server.js

// libuv threadpool headroom (default 4): a few fs ops stuck on a dying fuse
// mount used to starve EVERY async fs/dns op server-wide (real outage — see
// mounts.js hung-mount defense). Must be set before the pool first spins up,
// i.e. before any require that performs async I/O.
process.env.UV_THREADPOOL_SIZE = process.env.UV_THREADPOOL_SIZE || '32';
const express = require('express');
const http = require('http');
const { WebSocketServer } = require('ws');
const pty = require('node-pty');
const path = require('path');
const fs = require('fs');
const os = require('os');
const { execFileSync, spawn } = require('child_process');
const compression = require('compression');
const { MessageManager } = require('./src/message-manager');
const { createMessageManager } = require('./src/normalizers');
const { Telemetry } = require('./src/telemetry');
const { SyncStore } = require('./src/sync-store');
const { cwdToProjectDir, SessionMessages, findSessionJsonlPath, dedupWebuiSockets } = require('./src/session-store');
const { CodexSessionMessages } = require('./src/codex-session-store');
const { normalizeCodexSource, CODEX_SESSIONS_DIR } = require('./src/adapters/codex');
const { createAdapterRegistry } = require('./src/adapters');
const { buildClaudeSubscriptionLoginCommand } = require('./src/claude-subscription-login');
const fileRoutes = require('./src/routes/files');
const { SafeFs } = require('./src/safe-fs');
const { router: persistenceRouter, setup: setupPersistence } = require('./src/routes/persistence');

// ── Env sanitation: the server may have been (re)started from INSIDE a Claude
// Code session (e.g. an agent running in a WebUI terminal restarts it). The
// inherited session env then leaks into every CLI this server spawns —
// CLAUDE_CODE_CHILD_SESSION=1 alone puts a spawned claude into child-session
// mode: NO lock file, NO project transcript. Conversations look fine live but
// are silently unpersisted — terminate + resume loses everything (verified on
// CLI 2.1.199 by A/B env test). Strip the whole inherited set at startup so all
// spawn paths (dtach spawn line, wrappers, probes) run top-level.
if (process.env.CLAUDECODE || process.env.CLAUDE_CODE_CHILD_SESSION) {
  const stripped = [];
  for (const k of Object.keys(process.env)) {
    if (k === 'CLAUDECODE' || k === 'CLAUDE_EFFORT' || k.startsWith('CLAUDE_CODE_') || k.startsWith('CLAUDE_WEBUI_')) {
      stripped.push(k);
      delete process.env[k];
    }
  }
  console.warn(`[env] Server was started from inside a Claude Code session — stripped inherited session env (${stripped.join(', ')}) so spawned CLIs run top-level. Without this, spawned sessions never write transcripts and their conversations are LOST on resume.`);
}

// Optional persistent ops log (env-gated no-op without VIBESPACE_OPSLOG_DIR) —
// installed EARLY so the console tee captures the whole boot narrative.
try { require('./src/opslog').setupOpslog(require('./package.json').version); } catch (e) { console.warn('[opslog] init failed:', e.message); }

// Auto-update: pull latest + rebuild on startup (skip with NO_AUTO_UPDATE=1)
if (!process.env.NO_AUTO_UPDATE) {
  try {
    const repoDir = __dirname;
    // Ensure Homebrew/nvm paths are in PATH for child processes (macOS non-login shells)
    const nodeDir = path.dirname(process.execPath);
    const envPath = [nodeDir, process.env.PATH].filter(Boolean).join(path.delimiter);
    const spawnEnv = { ...process.env, PATH: envPath };
    const result = execFileSync('git', ['-C', repoDir, 'pull', '--ff-only'], { encoding: 'utf-8', timeout: 15000, stdio: ['pipe', 'pipe', 'pipe'] }).trim();
    if (result && !result.includes('Already up to date')) {
      console.log('[auto-update] git pull:', result);
      execFileSync('npm', ['install', '--no-audit', '--no-fund'], { cwd: repoDir, encoding: 'utf-8', timeout: 60000, stdio: 'inherit', env: spawnEnv });
      execFileSync('npm', ['run', 'build'], { cwd: repoDir, encoding: 'utf-8', timeout: 30000, stdio: 'inherit', env: spawnEnv });
      console.log('[auto-update] rebuilt successfully');
    }
  } catch (e) { console.log('[auto-update] skipped:', e.message?.split('\n')[0]); }
}

const PORT = process.env.PORT || 3456;
const CLAUDE_CMD_RAW = process.env.CLAUDE_CMD || 'claude';
const CODEX_CMD_RAW = process.env.CODEX_CMD || 'codex';
// Resolve full paths at startup — node-pty's posix_spawnp may not find commands
// if Homebrew/nvm paths (/opt/homebrew/bin) aren't in Node's inherited PATH
function resolveCmd(name) {
  // Try 'which' first
  try {
    const r = execFileSync('/usr/bin/which', [name], { encoding: 'utf-8', timeout: 2000 }).trim();
    if (r && r.startsWith('/')) return r;
  } catch {}
  // Search common paths directly
  const dirs = ['/opt/homebrew/bin', '/usr/local/bin', '/usr/bin', '/bin',
    ...(process.env.PATH || '').split(path.delimiter)];
  for (const dir of dirs) {
    const p = path.join(dir, name);
    try { fs.accessSync(p, fs.constants.X_OK); return p; } catch {}
  }
  return name;
}
const DTACH_CMD = resolveCmd('dtach');
const NODE_CMD = process.execPath;
const ENV_CMD = resolveCmd('env');

// ── X display detection (Linux clipboard / xclip) ──
// The inherited DISPLAY is unreliable: the server is often (re)started from
// shells with a stale value (e.g. :99 with no X server behind it), and under
// XWayland the display also needs the compositor's XAUTHORITY cookie — without
// it even the right display number fails. Probe candidates at startup and use
// the first {DISPLAY, XAUTHORITY} pair that actually answers; this env is used
// for the server's own xclip calls AND injected into spawned sessions (the CLI
// reads the clipboard itself on Ctrl+V).
function detectXDisplay() {
  if (process.platform !== 'linux') return { DISPLAY: process.env.DISPLAY || '', XAUTHORITY: process.env.XAUTHORITY || '' };
  const displays = [];
  if (process.env.DISPLAY) displays.push(process.env.DISPLAY);
  try {
    for (const f of fs.readdirSync('/tmp/.X11-unix')) {
      if (/^X\d+$/.test(f)) { const d = ':' + f.slice(1); if (!displays.includes(d)) displays.push(d); }
    }
  } catch {}
  const xauths = [];
  if (process.env.XAUTHORITY) xauths.push(process.env.XAUTHORITY);
  try {
    const rd = `/run/user/${process.getuid()}`;
    for (const f of fs.readdirSync(rd)) {
      // .mutter-Xwaylandauth.XXXXXX, Xauthority, xauth_XXXXXX (sddm), …
      // NOTE: "Xwaylandauth" does NOT contain the substring "xauth" — match "auth"
      if (/auth/i.test(f)) xauths.push(path.join(rd, f));
    }
  } catch {}
  xauths.push(path.join(os.homedir(), '.Xauthority'));
  const xauthCandidates = ['', ...xauths.filter((p, i, a) => p && a.indexOf(p) === i && fs.existsSync(p))];
  const xsetCmd = resolveCmd('xset');
  for (const d of displays) {
    for (const xa of xauthCandidates) {
      try {
        execFileSync(xsetCmd, ['q'], {
          env: { ...process.env, DISPLAY: d, ...(xa ? { XAUTHORITY: xa } : {}) },
          timeout: 1500, stdio: 'ignore',
        });
        return stabilizeXAuth({ DISPLAY: d, XAUTHORITY: xa, probed: true });
      } catch {}
    }
  }
  return { DISPLAY: process.env.DISPLAY || '', XAUTHORITY: process.env.XAUTHORITY || '', probed: false }; // best effort
}
// Compositor restarts mint a NEW per-instance cookie file
// (.mutter-Xwaylandauth.XXXXXX) while every already-running session keeps the
// OLD path in its env — the clipboard silently dies for all of them (real
// incident 2026-07-09: an Xwayland restart at 18:42 broke image paste in 11
// live sessions at once). Stabilize: merge the working cookie into
// ~/.Xauthority and hand THAT path to sessions — processes re-open the auth
// file on every X request, so after a future rotation one refreshXEnv() merge
// heals everything, old sessions included, without respawns.
function stabilizeXAuth(found) {
  if (!found.probed || !found.XAUTHORITY) return found;
  const home = path.join(os.homedir(), '.Xauthority');
  if (found.XAUTHORITY === home) return found;
  try {
    execFileSync(resolveCmd('xauth'), ['merge', found.XAUTHORITY], {
      env: { ...process.env, XAUTHORITY: home }, timeout: 3000, stdio: 'ignore',
    });
    // switch to the stable path only if it actually answers
    execFileSync(resolveCmd('xset'), ['q'], {
      env: { ...process.env, DISPLAY: found.DISPLAY, XAUTHORITY: home }, timeout: 1500, stdio: 'ignore',
    });
    return { ...found, XAUTHORITY: home };
  } catch { return found; }
}
// ONE mutable object — ws-handler and app.locals hold references to it, so a
// refresh propagates everywhere (new spawns + the paste route) without rewiring.
const X_ENV = detectXDisplay();
function refreshXEnv() { Object.assign(X_ENV, detectXDisplay()); return X_ENV; }
const CLAUDE_CMD = CLAUDE_CMD_RAW.startsWith('/') ? CLAUDE_CMD_RAW : resolveCmd(CLAUDE_CMD_RAW);
const CODEX_CMD = CODEX_CMD_RAW.startsWith('/') ? CODEX_CMD_RAW : resolveCmd(CODEX_CMD_RAW);
const CLAUDE_SUBSCRIPTION_LOGIN_HELPER = path.join(__dirname, 'data', 'bin', 'vibespace-claude-subscription-login.mjs');
const CODEX_LINUX_SANDBOX_CMD = resolveCmd('codex-linux-sandbox');
const CODEX_SANDBOX_SUPPORTED = process.platform !== 'linux'
  || (!!CODEX_LINUX_SANDBOX_CMD && CODEX_LINUX_SANDBOX_CMD !== 'codex-linux-sandbox')
  || (typeof CODEX_LINUX_SANDBOX_CMD === 'string' && fs.existsSync(CODEX_LINUX_SANDBOX_CMD));
const adapterRegistry = createAdapterRegistry({
  claudeCmd: CLAUDE_CMD,
  codexCmd: CODEX_CMD,
  codexSandboxSupported: CODEX_SANDBOX_SUPPORTED,
  chatWrapper: path.join(__dirname, 'data', 'bin', 'chat-wrapper.js'),
  codexChatWrapper: path.join(__dirname, 'data', 'bin', 'codex-chat-wrapper.js'),
  ptyWrapper: path.join(__dirname, 'data', 'bin', 'pty-wrapper.js'),
  buffersDir: path.join(__dirname, 'data', 'session-buffers'),
});

if (!CODEX_SANDBOX_SUPPORTED) {
  console.log('[codex] codex-linux-sandbox not found; default/safe-yolo sessions will run unsandboxed.');
}

