create-walle 0.10.2 → 0.10.3

package/template/coding-task-manager/lib/read-pool-client.js

@@ -125,6 +125,12 @@ const { decodeFramedJson: _decodeFramedJson } = require('./framed-json-codec');
 // by omission.
 const ISOLATE_INTERACTIVE = process.env.CTM_READPOOL_ISOLATE_INTERACTIVE !== '0';
 const REQUEST_CLASSES = new Set(['interactive', 'service', 'batch']);
+
+// WP-0 M-1/M-4 (docs/hub-local-cpu-memory-burn-2026-10-31.html §7): per-op CPU and heap
+// attribution, aggregated pool-side for perf-summary. See _attachOpPerfTap/_recordOpPerf.
+const PERF_HEAP_TOP_LIMIT = 20; // fixed ring: the 20 largest |heap+external| deltas seen
+const _PERF_TAP = Symbol('ctmReadPoolPerfTap');
+const _perfAttributionOn = () => boolFlag('CTM_PERF_ATTRIBUTION', true);
 // Counts are a WAITING backstop (WP-3 D-5): a class refuses with QUEUE_FULL only when its waiter list is full.
 const DEFAULT_QUEUE_CAPACITIES = Object.freeze({ interactive: 256, service: 256, batch: 128 });
 // D-7a/D-8 (idle-wake freeze design §5, §8 WP-1b): the service-class coalesce line is a
@@ -306,6 +312,12 @@ class CtmReadPoolClient {
     // ever gated by it; the map itself is maintained for every op so getStatus().perOp can
     // report a non-zero count for an uncapped op too.
     this._inFlightByOp = new Map();
+    // WP-0 M-1/M-4: per-op CPU totals (µs, converted to ms at read time so repeated reads
+    // cannot drift) and the bounded top-20 heap-delta ring. Both bounded: _cpuByOp is keyed by
+    // op name (the registry declares a fixed set, plus 'unknown'), _heapTopDeltas by
+    // PERF_HEAP_TOP_LIMIT. Unused (and empty) when CTM_PERF_ATTRIBUTION=0.
+    this._cpuByOp = new Map();
+    this._heapTopDeltas = [];
     // D-7a (WP-1b): one coalesce line per service singleflight key per COALESCE_LOG_INTERVAL_MS.
     this._lastCoalesceLogAt = new Map();
     this._closed = false;
@@ -334,8 +346,8 @@ class CtmReadPoolClient {
         historyReaderContext: this.#historyReaderContext,
         onMemoryLimitDeath: (occupiedEntries) => this._recordMemoryLimitDeath(occupiedEntries),
         onRefusal: (refusal) => this._recordRefusal(refusal),
-        onRespawn: (worker) => this._recordRespawn(worker),
-        onReady: () => this._drainClassWaiters(),
+        onRespawn: (worker) => { this._attachOpPerfTap(worker); this._recordRespawn(worker); },
+        onReady: (worker) => { this._attachOpPerfTap(worker); this._drainClassWaiters(); },
         onTiming: (kind, requestClass, ms) => this._recordTiming(kind, requestClass, ms),
         onGhostRetire: (worker, ghost, ranMs, spanMs) => this._recordGhostRetire(worker, ghost, ranMs, spanMs),
         onGhostTerminate: (worker, ghost, ranMs, spanMs) => this._recordGhostTerminate(worker, ghost, ranMs, spanMs),
@@ -1190,6 +1202,76 @@ class CtmReadPoolClient {
     return perOp;
   }
 
