unsnooze 1.10.0 → 1.12.2

package/src/doctor.js

@@ -0,0 +1,310 @@
+// `unsnooze doctor [--fix]` — health check + csg (claude-session-guard)
+// migration sweep. npm has no successor mechanism and `-g` uninstall hooks are
+// unreliable, so the ONLY robust cleanup of the pre-release csg install is
+// unsnooze itself finding and retiring its leftovers: zombie csg monitors/
+// resumers, an old launchd/systemd unit, the orphaned state dir, the stale
+// global package. Everything is injectable for tests; --fix never deletes
+// data (the state dir is archived) and never runs npm (hint only).
+
+import { readFileSync, readdirSync, renameSync, existsSync, unlinkSync, lstatSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { CLAUDE_SETTINGS, RESUMER_LOCK } from './config.js';
+import { getMultiplexer } from './multiplexer.js';
+import { makeLogger } from './logger.js';
+
+const log = makeLogger('doctor');
+
+const CSG_PROCESS_RE = /\bcsg\.js\s+_?(?:monitor|resumer|run|daemon|hook)/;
+// A unit is csg-legacy when it execs csg.js, or mentions claude-session-guard
+// WITHOUT execing unsnooze — the dev repo kept the old folder name after the
+// rename, so a live unsnooze daemon plist can legitimately have
+// .../claude-session-guard/bin/unsnooze.js in its path. Flagging that would
+// let --fix destroy the running daemon.
+function isCsgUnit(content) {
+  if (/csg\.js/.test(content)) return true;
+  return /claude-session-guard/.test(content) && !/unsnooze\.js|com\.unsnooze/.test(content);
+}
+
+function defaultRunner(cmd, args) {
+  try {
+    return spawnSync(cmd, args, { encoding: 'utf-8' });
+  } catch (err) {
+    return { status: 1, stdout: '', error: err };
+  }
+}
+
+// --- detections ---------------------------------------------------------------
+
+/** Live csg-era processes (monitors/resumers/daemons). */
+export function findCsgProcesses({ runner = defaultRunner } = {}) {
+  const r = runner('ps', ['-axo', 'pid=,command=']);
+  if (r.error || r.status !== 0) return [];
+  return String(r.stdout || '').split('\n')
+    .map(line => line.trim())
+    .filter(line => CSG_PROCESS_RE.test(line))
+    .map(line => {
+      const m = line.match(/^(\d+)\s+(.*)$/);
+      return m ? { pid: Number(m[1]), command: m[2] } : null;
+    })
+    .filter(Boolean);
+}
+
+/** launchd plists / systemd units that exec csg (never the unsnooze one). */
+export function findCsgAutostarts({ dir = defaultLaunchAgentsDir() } = {}) {
+  try {
+    return readdirSync(dir)
+      .filter(name => name.endsWith('.plist') || name.endsWith('.service'))
+      .map(name => join(dir, name))
+      .filter(path => {
+        try { return isCsgUnit(readFileSync(path, 'utf-8')); }
+        catch { return false; }
+      });
+  } catch {
+    return [];   // dir missing — nothing installed
+  }
+}
+
+function defaultLaunchAgentsDir(platform = process.platform) {
+  if (platform === 'darwin') {
+    return process.env.UNSNOOZE_LAUNCH_AGENTS_DIR || join(homedir(), 'Library', 'LaunchAgents');
+  }
+  return process.env.UNSNOOZE_SYSTEMD_USER_DIR || join(homedir(), '.config', 'systemd', 'user');
+}
+
+// The stale global package. `command -v csg` is NOT enough: after the rename
+// the repo has no bin/csg.js, so the global `csg` symlink dangles and shells
+// skip it — but the package entry in node_modules is still there (often as an
+// npm-link). lstat sees the entry even when the symlink target is gone.
+export function defaultCsgPackagePath({
+  runner = defaultRunner,
+  execPathRoots = [join(dirname(dirname(process.execPath)), 'lib', 'node_modules')],
+} = {}) {
+  const roots = [];
+  const r = runner('npm', ['root', '-g']);
+  if (!r.error && r.status === 0 && r.stdout) roots.push(String(r.stdout).trim());
+  roots.push(...execPathRoots);   // nvm/unix prefix layout fallback when npm is slow/absent
