own) return own;
+    // Same-name isolation (2026-10-07): scope the cross-instance fallback to the
+    // TARGET cwd so a cross-dir same-basename project sharing this pool can't be
+    // served. Keep-missing: legacy dirs with NO meta.cwd (null) stay eligible —
+    // excluding them would re-create the historical "excluded history" regression
+    // (sid-not-found / mis-detach). Same-cwd candidates always match, so same-cwd
+    // twin collaboration is unaffected. An empty targetCwd (instance dead / cwd
+    // unknown) disables the filter entirely — conservative, identical to today.
+    // This filters ONLY the fallback pool (projectCandidates), NEVER
+    // instanceCandidates above — an adopted/resumed dir's meta.cwd belongs to its
+    // original author and must not disqualify it from its own instance filter.
+    const fallbackPool = targetCwd
+      ? projectCandidates.filter((c) => c.metaCwd == null || c.metaCwd === targetCwd)
+      : projectCandidates;
+    const proj = newestWithMainTurn(fallbackPool);
+    if (proj) return proj;
+    // Nothing with a main turn anywhere: degrade to the instance's own newest dir (a truly
+    // fresh project) — still strictly this instance, never another's.
+    const ownAny = [...instanceCandidates].sort(byNewest)[0];
+    return ownAny || null;
   }
-  return null;
+  return newestWithMainTurn(projectCandidates);
 }
 
 /**
  * Absolute dir of the newest readable, non-teammate session that HAS a main
  * turn, or '' if there is none. Thin wrapper over {@link latestMainSession}.
  * @param {string} projectDir - absolute LOG_DIR/<project>
- * @param {{excludeDir?: string, skipForeignLive?: boolean}} [opts] - see {@link latestMainSession}
+ * @param {{excludeDir?: string, skipForeignLive?: boolean, instanceKey?: string, targetCwd?: string}} [opts] - see {@link latestMainSession}
  * @returns {string} absolute session dir, or ''
  */
-export function latestMainSessionDir(projectDir, opts) {
-  return latestMainSession(projectDir, opts)?.dir || '';
+export function latestMainSessionDir(projectDir, opts) {  return latestMainSession(projectDir, opts)?.dir || '';
 }

package/server/lib/v2/v2-writer.js

@@ -17,10 +17,10 @@
 // correctness dependency.
 
 import { statfsSync, existsSync, readdirSync, readFileSync } from 'node:fs';
-import { join, basename } from 'node:path';
+import { join, basename, sep } from 'node:path';
 import { AsyncWriteQueue } from '../async-write-queue.js';
 import { reportSwallowed } from '@ccv/core/error-report';
-import { ensureSessionDirSync, compactLocalTs14, sanitizePathComponent } from './layout.js';
+import { ensureSessionDirSync, compactLocalTs14, sanitizePathComponent, normalizeSessionCwd } from './layout.js';
 import { resolveSessionDirName, latestMainSession } from './session-select.js';
 import { acquireSessionClaim, releaseSessionClaim, isForeignLiveOwned } from './session-owner.js';
 import { BlobStore } from './blob-store.js';
@@ -78,6 +78,10 @@ export class V2Writer {
     // in-process live cursor can read the fresh appends with zero fs-watch
     // latency. Purely a nudge — the feed's data source stays the files.
     this._onActivity = typeof opts.onActivity === 'function' ? opts.onActivity : null;
+    // Fired once per request that resolves a (sid, project) pair — lets the
+    // server feed a PTY's sessionId index (pty-manager.setPtySessionId) so chat
+    // sends can be routed to the PTY owning that conversation (2026-10-05).
+    this._onSessionResolved = typeof opts.onSessionResolved === 'function' ? opts.onSessionResolved : null;
     this._sessions = new Map(); // sessionId → {paths, blobs, journal, convs, resolver}
     // Multi-window isolation (2026-07-17): session dirs this process has
     // claimed via owner.lock. Released synchronously in resetSessions()/close()
@@ -98,13 +102,16 @@ export class V2Writer {
     this._continuationLaunch = false;
     this._forkSession = false;
     this._resumeSession = false;
-    this._adopted = false;
+    // Per-project `-c` adoption latch (was a single boolean): each project may
+    // adopt at most once. Keyed by sanitized project so a scoped resetSessions(t)
+    // clears only project t's latch, not a background project's.
+    this._adopted = new Set();
     // In-terminal /resume switch (SessionStart hook, source:'resume'): the
     // next MAIN request must be re-routed to the resumed conversation's dir.
-    // {transcriptUuid, hookSid} | null; last-wins, consumed one-shot, no TTL
-    // (after a /resume the next main request belongs to the resumed
-    // conversation no matter how much later it is typed).
-    this._pendingResumeSwitch = null;
+    // Per-project (was a single value): keyed by sanitized project, so a scoped
+    // reset clears only the switched-away project's pending switch. Value:
+    // {transcriptUuid, hookSid}; consumed one-shot on the next main request.
+    this._pendingResumeSwitch = new Map();
   }
 