+  // WP-0 M-1/M-4 (hub-local-cpu-memory-burn-2026-10-31.html §7): read-only observation of the
+  // response messages the worker handle already consumes. The worker stamps each response with
+  // `perf = { op, cpuUserUs, cpuSystemUs, heapDeltaBytes, externalDeltaBytes }`; this listener
+  // keeps the per-op CPU totals and the top-20 heap deltas. It runs on the SAME event as the
+  // handle's own response accounting (so counts track responseByOp, modulo a response that
+  // arrives after its caller gave up -- the handle has already dropped that requestId, and this
+  // listener counts it because the op really did run), touches nothing the handle owns, and
+  // adds one symbol property per native worker. Attached from the ready/respawn hooks, since the
+  // handle creates (and replaces, on respawn) the native worker internally.
+  _attachOpPerfTap(handle) {
+    if (!_perfAttributionOn()) return;
+    const native = handle?.worker;
+    if (!native || typeof native.on !== 'function' || native[_PERF_TAP] === true) return;
+    try {
+      native[_PERF_TAP] = true;
+      native.on('message', (msg) => this._recordOpPerf(msg));
+    } catch { /* expected: a worker torn down mid-attach has no responses left to attribute; the respawn re-attaches */ }
+  }
+
+  _recordOpPerf(msg) {
+    if (!_perfAttributionOn()) return;
+    const perf = msg && msg.type === 'response' ? msg.perf : null;
+    if (!perf || typeof perf !== 'object') return;
+    const op = String(perf.op || 'unknown');
+    const totals = this._cpuByOp.get(op) || { count: 0, userUs: 0, systemUs: 0 };
+    totals.count += 1;
+    // Clamp negatives away: a µs delta cannot be negative, and a clock read that somehow is
+    // must not subtract from the op's own total.
+    totals.userUs += Math.max(0, Number(perf.cpuUserUs) || 0);
+    totals.systemUs += Math.max(0, Number(perf.cpuSystemUs) || 0);
+    this._cpuByOp.set(op, totals);
+    const heapDeltaBytes = Number(perf.heapDeltaBytes) || 0;
+    const externalDeltaBytes = Number(perf.externalDeltaBytes) || 0;
+    if (heapDeltaBytes === 0 && externalDeltaBytes === 0) return;
+    this._pushHeapDelta({ op, heapDeltaBytes, externalDeltaBytes, at: Date.now() });
+  }
+
+  // Bounded top-20 by heapDeltaBytes+externalDeltaBytes descending; while full, an entry that
+  // does not beat the smallest is dropped (no allocation, no sort). Keeps the sign of both
+  // deltas -- a GC-heavy or buffer-releasing op is a negative row, which is information too.
+  _pushHeapDelta(entry) {
+    const weight = (row) => row.heapDeltaBytes + row.externalDeltaBytes;
+    if (this._heapTopDeltas.length < PERF_HEAP_TOP_LIMIT) {
+      this._heapTopDeltas.push(entry);
+      this._heapTopDeltas.sort((a, b) => weight(b) - weight(a));
+      return;
+    }
+    if (weight(entry) <= weight(this._heapTopDeltas[this._heapTopDeltas.length - 1])) return;
+    this._heapTopDeltas[this._heapTopDeltas.length - 1] = entry;
+    this._heapTopDeltas.sort((a, b) => weight(b) - weight(a));
+  }
+
+  _cpuByOpStatus() {
+    if (!_perfAttributionOn()) return {};
+    const out = {};
+    for (const [op, totals] of this._cpuByOp) {
+      out[op] = {
+        count: totals.count,
+        userMs: Math.round((totals.userUs / 1000) * 10) / 10,
+        systemMs: Math.round((totals.systemUs / 1000) * 10) / 10,
+      };
+    }
+    return out;
+  }
+
+  _heapTopDeltasStatus() {
+    if (!_perfAttributionOn()) return [];
+    return this._heapTopDeltas.map((row) => ({ ...row }));
+  }
+
   getStatus() {
     const responseByOp = {};
     const responseByReason = {};
@@ -1317,6 +1399,11 @@ class CtmReadPoolClient {
       peakInputBytes: this._workers.reduce((peak, w) => Math.max(peak, w.peakInputBytes), 0),
       responseByOp,
       responseByReason,
+      // WP-0 M-1/M-4 (§7): per-op CPU (ms, 0.1 precision) beside responseByOp -- same op key,
+      // same response event -- and the bounded top-20 heap deltas. Empty when
+      // CTM_PERF_ATTRIBUTION=0.
+      cpuByOp: this._cpuByOpStatus(),
+      heapTopDeltas: this._heapTopDeltasStatus(),
     };
   }
 

package/template/coding-task-manager/lib/read-pool-worker-handle.js

@@ -194,13 +194,18 @@ function createPoolWorkerClass({
           workerData: { historyReaderContext: this.#historyReaderContext },
         });
         this.worker = worker;
+        // D-2 (docs/temp-file-leaks-disk-full-2026-10-25.html §8): captured at spawn, because a dead
+        // worker's own isolate can no longer report it. Threads share this process's pid, so pairing it
+        // with `_terminateIssued` below is the only evidence that a stopped thread left decode temps
+        // stranded mid-write (the write completed, its rename never ran).
+        const workerThreadId = worker.threadId;
 
         const failStart = (err) => {
           if (this.worker !== worker) return;
           if (this.ready) return;
           this.startPromise = null;
           this.worker = null;
-          try { worker.terminate(); } catch { /* expected: best-effort termination of a worker that failed to start */ }
+          try { this._terminateWorker(worker); } catch { /* expected: best-effort termination of a worker that failed to start */ }
           reject(err instanceof Error ? err : new Error(String(err || 'read-pool worker failed to start')));
         };
 