// Parse available permission modes, effort levels, and supported flags from claude --help
let PERMISSION_MODES = ['default', 'acceptEdits', 'auto', 'bypassPermissions', 'dontAsk', 'plan'];
// The effortLevel enum (parsed from `claude --help` below, which lists it on a
// wrapped line: "(low, medium, high, xhigh, max)"). This is the fallback if the
// parse ever fails — keep it matching. NOTE: "ultracode" is deliberately NOT
// here — it's not an effortLevel value but a separate session mode (xhigh +
// dynamic-workflow orchestration), appended as a pseudo-level client-side.
let EFFORT_LEVELS = ['low', 'medium', 'high', 'xhigh', 'max'];
let CLAUDE_SUPPORTS_NAME = false;
try {
  const help = execFileSync(CLAUDE_CMD, ['--help'], { encoding: 'utf-8', timeout: 5000 });
  const permMatch = help.match(/--permission-mode.*choices:\s*(.+)\)/);
  if (permMatch) {
    PERMISSION_MODES = permMatch[1].match(/"([^"]+)"/g)?.map(s => s.replace(/"/g, '')) || PERMISSION_MODES;
  }
  // --effort <level>  Effort level ... (low, medium, high, max)
  const effortMatch = help.match(/--effort\s+\S+\s+[^(]*\(([^)]+)\)/);
  if (effortMatch) {
    EFFORT_LEVELS = effortMatch[1].split(',').map(s => s.trim()).filter(Boolean);
  }
  CLAUDE_SUPPORTS_NAME = /--name\b/.test(help);
} catch {}
// Propagate capability flags to the adapter
adapterRegistry.get('claude').config.supportsName = CLAUDE_SUPPORTS_NAME;
// Discover available models per backend (cached, refreshed periodically)
const CLAUDE_MODEL_ALIASES = [
  { id: '', label: 'Default' },
  { id: 'fable', label: 'fable (latest, 200k)' },
  { id: 'fable[1m]', label: 'fable[1m] (latest, 1M context)' },
  { id: 'opus', label: 'opus (latest, 200k)' },
  { id: 'opus[1m]', label: 'opus[1m] (latest, 1M context)' },
  { id: 'sonnet', label: 'sonnet (latest)' },
  { id: 'sonnet[1m]', label: 'sonnet[1m] (latest, 1M context)' },
  { id: 'haiku', label: 'haiku (latest)' },
];
// Known GA full model ids — the BASELINE the dropdown always carries.
// The passive statusline discovery only learns models that have SERVED a
// LOCAL TERMINAL session here (real report: the list held Opus 4.8 —
// once seen — but never Opus 5), and the /v1/models fetch is §ban-safety
// opt-in. A new tier ships → add it here (same convention as the aliases).
// No context-size claims on these labels: a full id can serve the long
// context (a claude-opus-5 session was observed at 222k/1M under an old
// "(200k)" label) — the status bar derives the real window from usage.
const CLAUDE_KNOWN_MODELS = [
  { id: 'claude-fable-5', label: 'Fable 5' },
  { id: 'claude-opus-5', label: 'Opus 5' },
  { id: 'claude-sonnet-5', label: 'Sonnet 5' },
  { id: 'claude-haiku-4-5-20251001', label: 'Haiku 4.5' },
];
// Served-model passive discovery: EVERY session's assistant records name the
// model that actually served — feed the same __models__.json the statusline
// hook writes, so chat/remote sessions teach the dropdown too (both writers
// preserve-merge; ingestPassiveModels picks it up within ~30s).
const _modelsSeenRam = new Set();
function noteModelSeen(id) {
  if (!id || typeof id !== 'string' || id === '<synthetic>' || _modelsSeenRam.has(id)) return;
  _modelsSeenRam.add(id);
  try {
    const fp = path.join(USAGE_CACHE_DIR, '__models__.json');
    let list = [];
    try { list = JSON.parse(fs.readFileSync(fp, 'utf-8')) || []; } catch { }
    if (!list.some((m) => m && m.id === id)) {
      list.push({ id, label: id.replace(/^claude-/, '').replace(/-(\d{8})$/, '').replace(/-/g, ' ').replace(/\b\w/g, (c) => c.toUpperCase()) });
      fs.writeFileSync(fp, JSON.stringify(list));
    }
  } catch { }
}
const AVAILABLE_MODELS = {
  claude: [...CLAUDE_MODEL_ALIASES, ...CLAUDE_KNOWN_MODELS],
  codex: [{ id: '', label: 'Default' }],
};
function refreshAvailableModels() {
  // /v1/models accepts both auth schemes now (OAuth needs Bearer + the oauth
  // beta header — it used to 401, fixed server-side ~2026-06). The old
  // bootstrap endpoint's additional_model_options now returns null, so
  // /v1/models is the single source for full model IDs; CLI aliases
  // (fable/opus/sonnet/haiku) stay hardcoded since they're CLI-side names.
  function fetchModels(token, useOAuth) {
    const headers = { 'anthropic-version': '2023-06-01' };
    if (useOAuth) {
      headers['Authorization'] = 'Bearer ' + token;
      headers['anthropic-beta'] = 'oauth-2025-04-20';
    } else {
      headers['x-api-key'] = token;
    }
    const req = https.request('https://api.anthropic.com/v1/models?limit=100', {
      method: 'GET', headers,
    }, (res) => {
      let body = '';
      res.on('data', (d) => { body += d; });
      res.on('end', () => {
        try {
          const data = JSON.parse(body);
          if (data.data?.length) {
            const models = data.data.map(m => {
              const ctx = m.max_input_tokens >= 1000000 ? '1M' : m.max_input_tokens >= 200000 ? '200k' : Math.round(m.max_input_tokens / 1000) + 'k';
              return { id: m.id, label: `${m.display_name || m.id} (${ctx})` };
            });
            const known = CLAUDE_KNOWN_MODELS.filter((k) => !models.some((m) => m.id === k.id));
            AVAILABLE_MODELS.claude = [...CLAUDE_MODEL_ALIASES, ...known, ...models];
          } else if (res.statusCode !== 200) {
            console.warn(`[models] /v1/models failed: HTTP ${res.statusCode}`);
          }
        } catch {}
      });
    });
    req.on('error', () => {});
    req.end();
  }

  // §ban-safety: a /v1/models fetch with the OAuth (subscription) token is the
  // same off-CLI background-call pattern as the usage poll, so it's gated behind
  // the SAME opt-in. Default OFF → the dropdown falls back to the hardcoded CLI
  // aliases (fable/opus/sonnet/haiku[+1m]); only full model IDs are missed, and
  // "Custom…" still lets you type one. An API KEY (sanctioned) is always used.
  const apiKey = process.env.ANTHROPIC_API_KEY || null;
  if (apiKey) {
    fetchModels(apiKey, false);
  } else if (usagePollingEnabled()) {
    getOAuthToken((oauthToken) => { if (oauthToken) fetchModels(oauthToken, true); });
  }
  refreshCodexModels();
}

// ── Codex model list (from ~/.codex/models_cache.json) ──
// That cache is last-writer-wins AND version-gated server-side: a still-running
// OLD codex CLI re-fetches it and writes it back WITHOUT newer models (observed
// live TWICE: a 0.142.5 session erased the gpt-5.6 entries minutes after
// 0.144.0 fetched them — and once it happened right before a server restart,
// leaving the dropdown stale for the whole hourly re-read cycle). Two guards:
// (1) union every model ever seen, PERSISTED across restarts;
// (2) mtime-guarded re-read ON DEMAND from /api/available-models — the model/
//     effort dropdowns fetch per click, so they're always current, no timers.
const CODEX_MODELS_SEEN_FILE = path.join(__dirname, 'data', 'codex-models-seen.json');
const _codexModelsSeen = new Map();
try { for (const m of JSON.parse(fs.readFileSync(CODEX_MODELS_SEEN_FILE, 'utf-8'))) if (m && m.id) _codexModelsSeen.set(m.id, m); } catch {}
if (_codexModelsSeen.size) AVAILABLE_MODELS.codex = [{ id: '', label: 'Default' }, ..._codexModelsSeen.values()];
let _codexCacheMtime = 0;
function refreshCodexModels() {
  try {
    const fp = path.join(os.homedir(), '.codex', 'models_cache.json');
    const mt = fs.statSync(fp).mtimeMs;
    if (mt === _codexCacheMtime) return;
    _codexCacheMtime = mt;
    const codexCache = JSON.parse(fs.readFileSync(fp, 'utf-8'));
    if (!codexCache.models?.length) return;
    const fresh = codexCache.models.map(m => {
      const ctx = m.context_window ? (m.context_window >= 1000000 ? Math.round(m.context_window / 1000000) + 'M' : Math.round(m.context_window / 1000) + 'k') : '';
      // Per-model reasoning levels ride along: GPT-5.6 made efforts
      // model-specific (sol/terra add max+ultra, luna tops out at max) —
      // clients derive dropdowns from this instead of a stale hardcoded list.
      return { id: m.slug, label: (m.display_name || m.slug) + (ctx ? ` (${ctx})` : ''), efforts: (m.supported_reasoning_levels || []).map(l => l && l.effort).filter(Boolean) };
    }).filter(m => m.id);
    let changed = false;
    for (const m of fresh) {
      const prev = _codexModelsSeen.get(m.id);
      if (!prev || JSON.stringify(prev) !== JSON.stringify(m)) { _codexModelsSeen.set(m.id, m); changed = true; }
    }
    AVAILABLE_MODELS.codex = [{ id: '', label: 'Default' }, ..._codexModelsSeen.values()];
    if (changed) {
      try {
        const tmp = CODEX_MODELS_SEEN_FILE + '.tmp';
        fs.writeFileSync(tmp, JSON.stringify([..._codexModelsSeen.values()]));
        fs.renameSync(tmp, CODEX_MODELS_SEEN_FILE);
      } catch {}
    }
  } catch {}
}
refreshCodexModels();
setTimeout(refreshAvailableModels, 3000);
setInterval(refreshAvailableModels, 3600000); // refresh hourly

const HOST = process.env.HOST || '0.0.0.0';

const app = express();
const server = http.createServer(app);

// ── Optional password auth (VIBESPACE_PASSWORD env / data/auth.json) +
//    optional Clerk SSO (VIBESPACE_CLERK_PUBLISHABLE_KEY — src/clerk-auth.js) ──
const { Auth } = require('./src/auth');
const { ClerkAuth } = require('./src/clerk-auth');
const clerkAuth = new ClerkAuth();
const auth = new Auth(path.join(__dirname, 'data'), { clerk: clerkAuth });
{
  const { generated } = auth.ensurePassword({ generateIfMissing: process.env.VIBESPACE_GENERATE_PASSWORD === '1' });
  if (generated) {
    console.log('\n  ╔════════════════════════════════════════════════╗');
    console.log(`  ║  Generated workspace password: ${generated.padEnd(15)} ║`);
    console.log('  ║  (persisted in data/auth.json — set             ║');
    console.log('  ║   VIBESPACE_PASSWORD to choose your own)        ║');
    console.log('  ╚════════════════════════════════════════════════╝\n');
  }
  if (auth.passwordEnabled) console.log('  Password auth: ENABLED');
  if (clerkAuth.enabled) console.log(`  Clerk SSO: ENABLED (${clerkAuth.frontendApi})`);
  // getter — auth can be enabled/disabled at runtime via /api/auth/set-password
  Object.defineProperty(app.locals, 'authEnabled', { get: () => auth.enabled });
  Object.defineProperty(app.locals, 'ssoEnabled', { get: () => auth.ssoEnabled });
}