   /** P2: true once any session's FIRST main wire already carried assistant
@@ -131,6 +138,7 @@ export class V2Writer {
   /** Late wiring seam: the live feed is constructed by server.js AFTER this
    *  writer exists (module init order), so the nudge callback arrives here. */
   setOnActivity(fn) { this._onActivity = typeof fn === 'function' ? fn : null; }
+  setOnSessionResolved(fn) { this._onSessionResolved = typeof fn === 'function' ? fn : null; }
 
   /**
    * If this request should adopt the previous main session's folder — a `-c`
@@ -145,8 +153,14 @@ export class V2Writer {
    * history-less requests); and a previous main session exists.
    * @returns {{dirName:string, identityUUID:string}|null}
    */
+  /** Sanitized per-project key for the per-project latches (_adopted /
+   *  _pendingResumeSwitch). Single place so the latch keying can't drift. */
+  _projKey(project) {
+    return sanitizePathComponent(project || '');
+  }
+
   _resolveAdoption(sid, project, msgs, entry) {
-    if (this._adopted || this._leader) return null;
+    if (this._adopted.has(this._projKey(project)) || this._leader) return null;
     if (!this._continuationLaunch || this._forkSession || this._resumeSession) return null;
     if (this._sessions.has(sid)) return null;
     const m = Array.isArray(msgs) ? msgs
@@ -181,13 +195,17 @@ export class V2Writer {
    *  conversation was never recorded by ccv (it must not be the old wire sid:
    *  `<ts>_<oldSid>` would be re-resolved back to the OLD dir by
    *  resolveSessionDirName). Last-wins across repeated /resume picks. */
-  beginResumeSwitch({ transcriptUuid, hookSid } = {}) {
+  beginResumeSwitch({ transcriptUuid, hookSid, project } = {}) {
     try {
       if (!transcriptUuid || typeof transcriptUuid !== 'string') return;
-      this._pendingResumeSwitch = {
+      // Keyed by the project the resumed conversation belongs to (defaults to the
+      // currently-bound project — markSessionStart's guard already ensures the
+      // hook's cwd matches it). Per-project so a scoped reset clears only that one.
+      const key = sanitizePathComponent(project || this._projectFn() || '');
+      this._pendingResumeSwitch.set(key, {
         transcriptUuid,
         hookSid: (typeof hookSid === 'string' && hookSid) ? hookSid : null,
-      };
+      });
     } catch (err) {
       reportSwallowed('v2-write.resume-switch', err);
     }
@@ -210,8 +228,9 @@ export class V2Writer {
    * @returns {{dirName:string, identityUUID:string}}
    */
   _resolveResumeSwitch(sid, project, prevSid = null) {
-    const sw = this._pendingResumeSwitch;
-    this._pendingResumeSwitch = null; // one-shot
+    const key = this._projKey(project);
+    const sw = this._pendingResumeSwitch.get(key);
+    this._pendingResumeSwitch.delete(key); // one-shot
     const projectDir = join(this._logDir, sanitizePathComponent(project));
     let dirName = resolveSessionDirName(projectDir, sw.transcriptUuid, this._sessionsDirName);
     let identity = sw.transcriptUuid;
@@ -274,8 +293,17 @@ export class V2Writer {
     this._claimedDirs.clear();
   }
 