+  for (const root of roots) {
+    if (!root) continue;
+    const candidate = join(root, 'claude-session-guard');
+    try { lstatSync(candidate); return candidate; } catch { /* not here */ }
+  }
+  return null;
+}
+
+function defaultHookInstalled(settingsPath = CLAUDE_SETTINGS) {
+  try {
+    const settings = JSON.parse(readFileSync(settingsPath, 'utf-8'));
+    return (settings.hooks?.StopFailure || []).some(entry =>
+      (entry.hooks || []).some(h => /unsnooze\.js"? _hook-stopfailure/.test(h.command || '')));
+  } catch {
+    return false;
+  }
+}
+
+function defaultWrappersInstalled() {
+  return [join(homedir(), '.zshrc'), join(homedir(), '.bashrc')].some(rc => {
+    try { return readFileSync(rc, 'utf-8').includes('# >>> unsnooze >>>'); }
+    catch { return false; }
+  });
+}
+
+function daemonRunning() {
+  try {
+    const pid = parseInt(readFileSync(RESUMER_LOCK, 'utf-8'), 10);
+    if (!Number.isFinite(pid)) return false;
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// --- report ---------------------------------------------------------------------
+
+/**
+ * Run every check. Findings: { id, kind: 'legacy'|'health'|'info', title,
+ * detail, fix? } — `fix` is a machine-actionable descriptor consumed by
+ * applyFixes. healthy === no legacy and no health findings.
+ */
+export async function runDoctor({
+  runner = defaultRunner,
+  platform = process.platform,
+  launchAgentsDir = defaultLaunchAgentsDir(platform),
+  csgStateDir = join(homedir(), '.claude-session-guard'),
+  csgBinPath = defaultCsgPackagePath({ runner }),
+  mux = getMultiplexer(),
+  hookInstalled = defaultHookInstalled,
+  wrappersInstalled = defaultWrappersInstalled,
+} = {}) {
+  const findings = [];
+
+  const procs = findCsgProcesses({ runner });
+  if (procs.length) {
+    findings.push({
+      id: 'csg-processes', kind: 'legacy',
+      title: `${procs.length} old csg process(es) still running`,
+      detail: procs.map(p => `  pid ${p.pid}: ${p.command}`).join('\n'),
+      fix: { action: 'kill-processes', pids: procs.map(p => p.pid) },
+    });
+  }
+
+  const units = findCsgAutostarts({ dir: launchAgentsDir });
+  if (units.length) {
+    findings.push({
+      id: 'csg-autostart', kind: 'legacy',
+      title: 'old csg daemon autostart unit(s) present',
+      detail: units.map(u => `  ${u}`).join('\n'),
+      fix: { action: 'remove-units', units, platform },
+    });
+  }
+
+  if (existsSync(csgStateDir)) {
+    findings.push({
+      id: 'csg-state-dir', kind: 'legacy',
+      title: `old csg state dir at ${csgStateDir}`,
+      detail: '  contains the pre-rename ledger/logs; superseded by ~/.unsnooze',
+      fix: { action: 'archive-dir', dir: csgStateDir },
+    });
+  }
+
+  if (csgBinPath) {
+    findings.push({
+      id: 'csg-package', kind: 'legacy',
+      title: `old claude-session-guard package still installed (${csgBinPath})`,
+      detail: '  run: npm rm -g claude-session-guard',
+      // npm owns the package (it may even be an npm-link to a dev repo) —
+      // doctor only ever hints, never runs npm.
+    });
+  }
+
+  if (!hookInstalled()) {
+    findings.push({
+      id: 'hook-missing', kind: 'health',
+      title: 'Claude StopFailure hook is not installed',
+      detail: '  run: unsnooze install --yes',
+    });
+  }
+  if (!wrappersInstalled()) {
+    findings.push({
+      id: 'wrappers-missing', kind: 'health',
+      title: 'shell wrappers are not installed',
+      detail: '  run: unsnooze install --yes  (then: exec $SHELL)',
+    });
+  }
+  let muxOk = false;
+  try { muxOk = !!mux.available(); } catch { muxOk = false; }
+  if (!muxOk) {
+    findings.push({
+      id: 'mux-missing', kind: 'health',
+      title: `${mux.name || 'tmux'} is not installed — limit-watch and revival are off`,
+      detail: `  install ${mux.name || 'tmux'} to enable auto-resume`,