// noServer + ONE manual upgrade dispatcher (registered at the bottom of this
// file): ws's own {server, path} listener calls handleUpgrade UNCONDITIONALLY
// and abortHandshake(400)s every non-matching path — it was killing /proxy/
// WebSockets silently and the /api/vnc bridge on arrival. Auth happens in the
// dispatcher (cookie token, same as HTTP).
const wss = new WebSocketServer({ noServer: true });

app.use(compression());
// HTTP latency observation (names-and-numbers only): rolling 5-min window
// flushed by the metrics sampler; slow requests (>1.5s) recorded as events
// with the SANITIZED route (first 3 path segments — /api/file/serve/* etc.
// carry user paths that must never enter the ledger).
const _httpWin = { n: 0, sum: 0, max: 0, slow: [] };
app.use((req, res, next) => {
  const t0 = process.hrtime.bigint();
  res.on('finish', () => {
    const ms = Number(process.hrtime.bigint() - t0) / 1e6;
    _httpWin.n++; _httpWin.sum += ms; if (ms > _httpWin.max) _httpWin.max = ms;
    if (ms > 1500 && _httpWin.slow.length < 20) {
      _httpWin.slow.push({ route: req.path.split('/').slice(0, 4).join('/') || '/', ms: Math.round(ms) });
    }
  });
  next();
});
auth.registerRoutes(app);
app.use(auth.middleware());
// Serve index.html with cache-busting query params on every local js/css asset
// (?v=<mtime>). Browsers serve unversioned <script>/<link> from memory cache on
// a soft reload without revalidating, so users were stuck on a stale bundle
// after an update until a hard refresh. Versioning the URL forces a fresh fetch
// whenever the file changes — no hard refresh ever needed.
app.get(['/', '/index.html'], (req, res, next) => {
  try {
    const pub = path.join(__dirname, 'public');
    let html = fs.readFileSync(path.join(pub, 'index.html'), 'utf-8');
    html = html.replace(/(href|src)="\/([^"?]+\.(?:js|css))"/g, (m, attr, file) => {
      try { return `${attr}="/${file}?v=${Math.floor(fs.statSync(path.join(pub, file)).mtimeMs)}"`; }
      catch { return m; }
    });
    res.set('Cache-Control', 'no-cache');
    res.type('html').send(html);
  } catch { next(); }
});
app.use(express.static(path.join(__dirname, 'public'), { etag: true, lastModified: true, maxAge: 0 }));
// WebDAV bridge — BEFORE the json body parser (PUT bodies stream to disk).
// Auth = scoped Bearer mount tokens; see src/webdav.js for the security model.
const { MountTokens, registerWebdav } = require('./src/webdav');
const mountTokens = new MountTokens({ dataDir: path.join(__dirname, 'data') });
registerWebdav(app, { tokens: mountTokens });
app.use(express.json({ limit: '50mb' }));

app.get('/xterm.css', (req, res) => {
  res.sendFile(path.join(__dirname, 'node_modules/@xterm/xterm/css/xterm.css'));
});

// ── Active session tracking (dtach-backed for persistence across server restarts) ──
// dtach is a minimal PTY detach/attach tool — no rendering layer, no mouse interception.
// Claude processes get raw PTY I/O identical to a native terminal.
const activeSessions = new Map();
// B-3f8a: account ids that have a RUNNING session — the merge/creds-rewrite
// guard consults this so a subscription merge never rewrites/removes a creds
// dir under a live session (the CLI re-reads creds per request, mid-turn).
const liveAccountIdSet = () => {
  const s = new Set();
  for (const sess of activeSessions.values()) if (sess?._accountId) s.add(sess._accountId);
  return s;
};
const sessionCounterRef = { value: 0 };
const SOCKETS_DIR = path.join(__dirname, 'data', 'sockets');
const META_DIR = path.join(__dirname, 'data', 'session-meta');
const BUFFERS_DIR = path.join(__dirname, 'data', 'session-buffers');

// ── HOME-RENAME MIGRATION (B-b4a2, one-shot at boot) ────────────────────────
// The 3.5.0 fleet image personalizes the container user, so $HOME moves (e.g.
// /home/vibe → /home/userL) while the PVC keeps everything recorded under
// the OLD path: ~/.claude/projects dirs encode the old cwd (claude's resume
// lookup goes by CURRENT-cwd encoding → every resume died "No conversation
// found"), and mounts/layouts/session metas hold dead /home/vibe/... paths.
// This repeats for EVERY user on EVERY such roll (userL needed manual
// surgery) — migrate automatically: rename projdirs to the new encoding and
// prefix-rewrite recorded paths. One-shot per (oldUser→newUser) marker.
function migrateHomeRename() {
  try {
    const home = os.homedir();
    const user = path.basename(home);
    const projectsDir = path.join(home, '.claude', 'projects');
    let dirs = [];
    try { dirs = fs.readdirSync(projectsDir); } catch { return; }
    // Detect the old username from leftover projdirs: -home-<old>-… where
    // <old> ≠ current user and /home/<old> no longer exists.
    const oldUsers = new Set();
    for (const d of dirs) {
      const m = /^-home-([a-z][a-z0-9]*)-/.exec(d);
      if (m && m[1] !== user && !fs.existsSync(`/home/${m[1]}`)) oldUsers.add(m[1]);
    }
    for (const old of oldUsers) {
      const marker = path.join(__dirname, 'data', `.home-migrated-${old}-to-${user}`);
      if (fs.existsSync(marker)) continue;
      console.log(`[migrate] home rename detected: /home/${old} → ${home} — migrating projdirs + recorded paths`);
      let moved = 0;
      for (const d of fs.readdirSync(projectsDir)) {
        if (!d.startsWith(`-home-${old}-`)) continue;
        const nd = `-home-${user}-` + d.slice(`-home-${old}-`.length);
        const src = path.join(projectsDir, d), dst = path.join(projectsDir, nd);
        try {
          if (!fs.existsSync(dst)) { fs.renameSync(src, dst); moved++; }
          else { // merge, never overwrite (both sides may hold transcripts)
            for (const f of fs.readdirSync(src)) {
              if (!fs.existsSync(path.join(dst, f))) fs.renameSync(path.join(src, f), path.join(dst, f));
            }
            try { fs.rmdirSync(src); } catch { }
            moved++;
          }
        } catch (e) { console.warn(`[migrate] projdir ${d}: ${e.message}`); }
      }
      // Prefix-rewrite every recorded string path in the small JSON stores.
      const rewrite = (v) => (typeof v === 'string' && v.includes(`/home/${old}/`))
        ? v.split(`/home/${old}/`).join(`/home/${user}/`)
        : (typeof v === 'string' && v === `/home/${old}`) ? `/home/${user}` : v;
      const walk = (x) => {
        if (Array.isArray(x)) return x.map(walk);
        if (x && typeof x === 'object') { for (const k of Object.keys(x)) x[k] = walk(x[k]); return x; }
        return rewrite(x);
      };
      const stores = [path.join(__dirname, 'data', 'mounts.json'), path.join(__dirname, 'data', 'layouts.json'),
        path.join(__dirname, 'data', 'task-groups.json'), path.join(__dirname, 'data', 'machine-mounts.json')];
      try { for (const f of fs.readdirSync(META_DIR)) stores.push(path.join(META_DIR, f)); } catch { }
      let rewrote = 0;
      for (const f of stores) {
        try {
          if (!fs.existsSync(f)) continue;
          const raw = fs.readFileSync(f, 'utf-8');
          if (!raw.includes(`/home/${old}`)) continue;
          const fixed = JSON.stringify(walk(JSON.parse(raw)));
          fs.writeFileSync(f + '.pre-home-migrate', raw); // one-shot backup beside it
          const tmp = f + '.tmp'; fs.writeFileSync(tmp, fixed); fs.renameSync(tmp, f);
          rewrote++;
        } catch (e) { console.warn(`[migrate] ${path.basename(f)}: ${e.message}`); }
      }
      fs.writeFileSync(marker, JSON.stringify({ at: Date.now(), moved, rewrote }));
      console.log(`[migrate] home rename done: ${moved} projdirs, ${rewrote} stores rewritten (backups *.pre-home-migrate)`);
    }
  } catch (e) { console.warn('[migrate] home-rename check failed:', e.message); }
}
migrateHomeRename();
const USAGE_CACHE_FILE = path.join(__dirname, 'data', 'usage-cache.json');
// Per-account PASSIVE usage capture (written by data/bin/vibespace-usage, the
// statusLine hook). Key '__global__' = the machine's own login; 'sub-…' = a
// named subscription. This is the ONLY usage source now — VibeSpace makes NO
// background /api/oauth/usage calls with subscription tokens (that off-CLI
// automated pattern is what gets Max/Pro accounts banned; see §ban-safety).
const USAGE_CACHE_DIR = path.join(__dirname, 'data', 'usage-cache');
const USAGE_SCANNER_PATH = path.join(__dirname, 'data', 'bin', 'vibespace-usage-scan');
const PTY_WRAPPER = path.join(__dirname, 'data', 'bin', 'pty-wrapper.js');