-  _session(sessionId, userIdRaw, encoding, project, startTsIso, adoptTarget = null) {
+  _session(sessionId, userIdRaw, encoding, project, startTsIso, adoptTarget = null, instanceKey = null, cwd = null) {
     let s = this._sessions.get(sessionId);
+    // Cross-project guard: the map is keyed by bare sid, so a sid reused across two
+    // projects (a cross-project /resume takeover running alongside its old project)
+    // would otherwise reuse the OTHER project's session object and cross-write into
+    // the wrong dir. On a project mismatch, drop the stale binding and rebuild for
+    // THIS project. The hot path (same project) stays an O(1) map hit.
+    if (s && s.project && project && sanitizePathComponent(s.project) !== sanitizePathComponent(project)) {
+      this._sessions.delete(sessionId);
+      s = null;
+    }
     if (s) return s; // hot path: map hit is O(1), the scan below only runs on miss
 
     // Task C: the dir name carries a creation-time prefix `<ts>_<uuid>`. On a
@@ -291,6 +319,18 @@ export class V2Writer {
       ...(userIdRaw && { userIdRaw }),
       ...(encoding && { userIdEncoding: encoding }),
       ...(this._leader && { leader: this._leader }),
+      // Multi-instance (2026-10-06): stamp the owning PTY instanceKey on the session dir's
+      // meta.json (first-write-wins), so two concurrent same-cwd claude instances — which
+      // share one basename project dir but mint DIFFERENT wire session UUIDs (different
+      // session dirs) — can each be told apart at the directory level by readers/feed/cold
+      // load. Absent for legacy/external producers (no self-report) → instance-agnostic.
+      ...(instanceKey && { instance: instanceKey }),
+      // Same-name session isolation (2026-10-07): stamp the session's owning full cwd so
+      // the read-side fallback can tighten by path, telling two cross-dir same-basename
+      // projects apart (basename routing cannot). First-write-wins, so an adopted/resumed
+      // dir keeps its ORIGINAL author's cwd — never relabeled by the adopting entry.
+      // Normalized lexically (no realpath) to match the read side's targetCwd.
+      ...(cwd && { cwd: normalizeSessionCwd(cwd) }),
       ...(this._metaExtra || {}),
     };
     const projectDir = join(this._logDir, sanitizePathComponent(project));
@@ -326,6 +366,11 @@ export class V2Writer {
       journal: new Journal(paths, this._queue),
       convs: new ConversationStore(paths, this._queue, { exactFps: this._exactConvFps }),
       resolver: new ConvResolver(),
+      // The project this session's dir lives under — needed by resetSessions(target)
+      // to clear ONLY one project's sessions on a workspace switch, leaving a
+      // concurrently-running background project's bindings (a cross-project /resume
+      // takeover's old project) intact.
+      project,
     };
     this._sessions.set(sessionId, s);
     return s;
@@ -362,7 +407,18 @@ export class V2Writer {
   ingestRequest(entry, originalMessages) {
     if (!this._enabled || !entry) return null;
     try {
-      const project = this._projectFn();
+      // Per-request project override (/resume global sessions): only when the
+      // interceptor resolved a child claude's own project from the
+      // x-ccv-project-dir header does it set `entry._resumeProject` (already
+      // sanitized). We MUST key off that explicit marker, NOT the generic
+      // `entry.project` — the latter is set for every request (to the process
+      // cwd basename) and would silently misroute the moment it diverges from
+      // the writer's bound project (e.g. fixtures / teammate reshuffles).
+      // Each entry carries its own override, so concurrent sessions from
+      // different projects never cross-assign. Falls back to the bound project.
+      const project = (typeof entry._resumeProject === 'string' && entry._resumeProject)
+        ? entry._resumeProject
+        : this._projectFn();
       if (!project) return null; // workspace not selected yet — mirrors v1's empty-LOG_FILE no-op
       if (!this._diskOk()) return null;
 