+    });
+  }
+
+  findings.push({
+    id: 'daemon', kind: 'info',
+    title: daemonRunning() ? 'resumer/daemon: running' : 'resumer/daemon: not running (starts on the next limit stop)',
+    detail: '',
+  });
+
+  const healthy = findings.every(f => f.kind === 'info');
+  return { findings, healthy };
+}
+
+// --- fixes ------------------------------------------------------------------------
+
+function defaultKill(pid) {
+  try { process.kill(pid, 'SIGTERM'); return true; } catch { return false; }
+}
+
+/** Apply the machine-actionable fixes from a runDoctor report. */
+export async function applyFixes(report, {
+  kill = defaultKill,
+  runner = defaultRunner,
+  now = Date.now(),
+} = {}) {
+  const actions = [];
+  for (const finding of report.findings) {
+    const fix = finding.fix;
+    if (!fix) continue;
+    if (fix.action === 'kill-processes') {
+      for (const pid of fix.pids) {
+        kill(pid);
+        actions.push({ action: 'killed', pid });
+        log(`doctor: SIGTERM csg process ${pid}`);
+      }
+    } else if (fix.action === 'remove-units') {
+      for (const unit of fix.units) {
+        if (fix.platform === 'darwin') runner('launchctl', ['unload', unit]);
+        else runner('systemctl', ['--user', 'disable', '--now', unit]);
+        try { unlinkSync(unit); } catch { /* already gone */ }
+        actions.push({ action: 'removed-unit', unit });
+        log(`doctor: removed csg autostart ${unit}`);
+      }
+    } else if (fix.action === 'archive-dir') {
+      let target = `${fix.dir}.bak`;
+      if (existsSync(target)) target = `${fix.dir}.bak.${now}`;
+      try {
+        renameSync(fix.dir, target);
+        actions.push({ action: 'archived', from: fix.dir, to: target });
+        log(`doctor: archived ${fix.dir} → ${target}`);
+      } catch (err) {
+        actions.push({ action: 'error', detail: `archive ${fix.dir}: ${err.message}` });
+      }
+    }
+  }
+  return actions;
+}
+
+// --- CLI --------------------------------------------------------------------------
+
+export async function cmdDoctor(rest = [], deps = {}) {
+  const { print = console.log, ...checkDeps } = deps;
+  const wantFix = rest.includes('--fix');
+  const report = await runDoctor(checkDeps);
+
+  const legacy = report.findings.filter(f => f.kind === 'legacy');
+  const health = report.findings.filter(f => f.kind === 'health');
+  const info = report.findings.filter(f => f.kind === 'info');
+
+  if (legacy.length) {
+    print('unsnooze doctor — leftovers from the old claude-session-guard (csg) install:');
+    for (const f of legacy) {
+      print(`  ✗ ${f.title}`);
+      if (f.detail) print(f.detail);
+    }
+  }
+  if (health.length) {
+    print('unsnooze doctor — install health:');
+    for (const f of health) {
+      print(`  ✗ ${f.title}`);
+      if (f.detail) print(f.detail);
+    }
+  }
+  for (const f of info) print(`  · ${f.title}`);
+
+  if (report.healthy) {
+    print('unsnooze doctor: all clear — install is healthy.');
+    return 0;
+  }
+
+  if (wantFix) {
+    const actions = await applyFixes(report, deps);
+    for (const a of actions) {
+      if (a.action === 'killed') print(`  ✓ stopped csg process ${a.pid}`);
+      else if (a.action === 'removed-unit') print(`  ✓ removed ${a.unit}`);
+      else if (a.action === 'archived') print(`  ✓ archived ${a.from} → ${a.to}`);
+      else if (a.action === 'error') print(`  ! ${a.detail}`);
+    }
+    const pkg = legacy.find(f => f.id === 'csg-package');
+    if (pkg) print('  → finish up manually: npm rm -g claude-session-guard');
+    return 0;
+  }
+
+  print(legacy.length
+    ? '\nRun `unsnooze doctor --fix` to stop csg processes, remove its autostart, and archive its state.'
+    : '\nSee the hints above to finish the install.');
+  return 1;
+}