// ── CS refactor M1 (opt-in, default OFF): route LOCAL terminal sessions
// through the standing vibespace-agentd daemon. deviceMgr stays null unless
// the local device daemon is ALWAYS on since the 2.175.0 graduation —
// instantiates it, never spawns a daemon, and attachToDtach is byte-identical
// to today. daemonPtyShim presents the node-pty interface over a device
// session handle so setupSessionPty is unchanged.
let deviceMgr = null;
// ── M2 host-level agentd provisioning (flag agentd.remoteSessions) ──
// Per-host vsht_ token: plaintext in a 0600 local file (the attach bridge
// reads it at spawn; never argv), sha256 recorded alongside for audit.
const AGENTD_DIR = path.join(__dirname, 'data', 'agentd');
function agentdHostToken(hostId) {
  ensureDir(AGENTD_DIR);
  const f = path.join(AGENTD_DIR, 'host-' + hostId + '.token');
  try { return fs.readFileSync(f, 'utf-8').trim(); } catch { }
  const tok = 'vsht_' + require('crypto').randomBytes(24).toString('hex');
  fs.writeFileSync(f, tok, { mode: 0o600 });
  return tok;
}
// Install/refresh the daemon on a host, throttled per boot+version: a marker
// records the last version shipped; matching = skip (one ssh round trip saved
// per spawn; a bundle change reinstalls because the version bumps with it).
const _agentdInstalled = new Map(); // hostId → version
// ── Transport B (dial-out) server side: devices behind NAT dial US. Pairing
// mints {deviceId, dialToken}; the daemon presents the dial token at the ws
// upgrade (gates the endpoint), then the normal hello/vsht_ auth runs INSIDE
// the mux like every transport. Incoming dials land in a registry the
// device's transport waits on. ──
const agentdDials = new Map();      // deviceId → ws stream adapter (live dial)
// B-f3e8: the pairing credential lives ON the dial host record (hosts.json
// dialTokenHash) — dial-tokens.json is migrated once at boot (below, after
// HostManager construction) and there is no separate device registry anymore.
function agentdMintDialPair(deviceId) {
  ensureDir(AGENTD_DIR);
  const tok = 'vsdt_' + require('crypto').randomBytes(18).toString('hex');
  hosts.setDialToken(deviceId, require('crypto').createHash('sha256').update(tok).digest('hex'));
  // the device token (vsht_) for in-mux auth ships in the install payload
  return { deviceId, dialToken: tok, hostToken: agentdHostToken('dial-' + deviceId) };
}
/** Full unpair of a dial machine (DELETE /api/hosts/:id on a dial record):
 *  mounts torn down, vsht_ token file gone, live stream destroyed. The token
 *  hash dies with the host record itself. */
async function unpairDialDevice(deviceId) {
  try { await machineMounts.onMachineUnpaired(hosts.findByDeviceId(deviceId)?.id); } catch { }
  try { portForwards.onMachineUnpaired(hosts.findByDeviceId(deviceId)?.id); } catch { }
  try { exitProxy.onMachineUnpaired(hosts.findByDeviceId(deviceId)?.id); } catch { }
  try { fs.unlinkSync(path.join(AGENTD_DIR, `host-dial-${deviceId}.token`)); } catch { }
  const live = agentdDials.get(deviceId);
  if (live) { try { live.destroy(); } catch { } agentdDials.delete(deviceId); }
  agentdDialDevices.delete(deviceId);
}
// A DeviceManager over a DIALED-IN device (Transport B consumption): the
// device's daemon holds the mux-server end; we drive it (fs/serve-folder/
// tcp-forward) as the client over the live ws stream in agentdDials. Reused
// per device; reconnects follow the device's --dial retries (getStream picks
// up the fresh stream). Enables 'device' mounts + remote fs for NAT'd devices.
const agentdDialDevices = new Map(); // deviceId → DeviceManager
async function deviceForDial(deviceId, _retried = false) {
  // FAIL FAST when the device isn't dialed in: the stream transport's connect
  // loop otherwise backs off and retries FOREVER, so every operation against
  // an offline device (session create, mount, test) HUNG instead of erroring
  // (real report: create卡住/terminal空白/mount打不开 — Mac daemon died after
  // a self-upgrade re-exec and nothing surfaced it).
  const curStream = agentdDials.get(deviceId);
  if (!curStream) throw new Error(`device "${deviceId}" is offline — its daemon is not dialed in (rerun the install command on it)`);
  let dm = agentdDialDevices.get(deviceId);
  // STALE-STREAM GUARD (real report: online=true but every fs op/session
  // blank): the device re-dialed after a self-upgrade re-exec, so agentdDials
  // holds a FRESH stream — but the cached DeviceManager's mux is still bound
  // to the DEAD old stream, and its status().connected can lag true. Rebuild
  // whenever the live stream differs from the one this dm connected over.
  // A STOPPED dm must be treated exactly like a stale stream: stop() is
  // terminal (_connectLoop throws 'stopped' forever), so reusing one wedges
  // EVERY op against an otherwise-healthy device until the stream changes
  // (real userW outage: hours of "offline"/'stopped' while the Mac was
  // dialed-in and fine — a re-dial/unpair race stopped the cached dm).
  if (dm && (dm._stopped || (dm._dialStream && dm._dialStream !== curStream))) {
    try { dm.stop?.(); } catch { }
    dm = null;
    agentdDialDevices.delete(deviceId);
  }
  if (dm && dm.status().connected) return dm;
  if (!dm) {
    const { DeviceManager } = require('./src/agentd/client.js');
    dm = new DeviceManager({
      dataDir: path.join(__dirname, 'data'),
      bundlePath: path.join(__dirname, 'data', 'bin', 'vibespace-agentd.js'),
      version: require('./package.json').version,
      transport: { kind: 'stream', hostToken: agentdHostToken('dial-' + deviceId), getStream: () => agentdDials.get(deviceId) || null },
      log: (...a) => console.log('[device-dial]', ...a),
    });
    agentdDialDevices.set(deviceId, dm);
  }
  dm._dialStream = curStream; // remember which stream we bind the mux to
  try {
    await dm.connect();
  } catch (e) {
    // never leave a failed dm in the cache — the next op must rebuild clean
    try { dm.stop?.(); } catch { }
    if (agentdDialDevices.get(deviceId) === dm) agentdDialDevices.delete(deviceId);
    // a dm stopped MID-CONNECT by a concurrent re-dial cleanup surfaces one
    // transient 'stopped' — while the stream is live, rebuild once instead of
    // failing the caller's FIRST op after a re-dial (seen live on the userW
    // verification: test probe errored once, next op self-healed)
    if (!_retried && String(e && e.message) === 'stopped' && agentdDials.get(deviceId)) {
      return deviceForDial(deviceId, true);
    }
    throw e;
  }
  return dm;
}
async function ensureAgentdOnHost(hostId) {
  const version = require('./package.json').version;
  if (_agentdInstalled.get(hostId) === version) return;
  const bundlePath = path.join(__dirname, 'data', 'bin', 'vibespace-agentd.js');
  await hosts.installAgentd(hostId, bundlePath, version, agentdHostToken(hostId));
  _agentdInstalled.set(hostId, version);
}
function daemonPtyShim(handle) {
  let dataCb = null, exitCb = null;
  handle.onData = (buf) => { if (dataCb) dataCb(buf.toString('utf-8')); };
  handle.onExit = (code) => { if (exitCb) exitCb({ exitCode: code }); };
  return {
    _daemon: true,
    get pid() { return handle.pid; },
    onData(cb) { dataCb = cb; return { dispose() { dataCb = null; } }; },
    onExit(cb) { exitCb = cb; return { dispose() { exitCb = null; } }; },
    write(s) { try { handle.write(s); } catch {} },
    resize(cols, rows) { try { handle.resize(cols, rows); } catch {} },
    kill() { try { handle.kill(); } catch {} },
  };
}
const CHAT_WRAPPER = path.join(__dirname, 'data', 'bin', 'chat-wrapper.js');
const CODEX_CHAT_WRAPPER = path.join(__dirname, 'data', 'bin', 'codex-chat-wrapper.js');

function ensureDir(dir) { if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); }

// ── Cached webuiPids (PIDs managed by webui dtach sessions) ──
// Built from pty-wrapper metadata files (childPid), no pgrep/process-tree traversal needed.
const webuiPids = new Set();

function refreshWebuiPids() {
  webuiPids.clear();
  for (const [id, s] of activeSessions) {
    // Read childPid from pty-wrapper's metadata file
    try {
      const metaPath = path.join(BUFFERS_DIR, id + '.json');
      const meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
      if (meta.childPid) {
        webuiPids.add(meta.childPid);
        s._childPid = meta.childPid;
        // Also add direct children of childPid (claude forks from node-pty spawn)
        try {
          const ch = execFileSync('pgrep', ['-P', String(meta.childPid)], { encoding: 'utf-8', timeout: 2000 }).trim();
          for (const line of ch.split('\n')) { const p = parseInt(line.trim()); if (p) webuiPids.add(p); }
        } catch {}
      }
      if (meta.pid) { webuiPids.add(meta.pid); }
    } catch {}
  }
}

// ── Broadcast helper (avoids duplicating per-session WebSocket iteration) ──
const WS_OPEN = 1;
// Top-level stream-json record types this server KNOWS (2.227.8 breadcrumb).
// Add a type here when you add its handling — until then it announces itself.
const CLAUDE_STREAM_TYPES = new Set([
  'assistant', 'user', 'system', 'result', 'attachment', 'control_request',
  'control_response', 'tool_progress', 'stream_event', 'summary',
  'rate_limit_event', // handled since 2.289.0 — the set lagged the handler, so the breadcrumb cried 'unhandled' for a handled type (misled the inc-msozeyw2 read)
  '_stdin_ack', '_remote_state', '_remote_exit',
]);
const _seenStreamTypes = new Set();

function broadcastToSession(session, id, msg) {
  const json = JSON.stringify(msg);
  for (const client of session.clients.keys()) {
    if (client.readyState === WS_OPEN) { try { client.send(json); } catch {} }
  }
}

// ── Stop-on-model-fallback belt (2.228.0, claude.disableModelFallback) ──
// The PRIMARY mechanism is the CLI's native switchModelsOnFlag=false
// (spawn --settings + mid-session apply_flag_settings) — with it armed no
// fallback ever happens and this never fires. The belt covers sessions whose
// CLI predates the toggle (spawned before it was enabled, or restored from
// before a server restart): the moment a fallback signal appears on the
// stream, interrupt the turn (same recipe as the ws 'interrupt' case) and
// tell the user why. Once per turn (_fallbackStopFired, cleared on result).
// ── Pooled pseudo-account auto-switch (B-6217 v2) ───────────────────────────
// Runs at each claude turn end for sessions billed to a pool with auto=on.
// Decisions read ONLY the passive usage cache (§ban-safety — never an API
// call); see src/account-pool-auto.js for the semantics. hot=on → just
// re-point (the running CLI re-reads the credential file on its next request);
// hot=off → also ask ONE connected client to cold-restart the affected
// conversations (headless instances degrade to hot behavior until a client
// appears — the switch itself never waits on a browser).
const { decidePoolSwitch, rankPoolMembers, SWITCH_THRESHOLD_PCT: POOL_HARD_PCT } = require('./src/account-pool-auto.js');
const _poolAutoLast = new Map(); // poolId → ts of last DECISION (eval gate)
const _poolSwitchAt = new Map(); // poolId → ts of last actual SWITCH (dwell belt)
// ── get_usage control channel + chat-mode limit banner (B-7edc/B-292b) ──────
// The get_usage control request makes the CLI (first-party client) fetch usage
// itself — strictly better ToS posture than our bare /api/oauth/usage call.
// HUMAN-TRIGGERED ONLY (the ⟳ button): auto-firing was REJECTED (2026-08-09,
// user decision) — a machine-initiated quota check is the automated-access
// pattern that got a real account banned. The passive chat-mode signal is the
// LIMIT BANNER instead (markLimitBanner below): zero calls.
const { ClaudeCodeAdapter } = require('./src/adapters/claude-code.js');
// ── usage ANCHOR recorder (dead-reckoning data foundation, 2.261.0) ─────────
// Sweeps local usage-cache snapshots for NEW ground-truth readings (any
// source: statusline / ⟳ / get_usage / limit banner) and appends them, with
// the ledger cost consumed since the previous anchor, to
// data/usage-anchors/anchors-<identity>.ndjson. Identity key = orgUuid >
// email > account id, so a sub's history SURVIVES remove + re-add (user
// requirement — a re-add mints a fresh sub-<hex> id). Zero API calls.
const { UsageAnchors, identityKeyFor, costBetweenMulti } = require('./src/usage-anchors.js');
const { UsageEstimator, overlayCache: estOverlayCache, predictCalib } = require('./src/usage-estimator.js');
const usageAnchors = new UsageAnchors({ dataDir: path.join(__dirname, 'data') });
// Which caches map to which identity (org-merge aware) — shared by the sweep
// and the estimator's per-account resolution. Reads roster + cache files only.
function usageIdentityGroups() {
  const groups = new Map(); // identityKey → {accountIds:[], cache, accountId}
  let files = [];
  try { files = fs.readdirSync(USAGE_CACHE_DIR).filter((f) => f.endsWith('.json') && !f.startsWith('__models__') && !f.startsWith('host-') && f !== 'rates.json'); } catch { return groups; }
  const roster = accounts.list().accounts || [];
  for (const fn of files) {
    try {
      const accountId = fn === '__global__.json' ? null : fn.slice(0, -5);
      const cache = JSON.parse(fs.readFileSync(path.join(USAGE_CACHE_DIR, fn), 'utf-8'));
      if (!cache?.fetchedAt) continue;
      const acctRec = accountId ? roster.find((x) => x.id === accountId) : null;
      if (accountId && acctRec && (acctRec.type === 'pooled' || acctRec.backend === 'codex')) continue; // pools have no quota; codex economics are separate
      const key = identityKeyFor({ accountId, cache, email: acctRec?.email });
      const g = groups.get(key) || { accountIds: [], cache: null, accountId: null };
      g.accountIds.push(accountId || '__global__');
      // freshest cache is the identity's anchor source (the same real login can
      // surface as BOTH __global__ and a named sub — one quota, two files)
      if (!g.cache || cache.fetchedAt > g.cache.fetchedAt) { g.cache = cache; g.accountId = accountId; }
      groups.set(key, g);
    } catch { }
  }
  return groups;
}
// Dead-reckoning estimator (B-fcff v2): learned per-identity per-bucket rates
// over the anchor pairs, seeded with the measured Max-20x priors. Feeds the
// pool auto-switch an ESTIMATED bucket view and /api/usage an `estimates`
// field. Zero API calls; ledger + anchor files only.
const _identGroupsMemo = { at: 0, groups: null };
function usageIdentityGroupsCached() {
  if (!_identGroupsMemo.groups || Date.now() - _identGroupsMemo.at > 30000) {
    _identGroupsMemo.groups = usageIdentityGroups(); _identGroupsMemo.at = Date.now();
  }
  return _identGroupsMemo.groups;
}
const usageEstimator = new UsageEstimator({
  anchorsDir: path.join(__dirname, 'data', 'usage-anchors'),
  usageHistory: () => usageHistory, // declared far below — lazy ref (TDZ)
  resolveIdentity: (accountId) => {
    const want = accountId || '__global__';
    for (const [identityKey, g] of usageIdentityGroupsCached()) {
      if (g.accountIds.includes(want)) return { identityKey };
    }
    return null;
  },
});
app.locals.usageEstimator = usageEstimator;
// ── OFFLINE-BIAS defense (2.297.0, design §Cross-device aggregation) ──
// A source is ACTIVE-DARK when the ledger holds RECENT events from it but its
// link is down: its spend keeps accruing invisibly, which biases estimates in
// the DANGEROUS direction (under → late pool switches). 30s memo — this runs
// inside pool decisions and the anchor sweep.
let _darkMemo = { at: 0, list: [] };
function darkSources() {
  if (Date.now() - _darkMemo.at < 30000) return _darkMemo.list;
  const list = [];
  try {
    const wm = usageHistory.sourceWatermarks();
    const now = Date.now();
    for (const [src, ts] of Object.entries(wm)) {
      if (src === 'local') continue;
      if (now - ts > 48 * 3600 * 1000) continue; // idle for 2 days — not dangerous
      if (hosts.linkState(src) === 'offline') list.push({ host: src, lastEventTs: ts });
    }
  } catch { }
  _darkMemo = { at: Date.now(), list };
  return list;
}
// Which accounts a dark source taints: those with ledger events from that
// host in the last 7 days (per-account precision so an all-local pool never
// pays the pessimism tax for an unrelated machine's outage).
function darkTaintedAccounts() {
  const dark = darkSources();
  if (!dark.length) return {};
  const taint = {};
  try {
    const since = Date.now() - 7 * 24 * 3600 * 1000;
    const darkSet = new Set(dark.map((d) => d.host));
    for (const ev of usageHistory._events(since, Date.now())) {
      if (ev.host && darkSet.has(ev.host) && ev.acct && ev.atype !== 'host') taint[ev.acct] = DARK_PESSIMISM_PCT;
    }
  } catch { }
  return taint;
}
const DARK_PESSIMISM_PCT = 8; // dock: ~1 long turn of 5h headroom / real weekly $

