chamba 0.4.0 → 0.5.0

package/dist/commands/dev.js

@@ -18,7 +18,7 @@ import { buildPnpmStoreMountArgs } from "../lib/pnpm-store.js";
 import { assertHostPortsAvailable, formatPortNotice, formatWebRange, portEnvArgs, portPublishArgs, portsLabel, validatePortsConfig, } from "../lib/ports.js";
 import { containerSessionCount, loginShellExecArgs } from "../lib/sessions.js";
 import { buildShadowMountArgs, ensureShadowsInSync, expandShadowPatterns } from "../lib/shadows.js";
-import { buildWebpaneMountArgs, buildWebtermStateMountArgs, isWebKey, plantResumeMarker, readWebAgent, readWebKey, resolveWebPort, resumeCommandFor, setWebDefaultCwd, startWebtermAndVerify, webInterfaceAnswers, webInterfaceUrl, webPortUsable, webSessionInfo, } from "../lib/webterm.js";
+import { buildWebpaneMountArgs, buildWebtermStateMountArgs, isWebKey, readWebAgent, readWebKey, resolveWebPort, setWebDefaultCwd, startWebtermAndVerify, webInterfaceAnswers, webInterfaceUrl, webPortUsable, webSessionInfo, } from "../lib/webterm.js";
 import { readActiveProfile, readGitMode, writeActiveProfile } from "../lib/workspace-identity.js";
 // --- Working directory resolution ---------------------------------------------------------------------------------------------------------
 // Always open the session where chamba was invoked. The whole workspace root is bind-mounted at
@@ -519,33 +519,26 @@ export async function run(packageDir, ctx, options) {
             process.exit(1);
         }
     }
-    // --- Once-per-container-start hooks (resume marker + web interface launch) -----------------------------------------------------------
+    // --- Once-per-container-start hook (web interface launch) ----------------------------------------------------------------------------
     // Deliberately after the startup checks above: those update the AI CLIs inside the container, and the
     // interface spawns its agent the moment it comes up. Started any earlier, the browser would get a session
     // running the version the image was built with - a claude too old to know the current models - and the only
     // way out would be to wait for the update and start another session. The terminal never had this problem:
     // the login shell attaches below, after the update.
     //
-    // Runs on the created AND resumed (docker start) paths, never on connect to an already-running container -
-    // that is what makes the resume once-per-start. The marker is planted before the user's shell attaches,
-    // so the first web session to come up consumes it and resumes the most recent conversation; later
-    // sessions start fresh. Which agent it resumes is the one this workspace's web sessions start with,
-    // which is also the agent the interface is launched with.
+    // Reopening the last conversation is not decided here. The container's own server does it, for the first
+    // session of a container start, reading the agent stores from the side of the mount that owns them
+    // (templates/webterm/resume.js). Which agent gets the offer is the one this workspace's web sessions start
+    // with, which is also the agent the interface is launched with.
     const webAgent = readWebAgent(cacheDir);
     if (startResult.status !== "connected") {
-        // No marker when there is nothing to resume: the command would fail and take the session with it,
-        // so the first session starts the agent fresh instead.
-        const resumeCommand = resumeCommandFor(webAgent, cacheDir, workdir);
-        if (resumeCommand !== null)
-            plantResumeMarker(containerName, resumeCommand);
         if (webPort !== null)
             await launchWebInterface(containerName, webAgent, webPort, workdir);
     }
     else if (webPort !== null) {
         // Connecting to a container that is already up: the interface it started with should still be
         // serving. When it is not (crashed, or stopped by hand) the greeting would advertise a URL that
-        // does not answer, so start it again. No resume marker here - this is not a container start, so
-        // the relaunched interface opens a fresh conversation rather than re-resuming an old one.
+        // does not answer, so start it again.
         if (!(await webInterfaceAnswers(webPort))) {
             await launchWebInterface(containerName, webAgent, webPort, workdir);
         }

package/dist/lib/constants.js

@@ -119,17 +119,7 @@ export const WEBTERM_AGENT_FILE_PATH = `${CONTAINER_WEBTERM_STATE_DIR}/${WEBTERM
 // and a resumed conversation finds its own history again. Nothing sweeps it by age.
 export const WEBPANE_DIR = "webpane";
 export const CONTAINER_WEBPANE_DIR = `${CONTAINER_HOME}/.webpane`;
-// Resume marker: a host-written container file whose content is the full command that resumes the most
-// recent conversation. Planted by dev.ts on every container create/start; consumed (rename-then-read,
-// atomic) by exactly one webterm session, so the first session after a container start resumes and every
-// later one starts fresh. Lives in the devuser home, not /tmp - the consumer executes the file's content,
-// so it must not sit in a world-writable dir.
-export const RESUME_MARKER_PATH = `${CONTAINER_HOME}/.chamba-resume-pending`;
-// Per-agent command that reopens the most recent conversation. Pinned against the real CLIs by the
-// drift test in tests/webterm.test.ts, which checks each flag/subcommand against the CLI's own help.
-// Claude is not here: it is resumed by session id instead (resumeCommandFor), because `claude --continue`
-// exits with "No conversation found to continue" when there is nothing to continue.
-export const AGENT_RESUME_COMMAND = {
-    opencode: "opencode --continue",
-    codex: "codex resume --last",
-};
+// Reopening the last conversation is the container's own job: templates/webterm/resume.js reads the agent
+// stores from the side of the mount that owns those paths, and the server offers the resume to the first
+// session of a container start. The host used to read the same stores from out here and plant a command
+// file; nothing on this side needs to know how an agent files its conversations any more.