@@ -377,7 +433,41 @@ export class V2Writer {
       let sid;
       if (parsed) {
         sid = parsed.sessionId;
-        this._currentSid = sid;
+        // `_currentSid` = the session of the ACTIVE MAIN claude (the one whose cwd
+        // matches the server's currently-bound project). Every claude now
+        // self-reports its project via `x-ccv-project-dir` (spawnClaude injects it
+        // too, not just resume scratches), so `entry._resumeProject` is that
+        // claude's own project. Only the claude whose project == the bound project
+        // (`this._projectFn()`) is the main one — a kept-alive OLD project's
+        // background claude (header = old project ≠ bound) and resume scratches
+        // must NOT move `_currentSid`, or the /resume list's "current" blue dot
+        // would drift to whichever background session last emitted a request.
+        // A request with NO header at all (legacy / external producer) is treated
+        // as the main project's own (project === bound), preserving the old
+        // no-header behavior.
+        const entryProject = (typeof entry._resumeProject === 'string' && entry._resumeProject)
+          ? entry._resumeProject
+          : this._projectFn();
+        if (entryProject && entryProject === this._projectFn()) {
+          this._currentSid = sid;
+        }
+        // Feed the PTY sid index: this request's owning project just resolved a
+        // concrete sessionId, so the PTY serving that project can be addressed by
+        // sid. Multi-instance (2026-10-06): also forward the self-reported instanceKey
+        // (`_ccvInstance`) so the server can pin the sid to THIS exact process — basename
+        // routing cannot tell two same-cwd instances apart. Best-effort — a listener
+        // error must not break ingestion.
+        // MAIN-AGENT GATE (review P1, 2026-10-06): only pin a sid for the main interactive
+        // claude's own requests. A teammate/subagent child process INHERITS the parent's
+        // `ANTHROPIC_CUSTOM_HEADERS` (so it carries the parent's `x-ccv-instance`) but runs
+        // its OWN conversation/sid — without this gate it would overwrite the parent record's
+        // sessionId with the teammate's sid, mis-pinning the instance. Teammate / heartbeat /
+        // count_tokens requests are skipped.
+        const isMainAgentTurn = entry.mainAgent === true && !entry.teammate && !entry.isHeartbeat && !entry.isCountTokens;
+        if (this._onSessionResolved && entryProject && isMainAgentTurn) {
+          const instKey = (typeof entry._ccvInstance === 'string' && entry._ccvInstance) ? entry._ccvInstance : null;
+          try { this._onSessionResolved(sid, entryProject, instKey); } catch (err) { reportSwallowed('v2-write.session-resolved', err); }
+        }
       } else if (this._currentSid) {
         sid = this._currentSid; // §8.3 fallback: route metadata-less requests to the active session
       } else {
@@ -406,7 +496,7 @@ export class V2Writer {
         // probes and heartbeats wear main-agent body shapes but are not the
         // user's resumed turn — consuming on them would re-bind too early
         // with the same result, but keep the gate strict for clarity).
-        if (this._pendingResumeSwitch && entry.mainAgent
+        if (this._pendingResumeSwitch.has(this._projKey(project)) && entry.mainAgent
           && !entry.isCountTokens && !entry.isHeartbeat) {
           // Locally guarded (review P2): the switch resolution does dir-scan
           // fs work (resolveSessionDirName → readdirSync) whose residual
@@ -419,7 +509,7 @@ export class V2Writer {
         }
         if (!adoptTarget) {
           adoptTarget = this._resolveAdoption(sid, project, originalMessages, entry);
-          if (adoptTarget) this._adopted = true;
+          if (adoptTarget) this._adopted.add(this._projKey(project));
         }
       }
 
@@ -427,7 +517,9 @@ export class V2Writer {
       // the dir-name ts prefix (task C). First-write-wins: meta is only written
       // when the dir is first created, so this is the session's creation time
       // (live ≈ now; convert = the historical first-entry ts).
-      const s = this._session(sid, parsed && entry.body.metadata.user_id, parsed && parsed.encoding, project, entry.timestamp, adoptTarget);
+      const s = this._session(sid, parsed && entry.body.metadata.user_id, parsed && parsed.encoding, project, entry.timestamp, adoptTarget,
+        (typeof entry._ccvInstance === 'string' && entry._ccvInstance) ? entry._ccvInstance : null,
+        (typeof entry._resumeProjectCwd === 'string' && entry._resumeProjectCwd) ? entry._resumeProjectCwd : null);
 
       // System-prompt snapshot, Bind A (wire): the FIRST main request of a session
       // carries the launch's rendered injection in body.system — match it against the
@@ -682,6 +774,14 @@ export class V2Writer {
     return s ? s.paths.dir : null;
   }
 