package/src/install.js

@@ -16,6 +16,7 @@ import { CLAUDE_SETTINGS, STATE_DIR } from './config.js';
 import { getConfig, configFileExists } from './settings.js';
 import { xmlEscape } from './notify.js';
 import { installGrokHooks, uninstallGrokHooks } from './agents/grok.js';
+import { findCsgProcesses, findCsgAutostarts } from './doctor.js';
 import { UNSNOOZE_BIN, stopResumer } from './spawn.js';
 
 const FENCE_OPEN = '# >>> unsnooze >>>';
@@ -47,6 +48,15 @@ function atomicWrite(path, content) {
   renameSync(tmp, path);
 }
 
+// Two backup tiers: `.unsnooze-orig` is the pristine pre-unsnooze snapshot,
+// written exactly once (a re-run must never overwrite it with an already-
+// modified file); `.unsnooze-bak` rolls forward on every run.
+function backupOnce(path) {
+  const orig = `${path}.unsnooze-orig`;
+  if (!existsSync(orig)) copyFileSync(path, orig);
+  copyFileSync(path, `${path}.unsnooze-bak`);
+}
+
 // --- settings.json hook management ---
 
 function isOurs(entry) {
@@ -149,6 +159,7 @@ function autostartDir(platform) {
 export function launchdPlist({
   nodeBin = process.execPath, unsnoozeBin = UNSNOOZE_BIN,
   logFile = join(STATE_DIR, 'daemon.log'),
+  path = process.env.PATH || '/usr/local/bin:/opt/homebrew/bin:/usr/bin:/bin',
 } = {}) {
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -161,8 +172,18 @@ export function launchdPlist({
     <string>${xmlEscape(unsnoozeBin)}</string>
     <string>daemon</string>
   </array>
+  <!-- launchd default PATH is /usr/bin:/bin:/usr/sbin:/sbin — tmux (usually
+       /opt/homebrew/bin or /usr/local/bin) is invisible to the daemon and
+       every revival dies with spawn ENOENT. Bake the install-time PATH. -->
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key><string>${xmlEscape(path)}</string>
+  </dict>
   <key>RunAtLoad</key><true/>
   <key>KeepAlive</key><true/>
+  <!-- Without a throttle, KeepAlive + a half-installed package (npm -g
+       upgrade window) = instant-respawn crash-loop into the log. -->
+  <key>ThrottleInterval</key><integer>30</integer>
   <key>StandardOutPath</key><string>${xmlEscape(logFile)}</string>
   <key>StandardErrorPath</key><string>${xmlEscape(logFile)}</string>
 </dict>
@@ -170,14 +191,26 @@ export function launchdPlist({
 `;
 }
 