// Disarm a pool's device-side reflex (pool deleted / auto turned off) —
// without this the daemon kept executing a stale snapshot forever, and could
// even recreate a deleted pool's symlink during a server-down window.
async function clearSealedOrders(poolId) {
  try {
    _sealedOrdersSent.delete(poolId);
    const dm = await hosts.device(null);
    await dm.poolOrders({ clearPool: poolId });
  } catch { }
}
const _sealedOrdersSent = new Map(); // poolId → last pushed JSON (skip no-ops)
let _poolOrdersWarned = false; // warn once per boot, never per tick
async function pushSealedOrders(poolId) {
  const a = accounts.get(poolId);
  if (!a || a.type !== 'pooled') return;
  const members = accounts.poolMembers(poolId);
  const ranked = rankPoolMembers({
    members,
    readCache: (id) => { try { return JSON.parse(fs.readFileSync(path.join(USAGE_CACHE_DIR, id + '.json'), 'utf-8')); } catch { return null; } },
    nowSec: Date.now() / 1000,
  }).map((m) => ({ id: m.id, dir: accounts.subDir(m.id), creds: accounts.subCredsPath(m.id) }));
  const orders = { poolId, linkPath: accounts.subDir(poolId), ranked, currentId: accounts.poolCurrent(poolId) || null,
    // Plan C: per-session links are additional MATCH+ACT targets — the daemon
    // re-points exactly the link the banner session spawned against. Old
    // daemons ignore this field and keep matching only the default link:
    // reduced coverage on skew, never a wrong re-point.
    linkPaths: (() => { try { return accounts.sessionPoolLinks(poolId).map((l) => l.path); } catch { return []; } })() };
  const j = JSON.stringify(orders);
  if (_sealedOrdersSent.get(poolId) === j) return;
  const dm = await hosts.device(null); // device #0 — pools are local-only
  // (the memo below is per-pool AND the daemon now stores per-pool slots, so a
  // second pool's push can no longer evict the first — review finding)
  await dm.poolOrders(orders, (events) => {
    // fallback switches executed while this server was down: surface + let
    // the by-time ledger attribution reconcile billing (it already keys on
    // the symlink target's real account at scan time)
    for (const ev of events) {
      serverNotice('sealed-orders-' + ev.ts, `账号池 ${accounts.get(ev.poolId)?.name || ev.poolId} 在服务器离线期间因触限自动切换到 ${accounts.get(ev.to)?.name || ev.to}（sealed-orders 应急反射）`, { level: 'warn' });
      try { console.log('[sealed-orders] device-executed fallback switch:', JSON.stringify(ev)); } catch { }
    }
    try { dm.ackPoolOrdersLog(); } catch { }
  });
  _sealedOrdersSent.set(poolId, j);
}

function sweepUsageAnchors() {
  // GROUPED BY IDENTITY (2.263.0): recording per cache-file double-anchored
  // org-merged logins (__global__ + named sub interleaved in one identity
  // file, each record's costSince missing the sibling account's spend — real
  // data bug caught in the ProblemFactory analysis). One identity = one
  // anchor stream; cost sums across ALL its account ids.
  for (const [identityKey, g] of usageIdentityGroups()) {
    try {
      const prev = usageAnchors.lastAnchor(identityKey);
      const allIds = usageEstimator.accountIdsFor(identityKey, g.accountIds);
      const costSince = prev ? costBetweenMulti(usageHistory, allIds, prev.fetchedAt, g.cache.fetchedAt) : null;
      // calibration: what the CURRENT rates would have predicted for this new
      // reading — recorded into the anchor for offline analysis + Diagnostics
      let calib = null;
      if (prev && costSince) {
        try {
          const newBuckets = {
            fiveHour: g.cache.fiveHour ? { u: g.cache.fiveHour.utilization, resetsAt: g.cache.fiveHour.resetsAt } : null,
            sevenDay: g.cache.sevenDay ? { u: g.cache.sevenDay.utilization, resetsAt: g.cache.sevenDay.resetsAt } : null,
            scopedWeekly: (g.cache.scopedWeekly || []).map((s) => ({ name: s.name, u: s.utilization, resetsAt: s.resetsAt })),
          };
          calib = predictCalib(prev, newBuckets, usageEstimator.ratesFor(identityKey), costSince, (g.cache.fetchedAt - prev.fetchedAt) / 1000);
          if (calib) for (const c of Object.values(calib)) global.__vsMetric?.('usage-est-err-pct', Math.abs(c.err) * 100);
        } catch { }
      }
      // pairs recorded while ANY tainted source was dark must not teach rates
      // (Δu real, cost missing ⇒ a falsely HOT rate) — mark the record so
      // extractPairs voids pairs touching it (both sides of the gap).
      const darkHosts = (() => { try { const t = darkTaintedAccounts(); return allIds.some((a) => t[a]) ? darkSources().map((d) => d.host) : []; } catch { return []; } })();
      if (usageAnchors.maybeRecord({ identityKey, accountId: g.accountId, cache: g.cache, costSince, calib, accountIds: allIds, dark: darkHosts })) {
        usageEstimator.invalidate(identityKey); // rates re-derive from the grown pair set
      }
    } catch { }
  }
}
// boot-time sealed-orders push: a restarted server re-arms every pool's
// device-side fallback snapshot AND collects executions from its own down
// window (the report rides the pool-orders reply)
setTimeout(() => {
  // Only AUTO pools (review finding): the runtime refresh is gated on a.auto,
  // so arming a manual pool at boot let the device switch a pool the user
  // explicitly set to manual — with a snapshot frozen at boot forever.
  try {
    for (const a of (accounts.list().accounts || [])) {
      const full = accounts.get(a.id);
      if (full?.type === 'pooled' && full.auto) pushSealedOrders(a.id).catch(() => { });
    }
  } catch { }
}, 15000);
setInterval(() => { try { sweepUsageAnchors(); } catch {} }, 60000);
setTimeout(() => { try { sweepUsageAnchors(); } catch {} }, 20000);

// ── Plan C (B-a612, 2.315.0): per-session pool placement ────────────────────
// One pool, many links: each session bills the member its OWN symlink points
// at. The chooser and the per-session switch pass both read quota through the
// SAME estimator-overlaid readCache the pool engine uses, PROJECTED to the
// session's model family (src/model-family.js): scoped caps of models this
// session is not running stop vetoing its placement; 5h/7d always count
// (nested buckets); an unknown family means NO projection — today's
// conservative semantics, never a relaxation on ignorance.
const { familyOfModel, projectCacheForFamily } = require('./src/model-family.js');
function poolReadCache(poolId) {
  // the engine's readCache, extracted for reuse (identity-group freshest file
  // + estimator overlay); kept here so chooser/switch/engine cannot drift
  const now = Date.now();
  return (id) => {
    let raw = null;
    try { raw = JSON.parse(fs.readFileSync(path.join(USAGE_CACHE_DIR, id + '.json'), 'utf-8')); } catch { }
    try {
      for (const [, g] of usageIdentityGroupsCached()) {
        if (g.accountIds.includes(id) && g.cache && (g.cache.fetchedAt || 0) > (raw?.fetchedAt || 0)) { raw = g.cache; break; }
      }
    } catch { }
    try { return estOverlayCache(raw, usageEstimator.estimateFor(id, raw, now)); } catch { return raw; }
  };
}
function poolChooserForModel(poolId, { model } = {}) {
  try {
    const a = accounts.get(poolId);
    if (!a || a.type !== 'pooled') return null;
    const fam = familyOfModel(model);
    const cur = accounts.poolCurrent(poolId);
    if (!fam) return cur; // no identity → the pool's default target
    const base = poolReadCache(poolId);
    const readCache = (id) => projectCacheForFamily(base(id), fam);
    // decidePoolSwitch FROM the default target under the projected view: if
    // the default serves this family, stay (fewest distinct billing dirs);
    // if it doesn't, the switch verdict IS the placement.
    const { decidePoolSwitch } = require('./src/account-pool-auto.js');
    const d = decidePoolSwitch({ currentId: cur, members: accounts.poolMembers(poolId), readCache, nowSec: Date.now() / 1000, hot: true });
    return (d && d.to) || cur;
  } catch (e) { console.warn('[pool] chooser failed (falling back to default target):', e.message); return null; }
}
// The session's model identity, per the user's spec: the LAST assistant
// message's served model vs the last set-model pick — newest wins — else the
// spawn model. Any unknown → null (no projection).
function sessionModelFor(s) {
  const served = s._servedModel ? { m: s._servedModel, at: s._servedModelAt || 0 } : null;
  const picked = s._pickedModel ? { m: s._pickedModel, at: s._pickedModelAt || 0 } : null;
  const newest = served && picked ? (picked.at >= served.at ? picked : served) : (picked || served);
  return (newest && newest.m) || s._spawnModel || null;
}