package/dist/lib/webterm.js

@@ -1,12 +1,12 @@
 // =========================================================================================================================================
 // src/lib/webterm.ts - Host-side logic for the web agent interface (webterm)
-// Sticky per-workspace host-port assignment from the global web_range, plus the container hooks that
-// plant the resume marker and start the baked webterm server once per container start.
+// Sticky per-workspace host-port assignment from the global web_range, plus the container hooks that start
+// the baked webterm server once per container start and ask it what it is running.
 // =========================================================================================================================================
 import { spawnSync } from "node:child_process";
-import { mkdirSync, readdirSync, readFileSync, statSync } from "node:fs";
-import { basename, join } from "node:path";
-import { AGENT_RESUME_COMMAND, AGENTS_DIR, CONTAINER_USER, CONTAINER_WEBPANE_DIR, CONTAINER_WEBTERM_STATE_DIR, CONTAINER_WORKSPACE, DEFAULT_WEB_AGENT, RESUME_MARKER_PATH, WEB_AGENTS, WEB_KEY_FILE_PATH, WEBPANE_DIR, WEBTERM_AGENT_FILE, WEBTERM_STATE_DIR, } from "./constants.js";
+import { mkdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { AGENTS_DIR, CONTAINER_USER, CONTAINER_WEBPANE_DIR, CONTAINER_WEBTERM_STATE_DIR, DEFAULT_WEB_AGENT, WEB_AGENTS, WEB_KEY_FILE_PATH, WEBPANE_DIR, WEBTERM_AGENT_FILE, WEBTERM_STATE_DIR, } from "./constants.js";
 import { canBind, containerPublishedPorts, dockerPublishedPorts, PORT_LOOPBACK_HOST } from "./ports.js";
 import { listWorkspaceIds, readWebPort, writeWebPort } from "./workspace-identity.js";
 // --- Port assignment (pure over the .lock files) -----------------------------------------------------------------------------------------
@@ -260,192 +260,7 @@ export async function webInterfaceAnswers(webPort) {
         return false; // Not listening, or too slow to matter.
     }
 }
-// --- Resume command selection (host-side, over the mounted agent dirs) -------------------------------------------------------------------
-const SESSION_FILE_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/;
-/**
- * Claude Code files its transcripts per directory, in a dir named after the directory it ran in with every
- * character that is not a letter or a digit turned into "-": /workspace -> -workspace, /workspace/apps/api ->
- * -workspace-apps-api. So a session in a sub-directory reads and writes a different dir from one at the root,
- * and a resume command built from the wrong one names an id that claude cannot find.
- * Only the fallback below relies on this naming; the main path reads what a transcript says about itself.
- */
-export function claudeProjectKey(containerPath) {
-    return containerPath.replace(/[^a-zA-Z0-9]/g, "-");
-}
-/**
- * The resume command planted in the marker for a given agent, for a session that will run in `workdir`, or
- * null when this workspace has no conversation for that agent to reopen.
- *
- * Null is the important half. A resume command with nothing behind it is not harmless: every one of these
- * CLIs treats "resume, but there is nothing there" as an error and exits, so the browser would open on a
- * session that died the moment it started. With null the marker is never planted and the first session
- * starts the agent fresh, which is what a workspace with no history should give.
- *
- * For claude the session is picked explicitly: `claude --continue` takes the newest transcript by mtime and
- * silently starts FRESH when that transcript has no real messages (e.g. a session that only ran a slash
- * command), so relying on it makes auto-resume fail quietly whenever such a session happens to be the newest.
- * Resuming by id sidesteps the picker entirely, and having no id is also the honest answer to "is there
- * anything to resume". The other two are asked the same question of their own session stores.
- */
-export function resumeCommandFor(agent, workspaceCacheDir, workdir = CONTAINER_WORKSPACE) {
-    if (agent === "claude") {
-        const sessionId = latestClaudeSessionId(workspaceCacheDir, workdir);
-        return sessionId === null ? null : `claude --resume ${sessionId}`;
-    }
-    return hasStoredConversation(agent, workspaceCacheDir) ? AGENT_RESUME_COMMAND[agent] : null;
-}
-// Where opencode and codex keep their conversations, under this workspace's mounted agent dirs. These are
-// the host side of the directories the container sees at ~/.local/share/opencode/storage/session and
-// ~/.codex/sessions (templates/webterm/config.js holds the container-side pair).
-const AGENT_SESSION_STORE = {
-    opencode: ["opencode", "data", "storage", "session"],
-    codex: ["codex", "sessions"],
-};
-/**
- * Whether this agent has anything to resume: any file at all in the store it writes conversations to.
- * Deliberately shallow as a judgement - a file in there means the agent has run and kept something, which is
- * all the resume flag needs to not fail. Reading each store's own format to find out whether the newest
- * conversation is really resumable would tie chamba to two more internal layouts for no gain.
- */
-function hasStoredConversation(agent, workspaceCacheDir) {
-    return containsFile(join(workspaceCacheDir, AGENTS_DIR, ...AGENT_SESSION_STORE[agent]));
-}
-/**
- * True when `dir` holds a file anywhere below it. Recursive because both stores nest (by project, by date),
- * depth-bounded so an unexpected directory can never turn this into a walk of the disk, and it stops at the
- * first file it finds.
- */
-function containsFile(dir, depth = 4) {
-    let entries;
-    try {
-        entries = readdirSync(dir, { withFileTypes: true });
-    }
-    catch {
-        return false; // Never run, so never created.
-    }
-    for (const entry of entries) {
-        if (entry.isFile())
-            return true;
-        if (entry.isDirectory() && depth > 0 && containsFile(join(dir, entry.name), depth - 1))