@@ -357,6 +362,17 @@ function createPoolWorkerClass({
           this._rejectAll(err);
         });
         worker.on('exit', (code) => {
+          // D-2: a thread stopped mid-op (crash, or our own terminate) can never run its own cleanup,
+          // so the temps IT left are reclaimed here by ownership. Deliberately before the `this.worker
+          // !== worker` staleness guard: a replaced handle is exactly the case where nothing else would
+          // ever look at these files. Never throws -- a hygiene sweep must not disturb exit handling.
+          if (code !== 0 || worker._terminateIssued) {
+            // Fire-and-forget: the reclaim walks the whole cache, so it must not run synchronously on
+            // this (main) loop. The listener stays synchronous; a failure is only ever logged.
+            const tid = Number.isInteger(workerThreadId) ? workerThreadId : worker.threadId;
+            require('./transcript-source').removeCacheTempsForThreadAsync(process.pid, tid)
+              .catch((error) => this.logger?.warn?.(`[read-pool] cache temp cleanup failed: ${error?.message || error}`));
+          }
           if (this.worker !== worker) return;
           const wasReady = this.ready;
           this.ready = false;
@@ -377,6 +393,15 @@ function createPoolWorkerClass({
       return this.startPromise;
     }
 
+    // D-2: every termination goes through here so the Worker object itself records that this thread was
+    // STOPPED (rather than closing itself), which is what makes its stranded decode temps reclaimable
+    // in the 'exit' listener. Returns worker.terminate()'s promise for the close() timeout path.
+    _terminateWorker(worker) {
+      if (!worker) return Promise.resolve();
+      worker._terminateIssued = true;
+      return worker.terminate();
+    }
+
     async request(op, payload, timeoutMs, lifecycle = {}) {
       let lifecycleDone = false;
       const completeLifecycle = () => {
@@ -624,7 +649,7 @@ function createPoolWorkerClass({
         // terminate immediately, dropping whatever this worker was carrying. The lazy
         // drain above is the default; this only exists as an escape hatch.
         this.retiring = true;
-        try { this.worker?.terminate(); } catch { /* expected: worker already exited or never started — the rollback path's only goal is that it is not running */ }
+        try { this._terminateWorker(this.worker); } catch { /* expected: worker already exited or never started — the rollback path's only goal is that it is not running */ }
         return;
       }
       this.retiring = true;
@@ -693,7 +718,7 @@ function createPoolWorkerClass({
         const finish = () => { if (done) return; done = true; resolve(); };
         let timer = null;
         if (timeoutMs > 0) {
-          timer = setTimeout(() => { worker.terminate().finally(finish); }, timeoutMs);
+          timer = setTimeout(() => { this._terminateWorker(worker).finally(finish); }, timeoutMs);
           if (typeof timer.unref === 'function') timer.unref();
         }
         const onMessage = (msg) => {
@@ -704,7 +729,7 @@ function createPoolWorkerClass({
         };
         worker.on('message', onMessage);
         try { worker.postMessage({ type: 'close' }); }
-        catch { /* expected: close post race with an exiting worker; termination completes the lifecycle */ if (timer) clearTimeout(timer); worker.off('message', onMessage); worker.terminate().finally(finish); }
+        catch { /* expected: close post race with an exiting worker; termination completes the lifecycle */ if (timer) clearTimeout(timer); worker.off('message', onMessage); this._terminateWorker(worker).finally(finish); }
       });
       if (this.worker === worker) {
         this.ready = false;