-export function systemdUnit({ nodeBin = process.execPath, unsnoozeBin = UNSNOOZE_BIN } = {}) {
+export function systemdUnit({
+  nodeBin = process.execPath, unsnoozeBin = UNSNOOZE_BIN,
+  path = process.env.PATH || '/usr/local/bin:/usr/bin:/bin',
+} = {}) {
+  // Restart=always, not on-failure: the version-skew guard and the
+  // upgrade-window fail-safe exit 0 EXPECTING a respawn on fresh code.
+  // RestartSec throttles (like launchd's ThrottleInterval); the start
+  // rate-limit is disabled so a long broken-install window can never trip
+  // the unit into a permanent 'failed' state. Environment PATH mirrors the
+  // launchd fix — user units get a minimal PATH that may not find tmux.
+  // systemd treats % as a specifier — escape as %%.
   return `[Unit]
 Description=unsnooze daemon — watches GUI AI-coding sessions for limit stops
+StartLimitIntervalSec=0
 
 [Service]
 ExecStart="${nodeBin}" "${unsnoozeBin}" daemon
-Restart=on-failure
-RestartSec=10
+Environment="PATH=${path.replace(/%/g, '%%')}"
+Restart=always
+RestartSec=30
 
 [Install]
 WantedBy=default.target
@@ -211,6 +244,28 @@ export function installDaemonAutostart({ platform = process.platform, dir = null
   return null;   // native Windows: no supported multiplexer to revive into
 }
 
+// One-time self-heal for units written before 1.12.0: they carry no PATH, so
+// the daemon cannot find tmux (launchd gives daemons /usr/bin:/bin:… only) and
+// every revival dies with spawn ENOENT. npm updates never touch the unit file,
+// so the daemon repairs it on startup: regenerate + reload. Reloading kills
+// the calling daemon — by design; the supervisor restarts it under the fixed
+// unit. Returns the healed target, or null when nothing needed healing.
+export function healDaemonAutostart({ platform = process.platform, dir = null, activate = defaultActivate } = {}) {
+  const marker = platform === 'darwin' ? 'EnvironmentVariables' : 'Environment="PATH=';
+  const target = platform === 'darwin'
+    ? join(dir || autostartDir(platform), `${DAEMON_LABEL}.plist`)
+    : platform === 'linux'
+      ? join(dir || autostartDir(platform), 'unsnooze.service')
+      : null;
+  if (!target || !existsSync(target)) return null;   // not a daemon-autostart user
+  try {
+    if (readFileSync(target, 'utf-8').includes(marker)) return null;   // already current
+  } catch {
+    return null;   // unreadable — leave it alone
+  }
+  return installDaemonAutostart({ platform, dir, activate });
+}
+
 export function uninstallDaemonAutostart({ platform = process.platform, dir = null, activate = defaultActivate } = {}) {
   if (platform === 'darwin') {
     const target = join(dir || autostartDir(platform), `${DAEMON_LABEL}.plist`);
@@ -287,7 +342,7 @@ export function cmdInstall(rest, { agents = enabledAgents() } = {}) {
   //    when installed below).
   if (agents.includes('claude')) {
     if (existsSync(opts.settings)) {
-      copyFileSync(opts.settings, `${opts.settings}.unsnooze-bak`);
+      backupOnce(opts.settings);
       const before = readFileSync(opts.settings, 'utf-8');
       atomicWrite(opts.settings, mergeHookIntoSettings(before));
       console.log(`unsnooze: StopFailure hook installed in ${opts.settings} (backup: ${opts.settings}.unsnooze-bak)`);
@@ -319,7 +374,7 @@ export function cmdInstall(rest, { agents = enabledAgents() } = {}) {
       console.log(`unsnooze: "${OLD_FENCE_OPEN}" block manually first.`);
       return 1;
     }
-    if (existsSync(rc)) copyFileSync(rc, `${rc}.unsnooze-bak`);
+    if (existsSync(rc)) backupOnce(rc);
     const { content, oldRemoved } = installZshrcBlock(rcContent, agents);
     atomicWrite(rc, content);
     console.log(`unsnooze: wrappers (${agents.join(', ')}) installed in ${rc}${oldRemoved ? ' (legacy wrapper block removed)' : ''}`);
@@ -332,6 +387,20 @@ export function cmdInstall(rest, { agents = enabledAgents() } = {}) {
     else console.log('unsnooze: daemon autostart is not supported on this platform');
   }
 