-            return true;
-    }
-    return false;
-}
-/**
- * The most recent Claude Code conversation that can be resumed in `workdir`, read from the host-side mounted
- * agent dir: the newest transcript with a real (non-sidechain) user message that ran in that directory.
- *
- * The directory is matched on what the transcript records, not on which dir it sits in, so however claude
- * names those dirs we never hand back a conversation from somewhere else - resuming it would either fail or
- * drop the user into another directory's history. Transcripts old enough to record no directory at all are
- * the fallback, and for those the dir name is the only evidence there is.
- * Returns null when nothing qualifies.
- */
-export function latestClaudeSessionId(workspaceCacheDir, workdir = CONTAINER_WORKSPACE) {
-    const projectsDir = join(workspaceCacheDir, AGENTS_DIR, "claude", "projects");
-    const byRecordedDir = newestResumableSessionId(transcriptsNewestFirst(projectsDir, projectDirNames(projectsDir)), workdir);
-    if (byRecordedDir !== null)
-        return byRecordedDir;
-    return newestResumableSessionId(transcriptsNewestFirst(projectsDir, [claudeProjectKey(workdir)]), null);
-}
-// Every project dir claude has written under this workspace's cache. Read rather than derived: the point of
-// the walk is to find the transcript that says it ran where we are about to run.
-function projectDirNames(projectsDir) {
-    try {
-        return readdirSync(projectsDir, { withFileTypes: true })
-            .filter((entry) => entry.isDirectory())
-            .map((entry) => entry.name);
-    }
-    catch {
-        return [];
-    }
-}
-// Transcript paths from the given project dirs, newest first. Session files only - anything else in there
-// (subagent dirs, stray notes) is not a conversation. A missing or unreadable dir contributes nothing.
-function transcriptsNewestFirst(projectsDir, dirNames) {
-    const found = [];
-    for (const dirName of dirNames) {
-        const dir = join(projectsDir, dirName);
-        let names;
-        try {
-            names = readdirSync(dir);
-        }
-        catch {
-            continue;
-        }
-        for (const name of names) {
-            if (!SESSION_FILE_PATTERN.test(name))
-                continue;
-            const path = join(dir, name);
-            try {
-                found.push({ path, mtime: statSync(path).mtimeMs });
-            }
-            catch {
-                // Vanished between the listing and the stat.
-            }
-        }
-    }
-    return found.sort((a, b) => b.mtime - a.mtime).map((entry) => entry.path);
-}
-// The first of these transcripts that can be resumed, in the order given. `requiredCwd` of null asks only
-// that the conversation has messages; a directory asks that it recorded that one too. Transcripts are read
-// in order and the walk stops at the first hit, so the usual case reads a single file.
-function newestResumableSessionId(transcriptPaths, requiredCwd) {
-    for (const path of transcriptPaths) {
-        const facts = transcriptFacts(path);
-        if (!facts.resumable)
-            continue;
-        if (requiredCwd !== null && facts.cwd !== requiredCwd)
-            continue;
-        return basename(path).slice(0, -".jsonl".length);
-    }
-    return null;
-}
-// What a transcript says about itself, in one pass: whether it holds a real user message, and the directory
-// that message was typed in. Sessions that only recorded UI state (mode changes, slash commands) have
-// nothing to resume; sidechain records belong to subagents. isSidechain is a field we do not own, so only an
-// explicit true excludes a record: a record that stopped carrying the field still counts as resumable, which
-// fails on the safe side. `cwd` is null for transcripts written before claude recorded it.
-function transcriptFacts(transcriptPath) {
-    let content;
-    try {
-        content = readFileSync(transcriptPath, "utf8");
-    }
-    catch {
-        return { resumable: false, cwd: null };
-    }
-    // Walked by index rather than split("\n") so a multi-MB transcript is not copied into an array of lines.
-    let start = 0;
-    while (start <= content.length) {
-        const end = content.indexOf("\n", start);
-        const line = content.slice(start, end === -1 ? content.length : end);
-        start = (end === -1 ? content.length : end) + 1;
-        // Cheap pre-filter so multi-MB transcripts are not JSON.parsed line by line.
-        if (!line.includes('"type":"user"'))
-            continue;
-        try {
-            const record = JSON.parse(line);
-            if (record.type === "user" && record.isSidechain !== true) {
-                return { resumable: true, cwd: typeof record.cwd === "string" ? record.cwd : null };
-            }
-        }
-        catch {
-            // Skip malformed lines.
-        }
-    }
-    return { resumable: false, cwd: null };
-}
 // --- Container hooks (docker I/O, best-effort) --------------------------------------------------------------------------------------------
-/**
- * Plant the resume marker in the container: a devuser-owned file whose content is the full command that
- * resumes the most recent conversation. Called on every container create/start; the first web session
- * to come up consumes it atomically and runs the command, and every later one starts fresh.
- * Best-effort - a failure only means the session starts fresh. The command is always one of the
- * AGENT_RESUME_COMMAND constants, so interpolating it into the shell string is safe.
- */
-export function plantResumeMarker(containerName, resumeCommand) {
-    spawnSync("docker", ["exec", "-u", CONTAINER_USER, containerName, "bash", "-c", `printf %s "${resumeCommand}" > "${RESUME_MARKER_PATH}"`], { stdio: "pipe" });
-}
 /**
  * The `docker exec` argv that starts the baked webterm server, with the given agent as the one its new
  * sessions start with, opening them in `workdir`. The server runs every agent it knows, one per session, so