package/template/coding-task-manager/lib/recent-catalog-query.js

@@ -110,6 +110,17 @@ function mapAgent(agent, parentRow) {
   };
 }
 
+/**
+ * WP-0 (S-1, fleet-session-lists-hub-search-2026-11-01.html §6.1): the OWNER of a catalog row — the
+ * instance that executes it, falling back to its current owner. Unlike `machineFactsForRecentRow`
+ * this is unconditional: a box has no registered machines at all, so the tag path yields nothing
+ * there, and owner truth is exactly what a forwarded `owner=self` request filters on. Exported so
+ * the search projection (lib/api/session-messages.js) reads the same expression.
+ */
+function recentRowOwnerInstanceId(row) {
+  return String(row?.execution_host_instance_id || row?.current_owner_instance_id || '').trim();
+}
+
 /**
  * WP-3 (remote-hub-followups D-10): the machine tag for a recent row — the row's EXECUTION host
  * (falling back to its current owner) when that id names a REGISTERED machine and is not this host
@@ -202,6 +213,9 @@ function mapRecentSessionRow(row, options = {}) {
     parentAgentSessionId: row.parent_agent_session_id || primary?.parentAgentSessionId || '',
     agentNickname: row.agent_nickname || primary?.agentNickname || '',
     agentRole: row.agent_role || primary?.agentRole || '',
+    // WP-0 (S-1): owner truth, unconditionally — a box registers no machines, so the machine tag
+    // above never fires there and `owner=self` filters on THIS key. Empty string = unknown owner.
+    ownerInstanceId: recentRowOwnerInstanceId(row),
     // WP-3 (D-10): the machine tag, only when this row's execution host is a registered box.
     ...(machineFactsForRecentRow(row, options) || {}),
   };
@@ -259,5 +273,6 @@ module.exports = {
   mapRecentSessionRowsCooperatively,
   pickDisplayTitle,
   queryRecentCatalogSessions,
+  recentRowOwnerInstanceId,
   rowAgentSessionIds,
 };

package/template/coding-task-manager/lib/recent-session-catalog-response.js

@@ -92,22 +92,53 @@ function activityMs(session) {
 // session lives. Machine labeling MUST therefore use the machine's minted instance id
 // (`machine`/`machineName`, filled by lib/remote-machine-catalog.js) and NEVER a hostname: any
 // hostname-based label would silently claim a box's session is on this host (D-3).
-function buildRecentSessionCatalogResponse(input = {}) {
-  const shape = normalizeRecentCatalogShape(input.query);
-  const hostname = String(input.hostname || '');
-  const pinned = new Set((input.pinnedIds || []).map(String));
-  const sessions = (Array.isArray(input.sessions) ? input.sessions : [])
-    .map((session) => ({ ...session, hostname }))
-    .sort((a, b) => activityMs(b) - activityMs(a));
-  const selected = sessions.slice(0, shape.limit);
+/**
+ * WP-0 (S-2, fleet-session-lists-hub-search-2026-11-01.html §5 D-3, §6.1): the limit + starred rule,
+ * extracted pure so the owner filter can run BEFORE the limit.
+ *
+ * @param {object[]} sessions mapped recent rows (each carries `ownerInstanceId`, S-1)
+ * @param {{limit:number, pinnedIds?:string[], ownerLocalIds?:string[]|null}} opts
+ *   `ownerLocalIds` null/undefined = keep every row (today's behaviour). Otherwise a row is kept
+ *   iff it names no owner at all (`''` — an unknown/legacy owner) or names one of these ids. This
+ *   filter runs BEFORE the activityMs sort + slice, so foreign copies can never crowd out a box's
+ *   own sessions (the 3,775 Spark copies in the design doc's §1.1).
+ * @returns {object[]} activityMs desc, sliced to `limit`, then starred/pinned rows past it
+ */
+function selectRecentCatalogRows(sessions, { limit, pinnedIds = [], ownerLocalIds = null } = {}) {
+  const list = Array.isArray(sessions) ? sessions : [];
+  const localIds = Array.isArray(ownerLocalIds) ? ownerLocalIds : null;
+  const cap = Math.max(0, Number(limit) || 0);
+  const filtered = localIds