+  /** The writer's current (fallback-routing) session UUID, or null before the
+   *  first sid-bearing request. Exposed so the /resume list can mark exactly ONE
+   *  row as the live "current" session (the multi-blue-dot fix) — the row whose
+   *  sessionUuid matches this id is the one the main process is actively running. */
+  currentSessionId() {
+    return this._currentSid || null;
+  }
+
   /** Lifecycle hook: drop in-memory conversation continuity so the next
    *  request snapshots fresh. Journal seq keeps counting (same process, same
    *  session dirs — seq must stay monotonic per session). NOTE: the
@@ -700,26 +800,64 @@ export class V2Writer {
     }
   }
 
-  /** Lifecycle hook (workspace switch): drop ALL cached session bindings so the
-   *  next request re-creates its session dir under the newly resolved project.
-   *  A sid that persists across the switch gets a fresh dir (and fresh seq)
-   *  under the new project — different directory, so no seq collision. */
-  resetSessions() {
+  /** Lifecycle hook (workspace switch): drop the TARGET project's cached session
+   *  bindings so the next request re-creates its session dir under the newly
+   *  resolved project. `targetProject` is the project being switched AWAY from —
+   *  only its sessions/claims are dropped, so a concurrently-running BACKGROUND
+   *  project (a cross-project /resume takeover's old project, still being written
+   *  via `entry._resumeProject`) keeps its bindings and continues uninterrupted.
+   *  With no argument (legacy callers) it clears everything, matching the old
+   *  behavior byte-for-byte. A sid that persists across the switch gets a fresh
+   *  dir (and fresh seq) under the new project — different directory, so no seq
+   *  collision. */
+  resetSessions(targetProject = null) {
     try {
+      const matchAll = targetProject == null;
+      const targetSan = matchAll ? null : sanitizePathComponent(targetProject);
       // Release live claims FIRST (before the session map is gone): a
       // switched-away workspace's dirs are dormant and legitimately adoptable
-      // by other windows from this moment on.
-      this._releaseAllClaims();
-      this._sessions.clear();
+      // by other windows from this moment on. Only the target project's claims
+      // are released on a scoped reset — the background project keeps its lock.
+      if (matchAll) {
+        this._releaseAllClaims();
+      } else {
+        // Match by the project dir prefix (<logDir>/<projectSan>) rather than by
+        // positional path segment — the old slice(-3,-2) index assumed a fixed
+        // <logDir>/<project>/sessions/<ts>_<sid> depth and broke when
+        // _sessionsDirName changed the layout (offline converter staging dirs).
+        const prefix = join(this._logDir, targetSan) + sep;
+        for (const dir of [...this._claimedDirs]) {
+          if (dir === join(this._logDir, targetSan) || dir.startsWith(prefix)) {
+            releaseSessionClaim(dir);
+            this._claimedDirs.delete(dir);
+          }
+        }
+      }
+      for (const [sid, s] of [...this._sessions]) {
+        if (matchAll || sanitizePathComponent(s.project || '') === targetSan) {
+          this._sessions.delete(sid);
+        }
+      }
       this._pendingNoSid.length = 0;
       this._lateHandles.clear();
-      this._currentSid = null;
-      // A second workspace's `-c` must be able to adopt afresh — the previous
-      // workspace's adoption doesn't carry over.
-      this._adopted = false;
-      // A /resume signal armed in the previous workspace context is
-      // meaningless after the switch (its transcript belongs to that project).
-      this._pendingResumeSwitch = null;
+      // _currentSid only clears when it pointed at the dropped project — the
+      // background project's live "current" pointer survives a scoped reset.
+      if (matchAll) {
+        this._currentSid = null;
+      } else {
+        const cur = this._currentSid ? this._sessions.get(this._currentSid) : null;
+        if (this._currentSid && !cur) this._currentSid = null;
+      }
+      // `-c` adoption latch + pending /resume switch, both per-project now: a
+      // scoped reset clears only the switched-away project's latch (a background
+      // project's armed resume switch / adoption survives); a full reset clears all.
+      if (matchAll) {
+        this._adopted.clear();
+        this._pendingResumeSwitch.clear();
+      } else {
+        this._adopted.delete(targetSan);
+        this._pendingResumeSwitch.delete(targetSan);
+      }
     } catch (err) {
       reportSwallowed('v2-write.reset-sessions', err);
     }