+  // 5. Migration sweep: an upgrade from the pre-release csg leaves its
+  //    monitors/daemon/state behind (npm cannot clean up a renamed package) —
+  //    surface it right where upgraders will see it. Detection only; the
+  //    actual retirement is `unsnooze doctor --fix`, one explicit step away.
+  try {
+    const legacy = findCsgProcesses().length > 0
+      || findCsgAutostarts().length > 0
+      || existsSync(join(homedir(), '.claude-session-guard'));
+    if (legacy) {
+      console.log('\nunsnooze: leftovers from the old claude-session-guard (csg) install detected.');
+      console.log('unsnooze: run `unsnooze doctor --fix` to stop its processes and retire its files.');
+    }
+  } catch { /* detection is best-effort — never fail an install over it */ }
+
   console.log('\nunsnooze: done. Reload your shell:');
   console.log('  exec $SHELL');
   return 0;

package/src/launcher.js

@@ -74,6 +74,11 @@ export function runLauncher(args, agentId = 'claude') {
     : null;
   const leaseId = process.env.UNSNOOZE_LEASE_ID || createLeaseId();
   if (pane) {
+    // Stamp our own pane (best-effort, tmux only): the identity every later
+    // close/inject decision verifies against — pane ids get recycled.
+    if (typeof mux.stampPaneOwner === 'function') {
+      mux.stampPaneOwner(pane, leaseId).catch(() => { /* legacy tmux */ });
+    }
     spawnDetached(['_monitor', mux.name, paneOwner || '', pane, agent.id, leaseId],
       { UNSNOOZE_CWD: process.cwd() });
     log(`launching ${agent.id} in ${mux.name} ${paneOwner ?? '-'}:${pane}, monitor spawned`);

package/src/lease.js

@@ -85,3 +85,25 @@ export async function leaseMatches(rec, {
   if (!birth || birth !== stored.pidBirth) return false;
   try { return await mux.paneAlive(rec.pane); } catch { return false; }
 }
+
+// Ownership decision for anything that would TYPE INTO or CLOSE rec.pane.
+// Pane ids are recycled, so proof is required, in two layers:
+//   1. the @unsnooze_owner pane stamp (tmux; survives agent exit, dies with
+//      the pane): match → true, MISMATCH → false regardless of the lease —
+//      the pane id demonstrably belongs to a different launch now;
+//   2. the lease (pid + birth): proves the leased agent process is alive.
+// Returns true (ours), false (not ours), or null (record has no lease at all
+// and no stamp evidence — legacy/GUI record; the caller applies its own
+// last-resort heuristic).
+export async function paneOwnedByRecord(rec, { mux, matchesLease = leaseMatches } = {}) {
+  if (!rec?.pane || !mux) return rec?.leaseId ? false : null;
+  let stamp = null;
+  if (typeof mux.paneOwnerStamp === 'function') {
+    try { stamp = await mux.paneOwnerStamp(rec.pane); } catch { stamp = null; }
+  }
+  if (stamp != null && stamp !== '') {
+    return rec.leaseId != null && stamp === rec.leaseId;
+  }
+  if (await matchesLease(rec, { mux })) return true;
+  return rec.leaseId ? false : null;
+}

package/src/logger.js

@@ -1,9 +1,47 @@
-import { appendFileSync, mkdirSync } from 'node:fs';
+import { appendFileSync, mkdirSync, statSync, renameSync, copyFileSync, truncateSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { LOG_FILE } from './config.js';
 