+    ? list.filter((session) => {
+      const owner = String(session?.ownerInstanceId || '').trim();
+      return !owner || localIds.includes(owner);
+    })
+    : list.slice();
+  const sorted = filtered.sort((a, b) => activityMs(b) - activityMs(a));
+  const selected = sorted.slice(0, cap);
   const selectedIds = new Set(selected.map((session) => String(session.sessionId || session.id || '')));
-  for (const session of sessions) {
+  for (const session of sorted) {
     const id = String(session.sessionId || session.id || '');
-    if (!selectedIds.has(id) && (session.starred || pinned.has(id))) {
+    if (!selectedIds.has(id) && (session.starred || pinnedIds.includes(id))) {
       selected.push(session);
       selectedIds.add(id);
     }
   }
+  return selected;
+}
+
+function buildRecentSessionCatalogResponse(input = {}) {
+  const shape = normalizeRecentCatalogShape(input.query);
+  const hostname = String(input.hostname || '');
+  const sessions = (Array.isArray(input.sessions) ? input.sessions : [])
+    .map((session) => ({ ...session, hostname }));
+  // WP-0 (S-2): only `owner=self` filters; every other value (including absent) keeps today's
+  // output byte for byte, apart from the `ownerInstanceId` key each mapped row now carries.
+  const selected = selectRecentCatalogRows(sessions, {
+    limit: shape.limit,
+    pinnedIds: (input.pinnedIds || []).map(String),
+    ownerLocalIds: input.ownerFilter === 'self' ? input.ownerLocalIds : null,
+  });
   const buffer = Buffer.from(JSON.stringify({
     sessions: selected,
     lastActiveProject: input.lastActiveProject || null,
@@ -126,6 +157,19 @@ function buildRecentSessionCatalogVariantBundle(input = {}) {
   const variants = [];
   const limits = [...new Set((input.limits || [1, 50, 100, 200, 500])
     .map((limit) => normalizeRecentCatalogShape({ limit }).limit))];
+  // WP-0 (S-3): the owner dimension of the key is emitted ONLY when this host actually holds a
+  // row it does not own — then `|self` is a genuinely different answer and the hub can ask for it.
+  // With no foreign row the all-variant IS the self answer, so no `|self` key exists (and the
+  // lookup falls back), keeping every existing key byte-identical.
+  // Fail OPEN: an empty lineage (identity not minted yet) cannot tell owned rows from copies, so no
+  // `|self` variant is built and an owner=self request falls back to the all-variant. The hub's
+  // merge still drops rows owned by its own lineage (fleet-session-lists D-4).
+  const ownerLocalIds = Array.isArray(input.ownerLocalIds) && input.ownerLocalIds.length ? input.ownerLocalIds : null;
+  const hasForeignRow = !!ownerLocalIds && (Array.isArray(input.sessions) ? input.sessions : [])
+    .some((session) => {
+      const owner = String(session?.ownerInstanceId || '').trim();
+      return !!owner && !ownerLocalIds.includes(owner);
+    });
   for (const limit of limits) {
     for (const stale of [false, true]) {
       const key = `${limit}|${stale ? 1 : 0}`;
@@ -133,6 +177,18 @@ function buildRecentSessionCatalogVariantBundle(input = {}) {
         ...input,
         query: { limit },
         stale,
+        ownerFilter: '',
+      });
+      variants.push({ key: Buffer.from(key, 'utf8'), body: response.buffer });
+    }
+    if (!hasForeignRow) continue;
+    for (const stale of [false, true]) {
+      const key = `${limit}|${stale ? 1 : 0}|self`;
+      const response = buildRecentSessionCatalogResponse({
+        ...input,
+        query: { limit },
+        stale,
+        ownerFilter: 'self',
       });
       variants.push({ key: Buffer.from(key, 'utf8'), body: response.buffer });
     }
@@ -184,5 +240,6 @@ module.exports = {
   buildRecentSessionCatalogVariantBundle,
   decodeRecentSessionCatalogVariantBundle,
   normalizeRecentCatalogShape,
+  selectRecentCatalogRows,
   snapshotRecentCatalogSessions,
 };