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "chamba",
-    "version": "0.4.0",
+    "version": "0.5.0",
     "description": "Run AI coding agents in a container, from your browser",
     "type": "module",
     "bin": {

package/templates/webterm/README.md

@@ -94,8 +94,11 @@ webterm is baked into the chamba image with its dependencies preinstalled, and t
    The agent is always explicit; `webterm` on its own prints usage and the URL, and never picks one for you.
    The choice is written to `~/.chamba-webterm/agent`, a directory chamba bind-mounts from the workspace cache, and the host reads it back at the next container start - so it holds across restarts.
 
-The first session after a container start resumes the most recent conversation; later sessions start fresh.
-Only a session running that same agent may claim the resume - the marker holds a command for it, and any other agent would consume the conversation without being able to open it.
+The first session after a container start reopens the most recent conversation; later sessions start fresh.
+The server decides that itself, in `resume.js`, by reading the same agent stores the pane reads - the host is not involved and plants nothing.
+Which conversation is the workspace's newest one in the directory the session opens in, and for claude it is named by id rather than by `--continue`, whose picker starts fresh when the newest transcript holds no real messages.
+Only a session running the agent the interface was launched with may claim it; any other agent leaves the chance alone rather than spending it on a conversation it cannot open.
+The chance belongs to the container start, not to the server process: it is stamped with the start time of PID 1, so a server that crashes and comes back does not reopen the conversation a second time.
 
 Running `webterm <other-agent>` while the server is up starts nothing and ends nothing: it moves what `+ New session` will start, and prints the URL.
 Sessions already open keep running the agent they were started with.
@@ -148,8 +151,8 @@ Between the terminal and the composer, a claude session shows its own numbers, l
 