+// Logs must never grow unbounded (a single upgrade-window crash-loop once
+// produced a 10.3 MB daemon.log). One rotated generation is kept: file → .1.
+export const LOG_MAX_BYTES = 5 * 1024 * 1024;
+
 let dirReady = false;
 
+/**
+ * Rename `path` to `path.1` when it exceeds maxBytes (replacing any previous
+ * .1). Returns true when a rotation happened. Missing files and fs errors are
+ * a quiet no-op — rotation must never crash the hook or monitor paths.
+ */
+export function rotateIfLarge(path, maxBytes = LOG_MAX_BYTES) {
+  try {
+    if (statSync(path).size <= maxBytes) return false;
+    renameSync(path, `${path}.1`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Copy-truncate variant for files another process holds OPEN (launchd's
+ * StandardOut/ErrorPath fd on daemon.log): renaming such a file would leave
+ * the holder writing to the renamed inode forever, with no fresh file until
+ * its next restart. Copying to .1 and truncating in place keeps the inode —
+ * the holder's O_APPEND writes continue into the now-empty live file.
+ * Same quiet-no-op error contract as rotateIfLarge.
+ */
+export function copyTruncateIfLarge(path, maxBytes = LOG_MAX_BYTES) {
+  try {
+    if (statSync(path).size <= maxBytes) return false;
+    copyFileSync(path, `${path}.1`);
+    truncateSync(path, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function log(component, message) {
   const line = `${new Date().toISOString()} [${component}] ${message}\n`;
   try {
@@ -11,6 +49,7 @@ export function log(component, message) {
       mkdirSync(dirname(LOG_FILE), { recursive: true });
       dirReady = true;
     }
+    rotateIfLarge(LOG_FILE);
     appendFileSync(LOG_FILE, line);
   } catch {
     // Logging must never crash the hook or monitor paths.

package/src/monitor.js

@@ -25,7 +25,7 @@ import { upsertSession, setStatus, readState, updateState } from './state.js';
 import { latestRateLimitFromTranscript } from './watchers/claude.js';
 import { spawnResumerIfNeeded } from './spawn.js';
 import { makeLogger } from './logger.js';
-import { addressHash } from './lease.js';
+import { addressHash, readLease } from './lease.js';
 
 const log = makeLogger('monitor');
 
@@ -42,6 +42,7 @@ export function createMonitor({
   let terminalNotified = false;   // one notification per terminal-error appearance
   let running = true;
   let firstTick = true;           // §6: don't inherit a previous session's banner
+  let leaseSeen = false;          // F4: enforce lease-gone exit only after first sighting
 
   function markerPath() {
     return join(EVENTS_DIR, `${addressHash({ mux: muxName, paneOwner, pane })}.json`);
@@ -202,6 +203,22 @@ export function createMonitor({
       return;
     }
 
+    // F4: the pane can outlive the agent (in the user's own tmux the pane is
+    // their shell). The launcher removes the lease when the agent exits — a
+    // vanished lease means there is nothing left to watch, and continuing
+    // would scrape (and eventually type into) whatever now runs in the pane.
+    // The launcher writes the lease AFTER spawning us, so enforcement starts
+    // only once the lease has been seen.
+    if (leaseId) {
+      const lease = readLease({ mux: muxName, paneOwner, pane }, leaseId);
+      if (lease) leaseSeen = true;
+      else if (leaseSeen) {
+        log(`pane ${pane}: lease ${leaseId} gone — agent exited, monitor exiting`);
+        running = false;
+        return;
+      }
+    }
+
     const marker = consumeMarker();
     let text;
     try {
@@ -326,6 +343,7 @@ export function createMonitor({
     _tick: tick,   // exposed for tests
     get trackedKey() { return trackedKey; },
     get _firstTick() { return firstTick; },
+    get _running() { return running; },
   };
 }