package/template/coding-task-manager/lib/recovery-evidence.js

@@ -6,6 +6,14 @@ const crypto = require('node:crypto');
 const { execFile } = require('node:child_process');
 const { readPrivateJson } = require('./recovery-private-file');
 
+// The writer witness is read with the system `lsof`, from fixed absolute paths only: a
+// PATH-resolved binary is caller-controlled and must not be able to answer (or refuse) a
+// piece of recovery evidence. macOS installs lsof under /usr/sbin, Debian-family Linux
+// under /usr/bin, so the probe walks both in that order -- same rule as
+// bin/deflake-source-snapshot.js's `lsofCwdUsers` (ENOENT moves on, any other refusal is
+// unknown), minus its leading bare-`lsof` PATH candidate.
+const LSOF_CANDIDATES = Object.freeze(['/usr/sbin/lsof', '/usr/bin/lsof']);
+
 // Controller ownership is rewritten by normal adoption; provider binding,
 // workspace, origin, model and all other stable columns remain in the witness.
 const VOLATILE_RECIPE_FIELDS = new Set(['pid', 'ctm_pid', 'ctm_instance_id', 'current_owner_instance_id', 'updated_at', 'last_heartbeat', 'last_activity', 'last_user_prompt_input_at', 'last_meaningful_activity_at', 'attention_dismissed_at', 'attention_dismissed_input_at']);
@@ -51,17 +59,24 @@ async function verifyWriterWitness(operation, { execFileImpl = execFile } = {})
   if (!stat.isFile() || stat.isSymbolicLink() || stat.uid !== operation.original.uid || String(stat.ino) !== String(witness.lockFile.inode) || String(stat.dev) !== String(witness.lockFile.dev)) return false;
   // This is continuity of an explicitly selected owner's descriptor, not a
   // generic claim that an open fd proves advisory-lock ownership.
-  return new Promise((resolve, reject) => execFileImpl('/usr/sbin/lsof', ['-nP', '-Fpf', '--', lockPath], { timeout: 3000, maxBuffer: 64 * 1024 }, (error, stdout) => {
-    // Evidence is tri-state: exit 1 with no holder is a real change, but any
-    // other sampler failure (timeout, signal, spawn error) is `unknown`, which
-    // callers must treat as a retryable hold rather than "the writer changed".
-    if (error) {
-      if (error.code === 1 && !String(stdout).trim()) return resolve(false);
-      return reject(Object.assign(new Error(`writer witness unavailable: lsof code=${error.code ?? ''} signal=${error.signal ?? ''} killed=${!!error.killed}`), { code: 'RECOVERY_EVIDENCE_UNKNOWN' }));
-    }
-    const holders = String(stdout).split('\n').filter((line) => /^p\d+$/.test(line)).map((line) => Number(line.slice(1)));
-    resolve(holders.length === 1 && holders[0] === operation.original.pid);
-  }));
+  return new Promise((resolve, reject) => {
+    const probe = (index) => execFileImpl(LSOF_CANDIDATES[index], ['-nP', '-Fpf', '--', lockPath], { timeout: 3000, maxBuffer: 64 * 1024 }, (error, stdout) => {
+      // Only a candidate that is not installed at this location (ENOENT) falls through to
+      // the next one: a sampler that ran and refused must not be bypassed by a second
+      // binary, so every other failure is decided by this candidate alone.
+      if (error?.code === 'ENOENT' && index + 1 < LSOF_CANDIDATES.length) return probe(index + 1);
+      // Evidence is tri-state: exit 1 with no holder is a real change, but any
+      // other sampler failure (timeout, signal, spawn error) is `unknown`, which
+      // callers must treat as a retryable hold rather than "the writer changed".
+      if (error) {
+        if (error.code === 1 && !String(stdout).trim()) return resolve(false);
+        return reject(Object.assign(new Error(`writer witness unavailable: lsof code=${error.code ?? ''} signal=${error.signal ?? ''} killed=${!!error.killed}`), { code: 'RECOVERY_EVIDENCE_UNKNOWN' }));
+      }
+      const holders = String(stdout).split('\n').filter((line) => /^p\d+$/.test(line)).map((line) => Number(line.slice(1)));
+      resolve(holders.length === 1 && holders[0] === operation.original.pid);
+    });
+    probe(0);
+  });
 }
 
 async function verifyPreservedEvidence(operation, tasks) {

package/template/coding-task-manager/lib/relay-client.js

@@ -22,7 +22,7 @@ const path = require('node:path');
 const { WebSocket } = require('ws');
 
 const { atomicWriteFileSync } = require('../atomic-write');
-const { createMux, TYPE, CONTROL_SUBPROTOCOL } = require('../../ctm-relay/lib/protocol.js');
+const { createMux, TYPE, CONTROL_SUBPROTOCOL, OPEN_KINDS } = require('../../ctm-relay/lib/protocol.js');
 
 const DEFAULT_LOCAL_TARGET = Object.freeze({ host: '127.0.0.1', port: 3456 });
 const DEFAULT_PING_INTERVAL_MS = 25_000;
@@ -55,6 +55,35 @@ function hostFor(relayUrl, relayHost) {
   return new URL(relayUrl).host;
 }
 
+// SNI names a host, not an endpoint: `r.walle.sh:8443` becomes `r.walle.sh`, and
+// a bracketed IPv6 literal loses its brackets.
+function hostnameOnly(host) {
+  const text = String(host);
+  if (text.startsWith('[')) {
+    const end = text.indexOf(']');
+    return end === -1 ? text : text.slice(1, end);
+  }
+  const colon = text.lastIndexOf(':');
+  return colon === -1 ? text : text.slice(0, colon);
+}
+
+// The TLS seam (WP-11b): the rev 2 edge routes on SNI, so a client that reaches
+// the relay by address (`https://127.0.0.1:<port>`) still has to name the host it
+// speaks for, and a test CA has to ride along in `ca`. The seam is `options.tls`,
+// spread into the WebSocket options verbatim.
+//
+// Production passes neither: `relayUrl = https://r.walle.sh` with no explicit
+// relayHost means the requested host IS the URL's host, so nothing is added and
+// `ws` derives everything from the URL exactly as it did before.
+function tlsOptionsFor(relayUrl, relayHost, tls) {
+  const options = tls && typeof tls === 'object' ? Object.assign({}, tls) : {};
+  if (typeof relayHost !== 'string' || relayHost.length === 0) return options;
+  if (options.servername) return options;
+  if (relayHost === new URL(relayUrl).host) return options;
+  options.servername = hostnameOnly(relayHost);
+  return options;
+}
+
 function forwardHeaders(raw, { keepUpgrade = false } = {}) {
   const out = {};
   for (const [key, value] of Object.entries(raw || {})) {
@@ -120,6 +149,7 @@ function createRelayClient(options = {}) {
 