 ## Config
 
-`config.js` holds the knobs (port, agent list and default agent, key and key file, upload dir, size cap, sweep age/interval, paste framing, resume marker, state file, session limit, keepalive interval, stop timings, claude context file, workspace root and directory-scan limits, the pane's directory, caps, scan interval, feedback bounds and agent stores, and the status strip's scan interval).
-Env overrides: `WEBTERM_PORT`, `WEBTERM_CWD`, `WEBTERM_AGENT`, `WEBTERM_AGENT_ARGS`, `WEBTERM_KEY`, `WEBTERM_KEY_FILE`, `WEBTERM_RESUME_MARKER`, `WEBTERM_STATE_FILE`, `WEBTERM_MAX_SESSIONS`, `WEBTERM_PING_INTERVAL_MS`, `WEBTERM_WORKSPACE`, `WEBTERM_CONTEXT_FILE`, `WEBTERM_PANE_DIR`, `WEBTERM_MAX_PAGE_BYTES`, `WEBTERM_MAX_PANE_BYTES`, `WEBTERM_MAX_PANE_FILES`, `WEBTERM_PANE_SCAN_MS`, `WEBTERM_FEEDBACK_MIN_INTERVAL_MS`, `WEBTERM_MAX_FEEDBACK_PER_PAGE`, `WEBTERM_STATUS_SCAN_MS`, `WEBTERM_SUBMIT_DELAY_MS`, and the four `WEBTERM_*_DIR` agent-store paths, plus `WEBTERM_PROC_ROOT`, which belongs to `proc.js` rather than to `config.js`.
+`config.js` holds the knobs (port, agent list and default agent, key and key file, upload dir, size cap, sweep age/interval, paste framing, resume stamp, state file, session limit, keepalive interval, stop timings, claude context file, workspace root and directory-scan limits, the pane's directory, caps, scan interval, feedback bounds and agent stores, and the status strip's scan interval).
+Env overrides: `WEBTERM_PORT`, `WEBTERM_CWD`, `WEBTERM_AGENT`, `WEBTERM_AGENT_ARGS`, `WEBTERM_KEY`, `WEBTERM_KEY_FILE`, `WEBTERM_RESUME_STAMP`, `WEBTERM_STATE_FILE`, `WEBTERM_MAX_SESSIONS`, `WEBTERM_PING_INTERVAL_MS`, `WEBTERM_WORKSPACE`, `WEBTERM_CONTEXT_FILE`, `WEBTERM_PANE_DIR`, `WEBTERM_MAX_PAGE_BYTES`, `WEBTERM_MAX_PANE_BYTES`, `WEBTERM_MAX_PANE_FILES`, `WEBTERM_PANE_SCAN_MS`, `WEBTERM_FEEDBACK_MIN_INTERVAL_MS`, `WEBTERM_MAX_FEEDBACK_PER_PAGE`, `WEBTERM_STATUS_SCAN_MS`, `WEBTERM_SUBMIT_DELAY_MS`, and the four `WEBTERM_*_DIR` agent-store paths, plus `WEBTERM_PROC_ROOT`, which belongs to `proc.js` rather than to `config.js`.
 `WEBTERM_KEY` pins the key instead of minting one, which is for tests and hand-run debugging - there is no way to turn the gate off.
 `WEBTERM_CWD` is where new sessions start, not where they must stay: the browser can name another directory per session, and `POST /cwd` moves the default.
 `WEBTERM_AGENT` is the same shape: the agent new sessions start with, which the browser can override per session and `POST /agent` moves. A value that is not one of the three falls back to the first, so nothing arbitrary can be spawned through it.

package/templates/webterm/config.js

@@ -28,11 +28,12 @@ export const DEFAULT_AGENT = isKnownAgent(process.env.WEBTERM_AGENT) ? process.e
 // so they mean nothing to any other agent the browser might start.
 export const AGENT_ARGS = (process.env.WEBTERM_AGENT_ARGS || "").split(/\s+/).filter(Boolean);
 
-// Resume marker: a host-written file whose content is the full command that resumes the most
-// recent conversation. The first session to consume it (rename-then-read, atomic) spawns that
-// command instead of the default agent; later sessions start fresh. Empty means resume is disabled,
-// so a standalone `node server.js` behaves exactly as before.
-export const RESUME_MARKER = process.env.WEBTERM_RESUME_MARKER || "";
+// Where the server records that it has already offered a resume for this container start: one line holding
+// the start time of PID 1, which is a new number every time the container starts. The first session of a
+// container start reopens the newest conversation and stamps this file; every session after it starts fresh,
+// which is what the user wants once mid-work. Sits beside STATE_FILE in the same mounted directory, so it
+// outlives the container the way the stamped value is meant to be compared across one.
+export const RESUME_STAMP = process.env.WEBTERM_RESUME_STAMP || "/home/devuser/.chamba-webterm/resumed-at";
 
 // One-line file naming the agent new sessions get, written once the port is bound and again whenever the
 // default moves. The `webterm` launcher reads it so a second run can say what is live instead of just

package/templates/webterm/conversation.js

@@ -34,8 +34,11 @@ const MAX_JSON_BYTES = 1024 * 1024;
 // (sessions/2026/08/23/), opencode under a project directory; nothing goes deeper than that.
 const MAX_STORE_DEPTH = 5;
 
-/** Files under `dir` matching `pattern`, newest first, capped. Depth-limited; unreadable dirs contribute nothing. */
-function filesNewestFirst(dir, pattern, depth = MAX_STORE_DEPTH) {
+/**
+ * Files under `dir` matching `pattern`, newest first, capped. Depth-limited; unreadable dirs contribute nothing.
+ * Exported for resume.js, which reads the same stores to answer a different question.
+ */
+export function filesNewestFirst(dir, pattern, depth = MAX_STORE_DEPTH) {
     const found = [];
     const queue = [{ dir, depth }];
     while (queue.length > 0) {
@@ -163,7 +166,9 @@ function couldBelong(path, cwd, since) {
 
 // --- Claude ------------------------------------------------------------------------------------------------------------------------------
 