const _vsuPending = new Map(); // request_id → {resolve, timer}
function resolveUsageKey(session) {
  let acct = session._accountId || null;
  try { if (acct && accounts.get(acct)?.type === 'pooled') acct = accounts.poolCurrentFor(acct, session._webuiId || null) || acct; } catch {}
  return acct || '__global__';
}
function writeUsageCacheForKey(key, parsed) {
  try {
    const f = path.join(USAGE_CACHE_DIR, key.replace(/[^\w.-]/g, '_') + '.json');
    let prev = {}; try { prev = JSON.parse(fs.readFileSync(f, 'utf-8')) || {}; } catch {}
    const merged = { ...prev, ...parsed };
    // preserve-merge like the statusline hook: never clobber known scoped/org
    // data with an empty answer
    if ((!parsed.scopedWeekly || !parsed.scopedWeekly.length) && Array.isArray(prev.scopedWeekly) && prev.scopedWeekly.length) {
      merged.scopedWeekly = prev.scopedWeekly; merged.scopedFetchedAt = prev.scopedFetchedAt;
    }
    for (const k of ['orgUuid', 'orgName', 'orgEmail', 'email', 'name']) if (prev[k] !== undefined && merged[k] === undefined) merged[k] = prev[k];
    fs.mkdirSync(USAGE_CACHE_DIR, { recursive: true });
    fs.writeFileSync(f + '.tmp', JSON.stringify(merged)); fs.renameSync(f + '.tmp', f);
    return true;
  } catch { return false; }
}
// Ask a LIVE LOCAL claude chat session's CLI for usage over its control
// channel. Returns parsed cache shape or null. Caller is the human-gated ⟳.
function probeUsageViaSession(session, timeoutMs = 8000) {
  return new Promise((resolve) => {
    try {
      if (!session?.pty || session.backend !== 'claude' || session.mode !== 'chat' || session.host) return resolve(null);
      const req = ClaudeCodeAdapter.buildGetUsage();
      const timer = setTimeout(() => { _vsuPending.delete(req.request_id); resolve(null); }, timeoutMs);
      _vsuPending.set(req.request_id, { resolve, timer });
      session.pty.write(JSON.stringify(req) + '\n');
    } catch { resolve(null); }
  });
}
// Every account key in `key`'s IDENTITY group (org-merged logins span
// '__global__' + named subs — one real account, several keys). Falls back to
// just [key] when the identity is unknown.
function usageIdentityAccountIds(key) {
  try {
    for (const [, g] of usageIdentityGroupsCached()) {
      if (g.accountIds.includes(key)) return g.accountIds;
    }
  } catch { }
  return [key];
}
// ⟳-route hook: find any live local claude chat session billed to `key` — or
// to ANY key in its identity group (2.266.1, real report: ⟳ on the pool's
// ACTIVE target said "no valid token" while the asking session itself was
// billing that very account — the popup had remapped the linked account to
// '__global__', which no session matches when pool sessions bill the DIR key;
// the shared quota makes any same-identity session's answer authoritative).
function probeUsageForAccountKey(key) {
  const ids = new Set(usageIdentityAccountIds(key));
  for (const [, s] of activeSessions) {
    if (s.backend !== 'claude' || s.mode !== 'chat' || s.host || !s.pty) continue;
    if (!ids.has(resolveUsageKey(s))) continue;
    return probeUsageViaSession(s).then((parsed) => {
      if (parsed) writeUsageCacheForKey(key, parsed);
      return parsed;
    });
  }
  return Promise.resolve(null);
}
app.locals.usageIdentityAccountIds = usageIdentityAccountIds;
// Chat-mode PASSIVE exhaustion signal (zero API calls): the CLI's own
// "You've reached your … limit" banner marks the bucket dead in the cache and
// immediately re-evaluates the pool — this is what makes auto-switch work for
// chat-only accounts (the statusline never runs there).
// Which usage-cache identity does a session's quota belong to? Account-billed
// sessions (local, host-held, linked, pool→target) → the account key (quota
// is a per-account GLOBAL fact — readings merge across machines by identity,
// three-tier design). A REMOTE session on the host's own CLI login has no
// account id → the host bucket (usage-cache/host-<id>.json, the popup's
// machine rows) — resolveUsageKey alone mapped those to '__global__' and
// misattributed the HOST's quota to the LOCAL machine login.
function usageCacheKeyFor(session) {
  if (session?.host && !session._accountId) return 'host-' + session.host;
  return resolveUsageKey(session);
}
// Passive quota capture from the CLI's own rate_limit_event records (B-e5c9,
// 2.289.0) — ONE shared implementation (src/rate-limit-capture.js) for local
// AND remote chat sessions; the caller resolves key/identity as parameters.
function recordRateLimitEvent(session, msg) {
  try {
    const ev = parseRateLimitEvent(msg);
    if (!ev) return;
    const key = usageCacheKeyFor(session);
    const r = captureRateLimitEvent({ cacheDir: USAGE_CACHE_DIR, key, identityIds: usageIdentityAccountIds(key), ev });
    if (r.unknownType) { global.__vsEvent?.('rate-limit-event-unknown-type', r.unknownType); return; }
    global.__vsEvent?.('rate-limit-event', `${key}:${ev.kind}:${ev.status}${r.wroteReading ? ':reading' : ''}`);
    // a reading busts the estimator memo via fetchedAt and becomes an anchor
    // at the next sweep; exhaustion acts NOW (banner parity)
    if (r.dead) maybePoolAutoSwitch(session);
    else if (r.wroteReading) kickPoolEval();
  } catch (e) { console.warn('[usage] rate_limit_event capture failed:', e.message); }
}
function markLimitBanner(session, text) {
  try {
    const hit = ClaudeCodeAdapter.parseLimitBanner(text);
    if (!hit) return;
    const key = usageCacheKeyFor(session); // host-aware (2.289.0) — a remote host-login banner belongs to the host bucket, not __global__
    const nowSec = Math.floor(Date.now() / 1000);
    const bump = (b, fallbackResetSec) => ({
      ...(b || {}),
      utilization: 1, status: 'limited',
      // keep a known FUTURE reset; else a bounded guess so the marker self-
      // expires (reset-passed ⇒ full) instead of pinning the account dead
      resetsAt: (Number(b?.resetsAt) || 0) > nowSec ? b.resetsAt : nowSec + fallbackResetSec,
    });
    const applyHit = (cache) => {
      if (hit.kind === 'fiveHour') cache.fiveHour = bump(cache.fiveHour, 5 * 3600);
      else if (hit.kind === 'sevenDay') cache.sevenDay = bump(cache.sevenDay, 24 * 3600);
      else if (hit.kind === 'scoped') {
        const list = Array.isArray(cache.scopedWeekly) ? cache.scopedWeekly : [];
        const i = list.findIndex((x) => String(x?.name || '').toLowerCase() === hit.name.toLowerCase());
        if (i >= 0) list[i] = bump(list[i], 24 * 3600);
        else list.push({ name: hit.name, ...bump(null, 24 * 3600) });
        cache.scopedWeekly = list;
      }
      return cache;
    };
    const fileFor = (id) => path.join(USAGE_CACHE_DIR, String(id).replace(/[^\w.-]/g, '_') + '.json');
    // IDENTITY-GROUP write (2.267.0, anchor-poison root cause): an org-merged
    // login keeps several cache files, and stamping fetchedAt=now onto ONE of
    // them used to PROMOTE that file — week-stale sibling buckets and all —
    // to "freshest" for the anchor sweep (real incident: banner on the idle
    // __global__ file flapped the identity's anchors 51→19→51 and the bounce
    // pair taught a poison rate). Base the promoted write on the identity's
    // FRESHEST file, and mark the same bucket dead in every sibling WITHOUT
    // touching its fetchedAt (a stale file must never gain freshness here).
    const ids = usageIdentityAccountIds(key);
    let base = null, baseAt = -1;
    for (const id of ids) {
      try { const c = JSON.parse(fs.readFileSync(fileFor(id), 'utf-8')) || {}; if ((Number(c.fetchedAt) || 0) > baseAt) { baseAt = Number(c.fetchedAt) || 0; base = c; } } catch {}
    }
    const cache = applyHit(base ? { ...base } : {});
    cache.fetchedAt = Date.now(); cache.source = 'limit-banner';
    fs.mkdirSync(USAGE_CACHE_DIR, { recursive: true });
    const f = fileFor(key);
    fs.writeFileSync(f + '.tmp', JSON.stringify(cache)); fs.renameSync(f + '.tmp', f);
    for (const id of ids) {
      if (id === key) continue;
      try {
        const f2 = fileFor(id);
        let c2; try { c2 = JSON.parse(fs.readFileSync(f2, 'utf-8')) || null; } catch { c2 = null; }
        if (!c2) continue; // never CREATE a sibling file here
        applyHit(c2); // fetchedAt deliberately untouched
        fs.writeFileSync(f2 + '.tmp', JSON.stringify(c2)); fs.renameSync(f2 + '.tmp', f2);
      } catch {}
    }
    global.__vsEvent?.('usage-limit-banner-marked', `${key}:${hit.kind}`);
    maybePoolAutoSwitch(session); // freshest possible exhaustion signal — act now
  } catch (e) { console.warn('[usage] banner mark failed:', e.message); }
}