   const connectUrl = connectUrlFor(relayUrl); // throws on a malformed relayUrl, at construction
   const relayHost = hostFor(relayUrl, options.relayHost);
+  const tlsOptions = tlsOptionsFor(relayUrl, options.relayHost, options.tls);
   const localTarget = Object.assign({}, DEFAULT_LOCAL_TARGET, options.localTarget || {});
   const stateFile = options.stateFile || null;
   const clientKind = options.clientKind || 'node';
@@ -351,6 +381,9 @@ function createRelayClient(options = {}) {
     if (stopping) return;
     transition('connecting');
     const ws = new WebSocket(connectUrl, CONTROL_SUBPROTOCOL, {
+      // `ca` / `servername` / anything else the caller supplied for TLS. Empty in
+      // production, so the options object is unchanged there.
+      ...tlsOptions,
       headers: {
         // The control plane is routable on the base domain only; tests dial
         // 127.0.0.1 while presenting the real Host.
@@ -407,11 +440,32 @@ function createRelayClient(options = {}) {
 
   // --- OPEN handling -------------------------------------------------------
 
+  // Dispatch by kind, explicitly. Rev 1 was `kind === 'upgrade' ? serveUpgrade :
+  // serveHttp`, so a missing or unknown kind was silently served as an HTTP
+  // request to the user's workbench. Never guess: anything outside OPEN_KINDS
+  // (rev 2 has one kind, 'tls') is a protocol violation and is RST with
+  // 'client_error', with no request made to the local target.
   function handleStream(stream) {
     const meta = stream.meta || {};
     stream.on('error', (err) => warn('relay-client stream error', err));
-    if (meta.kind === 'upgrade') serveUpgrade(stream, meta);
-    else serveHttp(stream, meta);
+    const kind = meta.kind;
+    if (!OPEN_KINDS.includes(kind)) {
+      // Missing, non-string, or a kind this client does not know.
+      stream.rst('client_error');
+      return;
+    }
+    switch (kind) {
+      case 'upgrade':
+        serveUpgrade(stream, meta);
+        return;
+      case 'http':
+        serveHttp(stream, meta);
+        return;
+      default:
+        // 'tls': known to the protocol, not served by this client yet.
+        // WP-14 terminates TLS here.
+        stream.rst('client_error');
+    }
   }
 
   function serveHttp(stream, meta) {

package/template/coding-task-manager/lib/relink-audit.js

@@ -13,6 +13,7 @@
 
 const transcriptSource = require('./transcript-source');
 const path = require('path');
+const { NOOP_LAP, createPerfTrace, perfPhasesJson } = require('./perf-phase-trace');
 const { readJsonlHeader, normalizeCwd, readFirstUserMessage, wordOverlap } = require('./session-verify.js');
 const { detectAgentType, normalizeAgentType } = require('./agent-capabilities.js');
 const {
@@ -96,15 +97,21 @@ function readAgentFirstUserMessage(filePath, agentType) {
  * @param {string} [opts.projectsDir] — defaults to ~/.claude/projects
  * @returns {{ tabs: Array, summary: Object }}
  */
-function auditRelink({ db, projectsDir }) {
+function _auditRelinkInner({ db, projectsDir }, trace) {
+  const lap = trace ? trace.lap : NOOP_LAP;
+  // a nested call already inside a lap: reported in counters, not phases
+  const countCall = (name, fn) => (trace ? trace.timed(name, fn) : fn());
   const claudeProjectsDir = projectsDir || path.join(process.env.HOME || '', '.claude', 'projects');
   const hasStartupTasks = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='startup_tasks'").get();
   if (!hasStartupTasks) {
+    lap('startup_tasks_probe', 0);
     return { tabs: [], summary: { total: 0, clean: 0, cross_linked: 0, stale: 0, orphan: 0, unclassified: 0, model_mismatch: 0 } };
   }
+  lap('startup_tasks_probe', 1);
 