-const CLAUDE_TRANSCRIPT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/;
+// A transcript is named after the conversation it holds, which is also the id claude resumes by.
+// Exported with the rollout pattern below because resume.js reads the same two stores.
+export const CLAUDE_TRANSCRIPT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.jsonl$/;
 
 /**
  * Claude's conversation id for a session, by two routes.
@@ -189,7 +194,7 @@ export function claudeConversationId(session, stores) {
 // --- Codex -------------------------------------------------------------------------------------------------------------------------------
 
 // rollout-<timestamp>-<uuid>.jsonl - the uuid is the conversation id codex resumes by.
-const CODEX_ROLLOUT = /^rollout-.*-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/;
+export const CODEX_ROLLOUT = /^rollout-.*-([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/;
 
 /** Codex's conversation id for a session: the newest rollout file that could be this session's. */
 export function codexConversationId(session, stores) {

package/templates/webterm/resume.js

@@ -0,0 +1,145 @@
+// resume.js - The command that reopens the conversation this workspace was last having.
+//
+// A container you come back to should open where you left off, so the first session of a container start
+// continues the newest conversation instead of beginning one. Working out which conversation that is means
+// reading the store the agent keeps it in, and this is the only place that can honestly do it: the stores
+// are the container's own paths, and the CLIs that write them are installed here and nowhere else.
+//
+// Deliberately next to conversation.js, and deliberately not the same question. That file asks which
+// conversation a live session is having, and answers it from the process tree and the session's start time.
+// This one asks whether there is anything here worth reopening at all, before any session exists, so the
+// directory is the only thing it has to go on.
+//
+// Null is the half that matters. Every one of these CLIs treats "resume, but there is nothing there" as an
+// error and exits, so a resume command with nothing behind it opens the browser onto a session that died on
+// arrival. Null means the session starts the agent fresh, which is the right answer for a workspace with no
+// history.
+
+import { readFileSync } from "node:fs";
+import { basename, dirname } from "node:path";
+import { CLAUDE_TRANSCRIPT, CODEX_ROLLOUT, filesNewestFirst } from "./conversation.js";
+
+// --- Claude ------------------------------------------------------------------------------------------------------------------------------
+
+/**
+ * Claude Code files its transcripts per directory, in a dir named after the directory it ran in with every
+ * character that is not a letter or a digit turned into "-": /workspace -> -workspace, /workspace/apps/api ->
+ * -workspace-apps-api. So a session in a sub-directory reads and writes a different dir from one at the root,
+ * and a resume command built from the wrong one names an id that claude cannot find.
+ * Only the fallback below relies on this naming; the main path reads what a transcript says about itself.
+ */
+export function claudeProjectKey(containerPath) {
+    return containerPath.replace(/[^a-zA-Z0-9]/g, "-");
+}
+
+/**
+ * The most recent claude conversation that can be reopened in `cwd`: the newest transcript with a real
+ * (non-sidechain) user message that ran in that directory. Returns null when nothing qualifies.
+ *
+ * The directory is matched on what the transcript records, not on which dir it sits in, so however claude
+ * names those dirs we never hand back a conversation from somewhere else - resuming it would either fail or
+ * drop the user into another directory's history. Transcripts old enough to record no directory at all are
+ * the fallback, and for those the dir name is the only evidence there is.
+ */
+function claudeResumeId(cwd, stores) {
+    const transcripts = filesNewestFirst(stores.claudeProjects, CLAUDE_TRANSCRIPT);
+    const byRecordedDir = firstResumable(transcripts, cwd);
+    if (byRecordedDir !== null) return byRecordedDir;
+    const key = claudeProjectKey(cwd);
+    return firstResumable(
+        transcripts.filter((path) => basename(dirname(path)) === key),
+        null,
+    );
+}
+
+// The first of these transcripts that can be reopened, in the order given. `requiredCwd` of null asks only
+// that the conversation has messages; a directory asks that it recorded that one too. Transcripts are read