function maybePoolAutoSwitch(session) {
  try { if (session._accountId) maybePoolAutoSwitchForPool(session._accountId); } catch { }
}
// EVENT-DRIVEN pool evaluation (user-designed after exhaustion #2, 2026-08-09):
// every streamed usage record kicks a (5s-throttled) re-evaluation instead of
// waiting for the timer — combined with the estimator's live odometer, burst
// burns are seen the moment the CLI streams them, not when the ledger scan
// catches up. Zero network; decision reads memory + local files only.
let _poolEvalKickAt = 0;
function kickPoolEval() {
  const now = Date.now();
  if (now - _poolEvalKickAt < 5000) return;
  _poolEvalKickAt = now;
  setImmediate(() => {
    try {
      for (const a of accounts.list().accounts || []) {
        if (a.type === 'pooled' && a.auto) { try { maybePoolAutoSwitchForPool(a.id); } catch { } }
      }
    } catch { }
  });
}
// WORKFLOW usage tailer (2.266.0, user question "不能拦截workflow agents吗"):
// workflow agents are IN-PROCESS API calls writing FILE-ONLY transcripts —
// there is no process to wrap — but tailing the run dir is the same thing at
// the file level: every agent-*.jsonl growth streams its usage records into
// the live odometer within ~1-2s (vs the 30s timer+scan). Armed when the
// launch ack ("Run ID: wf_…") crosses the session's stdout; belt-polled 5s
// (fs.watch can coalesce/miss); torn down after 30min without growth or when
// the session dies. rid-dedup in noteLive makes offset loss/re-reads harmless.
const _wfWatchers = new Map(); // runId → tailer handle
function armWorkflowUsageWatcher(session, sessionId, runId) {
  try {
    if (_wfWatchers.has(runId) || _wfWatchers.size >= 6) return;
    if (session.host) return; // remote runs have no local files; timer+harvest cover them
    const sid = session.claudeSessionId || session.backendSessionId;
    if (!sid || !session.cwd) return;
    const { cwdToProjectDir } = require('./src/session-store.js');
    const dir = path.join(os.homedir(), '.claude', 'projects', cwdToProjectDir(session.cwd), sid, 'subagents', 'workflows', runId);
    // The tailer RETRIES until the dir exists — the ack beats the harness's
    // mkdir by ~17ms, so the old one-shot existsSync never armed (2.270.0,
    // see src/workflow-usage-tailer.js for the forensics).
    const { createWorkflowTailer } = require('./src/workflow-usage-tailer.js');
    const tailer = createWorkflowTailer({
      dir,
      isAlive: () => activeSessions.has(sessionId),
      onRecord: (r) => {
        const u = r.message?.usage;
        const rid = r.requestId || r.message?.id; if (!rid) return;
        const cc = u.cache_creation || {};
        const acctKey = resolveUsageKey(session);
        const acct = acctKey === '__global__' ? null : acctKey;
        const model = r.message?.model;
        const cost = (o) => usageHistory._cost({ acct, model, i: 0, o: 0, cw5: 0, cw1: 0, cr: 0, ...o });
        const usd = cost({ i: u.input_tokens || 0, o: u.output_tokens || 0, cw5: cc.ephemeral_5m_input_tokens || 0, cw1: cc.ephemeral_1h_input_tokens || 0, cr: u.cache_read_input_tokens || 0 });
        const cwUsd = cost({ cw5: cc.ephemeral_5m_input_tokens || 0, cw1: cc.ephemeral_1h_input_tokens || 0 });
        const crUsd = cost({ cr: u.cache_read_input_tokens || 0 });
        usageEstimator.noteLive({ rid, accountId: acctKey, model, usd, cwUsd, crUsd });
      },
      onDrain: (n) => {
        // Observability: this feature died silently for four releases because
        // nothing ever reported it running. Both signals are cheap + local.
        global.__vsMetric?.('wf-usage-noted', n);
        if (!_wfWatchers.get(runId)?._announced) {
          const h = _wfWatchers.get(runId); if (h) h._announced = true;
          global.__vsEvent?.('wf-usage-tailer-armed', runId);
        }
        kickPoolEval();
      },
    });
    _wfWatchers.set(runId, tailer);
    // Reap the handle when the tailer gives up (dead session / idle / no dir).
    const reap = setInterval(() => {
      if (_wfWatchers.get(runId) !== tailer) { clearInterval(reap); return; }
      if (tailer._state.stopped) { _wfWatchers.delete(runId); clearInterval(reap); }
    }, 30000);
    if (reap.unref) reap.unref();
  } catch { }
}
// TIMER-driven evaluation (2.263.0, real incident): the event triggers (turn
// `result` records + limit banner) both sit at TURN EDGES — an 8-minute
// review workflow burned an entire 5h window mid-turn with ZERO evaluation
// points and the pool only switched after exhaustion had failed 9 agents.
// Every auto pool now re-evaluates on a 60s timer (per-pool 60s throttle
// unchanged). §ban-safety: local reads only — the ledger scan mines the CLI's
// own transcripts (self-throttled), the decision reads cache files; no
// network anywhere.
setInterval(() => {
  try {
    const pools = (accounts.list().accounts || []).filter((a) => a.type === 'pooled' && a.auto);
    if (!pools.length) return;
    try { usageHistory.scan(); } catch { } // freshen the odometer first (incremental, 15s-throttled)
    for (const a of pools) { try { maybePoolAutoSwitchForPool(a.id); } catch { } }
  } catch { }
  // 30s (was 60s): the 2026-08-09 #2 exhaustion burned HALF the Fable bucket
  // between two ticks (12 concurrent maxed-context agents ≈ $100+/min) — a
  // tighter cadence can't fully close that gap (ledger visibility lags the
  // burn) but halves the blind window; anti-flap now lives in MIN_GAIN_PCT +
  // the proactive margin, not the cadence.
}, 30000);
function maybePoolAutoSwitchForPool(poolId) {
  try {
    if (!poolId) return;
    const a = accounts.get(poolId);
    if (!a || a.type !== 'pooled' || !a.auto) return;
    const now = Date.now();
    if ((now - (_poolAutoLast.get(poolId) || 0)) < 10000) return; // event-driven kicks need a tight gate; anti-flap = MIN_GAIN, not cadence
    const currentId = accounts.poolCurrent(poolId);
    if (!currentId) return;
    // ESTIMATED bucket view (B-fcff v2): the raw cache goes stale the moment
    // its session pauses — overlay dead-reckoned utilizations (anchor + rate ×
    // ledger cost since) so the decision sees NOW, not the last reading. The
    // estimator abstains per bucket when it has nothing better; those keep raw.
    const readCache = (id) => {
      let raw = null;
      try { raw = JSON.parse(fs.readFileSync(path.join(USAGE_CACHE_DIR, id + '.json'), 'utf-8')); } catch { }
      // ORG-MERGED identities keep TWO cache files (__global__ + the named
      // sub) and ground truth lands in whichever one the refresh targeted —
      // during the 2026-08-09 #2 exhaustion the ⟳ readings (Fable 34%→51%)
      // went to __global__.json while this decision read the sub's file
      // frozen at 01:23. Read through the IDENTITY GROUP: freshest file wins.
      try {
        for (const [, g] of usageIdentityGroupsCached()) {
          if (g.accountIds.includes(id) && g.cache && (g.cache.fetchedAt || 0) > (raw?.fetchedAt || 0)) { raw = g.cache; break; }
        }
      } catch { }
      try { return estOverlayCache(raw, usageEstimator.estimateFor(id, raw, now)); } catch { return raw; }
    };
    // proactive EDF tier only for HOT pools (re-point is free — no restart);
    // cold pools switch on exhaustion only (each switch restarts conversations).
    // Hot pools also treat est<10% as exhaustion (提前切 — switch BEFORE the
    // limit interrupts a long-running workflow; cold keeps 5%).
    // SEALED ORDERS push (design §Pool management, 2.300.0): after every
    // evaluation the holding device (device #0 — pools are local-only) gets
    // the pool's ranked member snapshot. It executes a LOCAL fallback switch
    // ONLY when it both sees a hard limit banner AND cannot reach this
    // server; executions are reported on reconnect and re-attributed below.
    // OBSERVE the rejection: hosts.device(null) throws while the local daemon
    // is down/upgrading, and an unobserved rejection is a process-level
    // unhandledRejection on every eval tick (the deviceBounded ② rule)
    pushSealedOrders(poolId).catch((e) => { if (!_poolOrdersWarned) { _poolOrdersWarned = true; console.warn('[pool] sealed-orders push unavailable:', e.message); } });
    // ── Per-SESSION pass (plan C): sessions with their OWN link decide on a
    // FAMILY-PROJECTED view and re-point only their link — an opus session's
    // spent cap never evicts a fable session, and vice versa. Sessions whose
    // family is unknown project nothing (full view = legacy semantics).
    const members = accounts.poolMembers(poolId);
    for (const [sid, s2] of activeSessions) {
      if (s2._accountId !== poolId || s2.host) continue;
      let curFor = null;
      try { curFor = accounts.poolCurrentFor(poolId, sid); } catch { }
      const hasOwnLink = (() => { try { fs.lstatSync(accounts.sessionPoolLinkPath(poolId, sid)); return true; } catch { return false; } })();
      if (!hasOwnLink || !curFor) continue;
      const fam = familyOfModel(sessionModelFor(s2));
      const projected = (id) => projectCacheForFamily(readCache(id), fam);
      const ds = decidePoolSwitch({ currentId: curFor, members, readCache: projected, nowSec: now / 1000, proactive: !!a.hot, hot: !!a.hot, pessimism: darkTaintedAccounts() });
      if (!ds || !ds.to) continue;
      const dwellKey = poolId + ':' + sid;
      const lastS = _poolSwitchAt.get(dwellKey) || 0;
      if (now - lastS < 180000 && !(ds.fromRemaining != null && ds.fromRemaining < POOL_HARD_PCT)) continue;
      _poolSwitchAt.set(dwellKey, now);
      try {
        accounts.ensureSessionPoolLink(poolId, sid, ds.to);
        try { recordUsageAttribution({ claudeSessionId: s2.claudeSessionId || s2.backendSessionId, accountId: poolId }); } catch { }
        const toName = accounts.get(ds.to)?.name || ds.to;
        serverNotice(`pool-sess-${sid}-${now}`, `Pool "${a.name}": conversation "${s2.name || sid}" moved to ${toName}${fam ? ` (its ${fam} quota${ds.fromRemaining != null ? ` was at ${Math.round(ds.fromRemaining)}%` : ''})` : ''}${a.hot ? '' : ' — restarting it'}`);
        console.log(`[pool] per-session switch ${poolId}/${sid}: ${curFor} → ${ds.to} (fam=${fam || '?'}, from ${ds.fromRemaining}%)`);
        if (!a.hot) {
          const payload = JSON.stringify({ type: 'pool-auto-switched', poolId, affected: [{ serverId: sid, backend: s2.backend || 'claude', backendSessionId: s2.claudeSessionId || s2.backendSessionId || null, cwd: s2.cwd || null, name: s2.name || null, host: s2.host || null }] });
          for (const c of wss.clients) { if (c.readyState === WS_OPEN) { try { c.send(payload); } catch {} break; } }
        }
      } catch (e) { console.warn('[pool] per-session re-point failed:', e.message); }
    }
    const d = decidePoolSwitch({ currentId, members, readCache, nowSec: now / 1000, proactive: !!a.hot, hot: !!a.hot, pessimism: darkTaintedAccounts(), explain: true });
    if (!d) return;
    if (!d.to) {
      // A pool sitting on a DEAD account with nowhere to go used to be
      // completely silent — the user found out by hitting a limit mid-turn
      // (real incident 2026-08-11). Say it, once per hour per pool: this is
      // the state where only the user can act (add a member, wait for a
      // reset, switch that conversation off the pool).
      // EVERY non-actionable outcome must speak, not just 'stuck' (2.313.0):
      // when the candidate gate drops every member the code returns through
      // 'no-members' instead, which was silent — the same "pool sits on a dead
      // account while the user finds out by hitting a limit" incident down a
      // different branch. `_sentNotices` is a per-BOOT permanent Set, so the
      // key must carry an hour bucket or a recurrence is never reported again.
      if (d.reason === 'stuck' || d.reason === 'no-members' || d.reason === 'no-settleable') {
        // Say WHICH buckets are dead. "Every member is out of quota" is wrong
        // under the nested model and points at the wrong action (pay/wait a
        // week) when the truth is usually "one model's weekly cap is spent
        // while the 7-day budget still has 40% left".
        const dead = (d.deadBuckets || []).join(', ');
        const live = (d.liveBuckets || []).join(', ');
        const what = dead ? `spent: ${dead}` : 'out of quota';
        const rest = live ? ` (still available: ${live})` : '';
        const alt = d.bestRemaining != null ? ` The best other member is at ${Math.round(d.bestRemaining)}%.` : '';
        const why = d.reason === 'no-members'
          ? `no member can serve it — ${what}${rest}`
          : `nowhere better to go — ${what}${rest}`;
        serverNotice(`pool-blocked-${poolId}-${d.reason}-${Math.floor(now / 3600000)}`,
          `Pool "${a.name}": ${why}.${alt} Conversations on it will hit a limit until a window resets, you add a member, or you move them off the pool.`, { level: 'warn' });
      }
      return;
    }
    // DWELL belt (2.266.1, real oscillation report): every switch cold-starts
    // the running sessions' prompt caches on BOTH accounts — expensive. After
    // any switch, further switches wait 3min unless the current target is
    // HARD-dead (<5%, genuinely unusable — escaping immediately is cheaper
    // than idling on a dead account). The settle-bar in decidePoolSwitch is
    // the primary anti-oscillation; this is the belt.
    const lastSwitch = _poolSwitchAt.get(poolId) || 0;
    if (now - lastSwitch < 180000 && !(d.fromRemaining != null && d.fromRemaining < POOL_HARD_PCT)) return;
    _poolSwitchAt.set(poolId, now);
    _poolAutoLast.set(poolId, now);
    accounts.setPoolTarget(poolId, d.to);
    // Re-attribute every live session on this pool from this moment — the
    // ledger's by-time attribution resolves pool → current target at record
    // time, so a fresh record moves subsequent requests to the new account.
    const affected = [];
    for (const [sid, s] of activeSessions) {
      if (s._accountId !== poolId) continue;
      // plan C: a session with its own link didn't move with the default —
      // restarting it for the pool-level switch would be the old collateral
      try { fs.lstatSync(accounts.sessionPoolLinkPath(poolId, sid)); continue; } catch { }
      try { recordUsageAttribution({ claudeSessionId: s.claudeSessionId || s.backendSessionId, accountId: poolId }); } catch {}
      affected.push({ serverId: sid, backend: s.backend || 'claude', backendSessionId: s.claudeSessionId || s.backendSessionId || null, cwd: s.cwd || null, name: s.name || null, host: s.host || null });
    }
    const fromPct = d.fromRemaining != null ? Math.round(d.fromRemaining) : null;
    serverNotice(`pool-auto-${poolId}-${now}`, d.reason === 'edf'
      ? `Pool "${a.name}" switched to ${d.toName} — draining the member whose weekly quota resets soonest (use-it-or-lose-it)`
      : `Pool "${a.name}" auto-switched to ${d.toName} (previous account down to ${fromPct}% remaining)${a.hot ? '' : ' — restarting its conversations'}`);
    console.log(`[pool] auto-switch ${poolId}: ${currentId} → ${d.to} (${d.reason}, from ${fromPct}% left, hot=${!!a.hot}, affected=${affected.length})`);
    if (!a.hot && affected.length) {
      // ONE client only — every client acting would race duplicate restarts.
      const payload = JSON.stringify({ type: 'pool-auto-switched', poolId, affected });
      for (const c of wss.clients) { if (c.readyState === WS_OPEN) { try { c.send(payload); } catch {} break; } }
    }
  } catch (e) { console.warn('[pool] auto-switch check failed:', e.message); }
}
// Alias-tolerant model compare (server twin of the client's _modelMismatch):
// 'fable' vs 'claude-fable-5' is NOT a mismatch; [1m] suffixes ignored.
function modelsMatch(a, b) {
  if (!a || !b) return true;
  const core = (m) => String(m).toLowerCase().replace(/^claude-/, '').replace(/\s*\[1m\]$/, '').trim();
  const x = core(a), y = core(b);
  return x === y || x.startsWith(y) || y.startsWith(x);
}
// Per-conversation MODEL LOCK v2 (#6, semantics per the user's correction):
// fallback stays ALLOWED (the flagged turn completes on the fallback model),
// but at each turn end a locked session whose SERVED model drifted away is
// re-pinned via set_model — so every subsequent turn re-attempts the original
// model instead of staying degraded forever (switchModelsOnFlag switches the
// session's model persistently on a safety reroute; this undoes it per turn).
// The set_model echo ("Set model to …") lands in the chat as the visible trace.
function maybeRepinLockedModel(session) {
  try {
    if (!session._modelLocked || !session._lockedModel || !session.pty || session.mode !== 'chat') return;
    if (modelsMatch(session._servedModel, session._lockedModel)) return;
    const adapter = adapterRegistry.get(session.backend);
    if (!adapter?.formatSetModel) return;
    session.pty.write(adapter.formatSetModel(session._lockedModel) + '\n');
    global.__vsEvent?.('model-lock-repin', `${session._servedModel || '?'}->${session._lockedModel}`);
  } catch (e) { console.warn('[model-lock] repin failed:', e.message); }
}