   const stCols = new Set(db.prepare('PRAGMA table_info(startup_tasks)').all().map(c => c.name));
   const ctmCols = new Set(db.prepare('PRAGMA table_info(ctm_sessions)').all().map(c => c.name));
+  lap('schema_probe', 2);
   const stSelect = (name, alias = name, fallback = "''") => stCols.has(name)
     ? `st.${name} AS ${alias}`
     : `${fallback} AS ${alias}`;
@@ -135,6 +142,7 @@ function auditRelink({ db, projectsDir }) {
     LEFT JOIN ctm_sessions cs ON cs.id = st.ctm_session_id
     ORDER BY created_at
   `).all();
+  lap('load_startup_rows', rows.length);
 
   const agentCols = hasAgentSessions
     ? new Set(db.prepare('PRAGMA table_info(agent_sessions)').all().map(c => c.name))
@@ -162,6 +170,7 @@ function auditRelink({ db, projectsDir }) {
     agentsByCtm.get(agent.ctm_session_id).push(agent);
     ownerByAgent.set(agent.agent_session_id, agent);
   }
+  lap('load_agent_rows', agentRows.length);
 
   // Build a set of all ctm_session_ids — used to detect classic cross-link signature:
   // tab A's agent_session_id == tab B's ctm_session_id (means A got linked to B's original JSONL).
@@ -178,6 +187,7 @@ function auditRelink({ db, projectsDir }) {
       argsResumeId: extractResumeTarget(agentType, args)?.sessionId || null,
     });
   }
+  lap('build_startup_index', rows.length);
 
   const results = [];
   for (const row of rows) {
@@ -200,7 +210,7 @@ function auditRelink({ db, projectsDir }) {
     for (const ag of agentList) {
       const agType = normalizeAgentType(ag.provider || '') || agentType;
       const filePath = ag.jsonl_path || (agType === 'codex' ? '' : path.join(projectDir, `${ag.agent_session_id}.jsonl`));
-      const fileView = transcriptSource.statTranscriptSync(filePath);
+      const fileView = countCall('stat_transcript', () => transcriptSource.statTranscriptSync(filePath));
       const exists = fileView.exists;
       let header = null;
       let stat = null;
@@ -208,10 +218,10 @@ function auditRelink({ db, projectsDir }) {
       let contentOverlap = null;
       if (exists) {
         stat = fileView;
-        header = readAgentHeader(filePath, agType);
+        header = countCall('read_header', () => readAgentHeader(filePath, agType));
         // Only bother reading first user message if we have a tab message to compare
         if (tabFirstMsg && tabFirstMsg.length >= 10) {
-          fileFirstUserMsg = readAgentFirstUserMessage(filePath, agType);
+          fileFirstUserMsg = countCall('read_first_user_message', () => readAgentFirstUserMessage(filePath, agType));
           if (fileFirstUserMsg) {
             contentOverlap = wordOverlap(tabFirstMsg, fileFirstUserMsg);
           }
@@ -239,7 +249,7 @@ function auditRelink({ db, projectsDir }) {
       let codexStateModel = '';
       if (agType === 'codex') {
         try {
-          codexStateModel = String(getCodexStateThreadById(ag.agent_session_id, process.env.HOME)?.model || '');
+          codexStateModel = String(countCall('codex_state_read', () => getCodexStateThreadById(ag.agent_session_id, process.env.HOME))?.model || '');
         } catch { codexStateModel = ''; /* expected: best-effort audit column */ }
       }
       agents.push({
@@ -382,6 +392,7 @@ function auditRelink({ db, projectsDir }) {
       details,
     });
   }
+  lap('tab_loop', rows.length);
 
   const summary = {
     total: results.length,
@@ -392,8 +403,26 @@ function auditRelink({ db, projectsDir }) {
     unclassified: results.filter(r => r.verdict === 'unclassified').length,
     model_mismatch: results.filter(r => r.model_mismatch === true).length,
   };
+  lap('build_summary', results.length);
 
   return { tabs: results, summary };
 }
 
+/**
+ * Perf-attribution wrapper (WP-0 / M-3): runs the audit with a phase trace, attaches it as
+ * `result.phases` (additive field — tabs/summary are unchanged) and logs one
+ * `[session-integrity] phases {...}` line for this run. Measurement only: with
+ * CTM_PERF_ATTRIBUTION off the trace is null, so nothing is attached or logged.
+ */
+function auditRelink(opts) {
+  const trace = createPerfTrace();
+  const result = _auditRelinkInner(opts, trace);
+  if (trace) {
+    trace.lap('finalize', 1);
+    result.phases = trace.phases;
+    console.log(`[session-integrity] phases ${perfPhasesJson('relink', trace)}`);
+  }
+  return result;
+}
+
 module.exports = { auditRelink };