+// in order and the walk stops at the first hit, so the usual case reads a single file.
+function firstResumable(transcriptPaths, requiredCwd) {
+    for (const path of transcriptPaths) {
+        const facts = transcriptFacts(path);
+        if (!facts.resumable) continue;
+        if (requiredCwd !== null && facts.cwd !== requiredCwd) continue;
+        return basename(path).slice(0, -".jsonl".length);
+    }
+    return null;
+}
+
+/**
+ * What a transcript says about itself, in one pass: whether it holds a real user message, and the directory
+ * that message was typed in. Sessions that only recorded UI state (mode changes, slash commands) have
+ * nothing to resume; sidechain records belong to subagents. isSidechain is a field we do not own, so only an
+ * explicit true excludes a record: a record that stopped carrying the field still counts as resumable, which
+ * fails on the safe side. `cwd` is null for transcripts written before claude recorded it.
+ *
+ * Read whole rather than by the head, unlike conversation.js: the first user message can sit behind any
+ * amount of session setup, and answering "resumable" wrongly costs a dead session rather than a retry. The
+ * walk stops at the first hit, and the caller stops at the first resumable file, so the usual cost is the
+ * first few kilobytes of one transcript.
+ */
+function transcriptFacts(transcriptPath) {
+    let content;
+    try {
+        content = readFileSync(transcriptPath, "utf8");
+    } catch {
+        return { resumable: false, cwd: null };
+    }
+    // Walked by index rather than split("\n") so a multi-MB transcript is not copied into an array of lines.
+    let start = 0;
+    while (start <= content.length) {
+        const end = content.indexOf("\n", start);
+        const line = content.slice(start, end === -1 ? content.length : end);
+        start = (end === -1 ? content.length : end) + 1;
+        // Cheap pre-filter so multi-MB transcripts are not JSON.parsed line by line.
+        if (!line.includes('"type":"user"')) continue;
+        try {
+            const record = JSON.parse(line);
+            if (record.type === "user" && record.isSidechain !== true) {
+                return { resumable: true, cwd: typeof record.cwd === "string" ? record.cwd : null };
+            }
+        } catch {
+            // Skip malformed lines.
+        }
+    }
+    return { resumable: false, cwd: null };
+}
+
+// --- Codex and opencode ------------------------------------------------------------------------------------------------------------------
+
+// What reopens a stored conversation, per agent, and where to look to know there is one. claude is not here:
+// it is resumed by id above, because `claude --continue` takes the newest transcript by mtime and silently
+// starts FRESH when that transcript holds no real messages, which makes auto-resume fail quietly whenever
+// such a session happens to be the newest.
+//
+// These two are asked a shallower question than claude - does the store hold a conversation file at all -
+// and their own flag picks which one. Reading each store's format to find out whether the newest
+// conversation is really resumable would tie chamba to two more internal layouts for no gain.
+export const CONTINUE = {
+    opencode: { argv: ["opencode", "--continue"], store: "opencodeSessions", pattern: /\.json$/ },
+    codex: { argv: ["codex", "resume", "--last"], store: "codexSessions", pattern: CODEX_ROLLOUT },
+};
+
+// --- The one entry point -----------------------------------------------------------------------------------------------------------------
+
+/**
+ * The argv that reopens this workspace's most recent conversation for `agent` in `cwd`, or null when there
+ * is nothing to reopen. `stores` is config.js's AGENT_STORES, passed in so this can be exercised against a
+ * fixture the way conversation.js is.
+ *
+ * An agent nobody wrote a reader for is a supported answer, not an error: it starts fresh.
+ */
+export function resumeArgvFor(agent, cwd, stores) {
+    try {
+        if (agent === "claude") {
+            const id = claudeResumeId(cwd, stores);
+            return id === null ? null : ["claude", "--resume", id];
+        }
+        const known = CONTINUE[agent];
+        if (!known) return null;
+        return filesNewestFirst(stores[known.store], known.pattern).length > 0 ? [...known.argv] : null;
+    } catch {
+        // A store that changed shape under us must never take the session down with it - starting fresh is
+        // a worse session than the user asked for, but it is a session.
+        return null;
+    }
+}

package/templates/webterm/server.js

@@ -11,7 +11,7 @@
 // container isolation it has in the terminal. Nothing here touches credentials.
 
 import { randomBytes } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { createServer } from "node:http";
 import { createRequire } from "node:module";
 import { join, resolve, sep } from "node:path";
@@ -52,7 +52,7 @@ import {
     PASTE_END,
     PASTE_START,
     PORT,
-    RESUME_MARKER,
+    RESUME_STAMP,
     resolveWorkspacePath,
     STATE_FILE,
     STATUS_SCAN_MS,
@@ -68,7 +68,8 @@ import {
     workspaceLabel,
 } from "./config.js";
 import { createPane } from "./pane.js";
-import { isSelfOrDescendant } from "./proc.js";
+import { isSelfOrDescendant, processStart } from "./proc.js";
+import { resumeArgvFor } from "./resume.js";
 import { createRegistry, WORK_TICK_MS } from "./sessions.js";
 import { statusFor, writesSnapshots } from "./snapshot.js";
 
@@ -788,36 +789,74 @@ function nudge(session, title, path) {
     pasteToSession(session, `[web pane] Feedback submitted on "${quoted}" - read ${homeLabel(path)}`);
 }
 
-// Consume the host-planted resume marker, if any. The rename is the claim: of all the sessions that may
-// start at once, exactly one wins, so only the first one resumes and the rest start fresh.
-// Returns the resume command as [cmd, ...args], or null when there is nothing to resume.
-// `agent` is what the session is about to start. The marker holds a resume command for the agent the host
-// started this interface with (DEFAULT_AGENT, not wherever the default has moved to since), so any other
-// agent leaves it alone rather than claiming a conversation it cannot open.
-function consumeResumeMarker(agent) {
-    if (!RESUME_MARKER || agent !== DEFAULT_AGENT) return null;
-    const claimed = `${RESUME_MARKER}.web`;
+// --- Resume, once per container start ----------------------------------------------------------------------------------------------------
+
+// PID 1 is CONTAINER_KEEP_ALIVE, so it starts when the container does and its start time is a different
+// number on every `docker start`. That makes it the name of this container start, which is the span the
+// resume belongs to: not this server process (one crash and relaunch would resume a second time) and not
+// this workspace (then it would only ever happen once).
+function containerStartId() {
+    const started = processStart(1);
+    return started === null ? null : String(started);
+}
+
+// The fallback when /proc cannot be read at all: one resume per server process. Weaker than the stamp -
+// a relaunched server would offer another - but a server that cannot see /proc is already in a container
+// that is not behaving, and a spare resume is a better failure than none.
+let resumeSpent = false;
+
+/**
+ * Whether this session is the one that gets to reopen the last conversation, spending the chance as it
+ * answers. True at most once per container start.
+ *
+ * Spent whether or not anything is found to resume, which is the point: a session that started fresh
+ * because the workspace was empty has since written a transcript, and the next session in the same bar
+ * must not reopen it. Nothing here needs a lock - the server is one process and one thread, so no two
+ * sessions are inside this function at once.
+ */
+function claimResumeChance() {
+    const startId = containerStartId();
+    if (startId === null) {
+        if (resumeSpent) return false;
+        resumeSpent = true;
+        return true;
+    }
+    let stamped = null;
     try {
-        renameSync(RESUME_MARKER, claimed);
+        stamped = readFileSync(RESUME_STAMP, "utf8").trim();
     } catch {
-        return null; // No marker, or another consumer claimed it first.
+        // Never stamped, or the file is gone - either way this container start has not had its resume.
     }
+    if (stamped === startId) return false;
     try {
-        const command = readFileSync(claimed, "utf8").trim();
-        unlinkSync(claimed);
-        const parts = command.split(/\s+/).filter(Boolean);
-        return parts.length > 0 ? parts : null;
-    } catch {
-        return null;
+        writeFileSync(RESUME_STAMP, `${startId}\n`);
+    } catch (err) {
+        // Every session would resume if this kept failing, so say so once rather than silently repeating it.
+        console.warn(`[webterm] could not write ${RESUME_STAMP}: ${err instanceof Error ? err.message : String(err)}`);
     }
+    resumeSpent = true;
+    return true;
+}
+
+/**
+ * The argv that reopens the newest conversation, for the first session of a container start, or null.
+ *
+ * `agent` is what the session is about to start. Only the agent the interface was launched with is offered
+ * the resume (DEFAULT_AGENT, not wherever the default has moved to since); any other agent leaves the
+ * chance unspent rather than claiming a conversation it cannot open.
+ */
+function resumeArgv(agent, cwd) {
+    if (agent !== DEFAULT_AGENT) return null;
+    if (!claimResumeChance()) return null;
+    return resumeArgvFor(agent, cwd, AGENT_STORES);
 }
 
 // Spawn a new session's agent, in the directory the registry was given. Env is inherited so subscription
-// auth flows through. The first session after a container start finds the host-planted marker and continues
-// the most recent conversation; every later session starts fresh, which is what the user wants once mid-work.
+// auth flows through. The first session after a container start continues the most recent conversation;
+// every later session starts fresh, which is what the user wants once mid-work.
 // AGENT_ARGS belong to the agent the launcher named, so any other agent is spawned bare.
 function spawnAgent({ cwd, agent }) {
-    const resume = consumeResumeMarker(agent);
+    const resume = resumeArgv(agent, cwd);
     const [spawnCmd, ...baseArgs] = resume ?? [agent, ...(agent === DEFAULT_AGENT ? AGENT_ARGS : [])];
     if (resume) console.log(`[webterm] resuming most recent conversation: ${resume.join(" ")}`);
     // Append the browser-awareness flag for claude (fresh or resumed); every other agent is untouched.

package/templates/webterm.sh

@@ -113,9 +113,6 @@ export WEBTERM_AGENT="$AGENT"
 export WEBTERM_STATE_FILE="$STATE_FILE"
 # Where the server publishes the key it mints for this run; every URL printed above is read back from it.
 export WEBTERM_KEY_FILE="$KEY_FILE"
-# Guarded like the sibling baked scripts: a detached `docker exec` need not carry HOME, and under
-# `set -u` a bare $HOME would abort the launcher before the server ever starts.
-export WEBTERM_RESUME_MARKER="${HOME:-/home/devuser}/.chamba-resume-pending"
 # The workspace name (host-injected as CHAMBA_WORKSPACE) labels the session bar and the browser tab.
 export WEBTERM_WORKSPACE="${CHAMBA_WORKSPACE:-}"
 # Where new sessions start. The host passes it (the directory `npx chamba` ran in), so a browser session