function maybeStopOnFallback(session, id, from, to) {
  try {
    if (serverSetting('claude.disableModelFallback') !== true) return;
    if (session._fallbackStopFired || session.mode !== 'chat' || !session.pty) return;
    const adapter = adapterRegistry.get(session.backend);
    if (!adapter?.formatInterrupt) return;
    session._fallbackStopFired = true;
    session.pty.write(adapter.formatInterrupt() + '\n');
    adapter.postInterrupt(session, id);
    // Belt-and-braces: also disarm fallback in this CLI for the rest of the
    // session, so the next turn stops at the refusal instead of re-routing.
    try { if (adapter.formatSetFallbackPolicy) session.pty.write(adapter.formatSetFallbackPolicy(true) + '\n'); } catch {}
    global.__vsEvent?.('fallback-auto-stop', `${from || '?'}->${to || '?'}`);
    broadcastToSession(session, id, {
      type: 'server-notice', key: `fallback-stop:${id}:${Date.now()}`, level: 2,
      text: `Model fallback detected (${from || '?'} → ${to || '?'}) — turn stopped because "Disable model fallback" is on. Send a new message to continue on your model.`,
    });
  } catch (e) { console.warn('[fallback-stop] failed:', e.message); }
}

// SyncStore imported from ./src/sync-store.js

// ── Effective-size computation (min cols/rows across clients + PTY resize + broadcast) ──
// Only clients that have sent a REAL `resize` (terminal fit) drive the PTY
// size. Two classes of entries must NOT shrink it:
//  - viewer:true  → subagent View Log windows attach to the PARENT session's
//    clients map purely to receive broadcasts; they have no terminal.
//  - placeholder (no `real` flag) → the 120×30 default set at attach time,
//    before the client's first fit(). A reconnecting/ghost client sitting at
//    this placeholder used to win the min and shrink everyone's terminal.
function resizeSessionToMin(session, sessionId) {
  if (!session.clients.size || !session.pty) return;
  let minCols = Infinity, minRows = Infinity, realCount = 0;
  for (const sz of session.clients.values()) {
    if (sz.viewer || !sz.real) continue;
    realCount++;
    if (sz.cols < minCols) minCols = sz.cols;
    if (sz.rows < minRows) minRows = sz.rows;
  }
  // No real terminal client yet (e.g. chat sessions never fit) — fall back to
  // non-viewer placeholders so chat PTYs still get a sane width, but never let
  // a viewer entry participate.
  if (!realCount) {
    for (const sz of session.clients.values()) {
      if (sz.viewer) continue;
      if (sz.cols < minCols) minCols = sz.cols;
      if (sz.rows < minRows) minRows = sz.rows;
    }
  }
  // Size override ("take over"): one client forces the PTY to ITS size instead
  // of the min — e.g. working from a big screen while a small window at home
  // stays attached. Smaller clients block their view behind a "Resume here"
  // overlay. Ownership follows the owner's live resizes and evaporates when the
  // owner disconnects (its clients-map entry disappears → back to min policy).
  let cols = minCols, rows = minRows, override = false;
  const ownerSz = session._sizeOwnerWs ? session.clients.get(session._sizeOwnerWs) : null;
  if (ownerSz && ownerSz.real && !ownerSz.viewer) {
    cols = ownerSz.cols; rows = ownerSz.rows; override = true;
  } else if (session._sizeOwnerWs) {
    session._sizeOwnerWs = null; // owner gone — min policy again
  }
  if (cols < Infinity && rows < Infinity) {
    try { session.pty.resize(cols, rows); } catch {}
    // clients: real terminal count — lets the UI say "limited by a smaller
    // client" (tmux-style boundary) only when someone else is actually attached
    broadcastToSession(session, sessionId, { type: 'effective-size', sessionId, cols, rows, clients: realCount, override });
  }
}

// ── Native goal status sync (Claude) ──
// /goal runs natively in the CLI (Stop hook drives continuation + met
// detection), but goal_status attachments are JSONL-only — they are NOT
// emitted on stream-json stdout (same gap class as subagent messages,
// anthropics/claude-code#8262). After each turn we tail the session JSONL for
// the newest goal_status and sync session state from it.
function checkClaudeGoalStatus(session, id) {
  if (!session.claudeSessionId) return;
  // Remote session: goal_status attachments land in the transcript ON THE
  // HOST — the local data/remote-jsonl cache only refreshes at attach/history
  // fetches, so met-detection could lag arbitrarily (audit 2.192.0). Kick a
  // throttled background refresh; this pass tail-reads whatever is cached and
  // the next result-triggered check sees the refreshed file.
  if (session.host && hosts) {
    const now = Date.now();
    if (!session._goalJsonlFetchAt || now - session._goalJsonlFetchAt > 30000) {
      session._goalJsonlFetchAt = now;
      hosts.fetchSessionJsonl(session.host, session.claudeSessionId).catch(() => {});
    }
  }
  try {
    const fp = findSessionJsonlPath(session.claudeSessionId, session.cwd || '');
    if (!fp) return;
    const stat = fs.statSync(fp);
    const TAIL = 65536;
    let content;
    if (stat.size > TAIL) {
      const fd = fs.openSync(fp, 'r');
      try {
        const buf = Buffer.alloc(TAIL);
        const n = fs.readSync(fd, buf, 0, TAIL, stat.size - TAIL);
        content = buf.toString('utf-8', 0, n);
        content = content.slice(content.indexOf('\n') + 1);
      } finally { fs.closeSync(fd); }
    } else {
      content = fs.readFileSync(fp, 'utf-8');
    }
    // Newest goal_status record wins
    let latest = null;
    for (const line of content.split('\n')) {
      if (!line.includes('"goal_status"')) continue;
      try {
        const rec = JSON.parse(line);
        if (rec.type === 'attachment' && rec.attachment?.type === 'goal_status') latest = rec;
      } catch {}
    }
    if (!latest || latest.uuid === session._lastGoalStatusUuid) return;
    session._lastGoalStatusUuid = latest.uuid;
    const a = latest.attachment;
    const prevGoal = session._goal;
    if (a.durationMs) session._goalElapsed = a.durationMs;
    if (a.tokens) session._goalTokensUsed = a.tokens;
    if (a.met) {
      if (prevGoal) session._prevGoal = prevGoal;
      session._goal = null;
      session._goalStatus = 'complete';
      const reason = (a.reason || '').slice(0, 300);
      broadcastToSession(session, id, {
        type: 'goal-updated', sessionId: id, goal: null, goalStatus: 'complete',
        goalElapsed: session._goalElapsed || 0,
        statusMsg: `Goal met: ${a.condition}${reason ? `\n${reason}` : ''}`,
      });
      // Sync the wrapper meta too — the CLI already cleared its goal natively,
      // but the wrapper can't see that (attachments are JSONL-only). Without
      // this, a server restart would restore a stale "active" goal from meta.
      // (/goal clear on an already-cleared goal is a synthetic no-op.)
      if (session.pty) { try { session.pty.write(JSON.stringify({ type: 'set-goal', goal: null }) + '\n'); } catch {} }
    } else if (a.condition) {
      const changed = session._goal !== a.condition;
      session._goal = a.condition;
      session._goalStatus = 'active';
      if (changed || a.durationMs) {
        broadcastToSession(session, id, {
          type: 'goal-updated', sessionId: id, goal: a.condition, goalStatus: 'active',
          goalElapsed: session._goalElapsed || 0,
          statusMsg: a.sentinel && changed ? `Goal set: ${a.condition}` : null,
        });
      }
    }
  } catch {}
}

// ── PTY setup helper (onData + onExit wiring) ──
// Live TODO capture — the agent's own TodoWrite (claude) / plan tool (codex)
// IS the session's (活儿's) checklist; VibeSpace only OBSERVES it (never a
// parallel store the agent must be taught). Summary rides active-sessions for
// the board's progress pill; the full list is fetched on demand (expanded card
// → /api/session-todos, which reads taskState() from the transcript).
// New task-tool family (CLI ≥2.1.2xx: TaskCreate/TaskUpdate — CRUD by id, not
// full-list snapshots like TodoWrite). The created task's id only arrives in
// the paired TOOL RESULT text ("Task #N created…"), so creates are stashed by
// tool_use_id until the result lands. Replayed into a list for the same pill.
function applyTaskToolUpdate(session, input) {
  const list = (session._taskList ||= new Map());
  const key = String(input.taskId);
  if (input.status === 'deleted') list.delete(key);
  else {
    const cur = list.get(key) || { content: '', status: 'pending' };
    if (input.subject) cur.content = input.subject;
    if (input.activeForm) cur.activeForm = input.activeForm;
    if (input.status) cur.status = input.status;
    list.set(key, cur);
  }
  emitTaskListTodos(session);
}
function emitTaskListTodos(session) {
  if (!session._taskList?.size) return;
  const todos = [...session._taskList.entries()]
    .sort((a, b) => Number(a[0]) - Number(b[0]))
    .map(([, v]) => v);
  updateSessionTodos(session, todos);
}
let _todoBroadcastTimer = null;
function updateSessionTodos(session, todos) {
  try {
    if (!Array.isArray(todos) || !todos.length) return;
    const done = todos.filter((t) => t?.status === 'completed').length;
    const cur = todos.find((t) => t?.status === 'in_progress');
    session._todos = { done, total: todos.length, current: cur ? String(cur.content || cur.activeForm || cur.step || '').slice(0, 140) : null };
    if (!_todoBroadcastTimer) { // coalesce: TodoWrite can fire several times per turn
      _todoBroadcastTimer = setTimeout(() => { _todoBroadcastTimer = null; broadcastActiveSessions(); }, 500);
    }
  } catch { }
}

function setupSessionPty(session, id, ptyProcess, { cleanupOnExit = true } = {}) {
  session.pty = ptyProcess;

  if (session.mode === 'chat') {
    let lineBuf = '';
    if (session.backend === 'codex') {
      const stripAnsi = (value) => String(value || '').replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, '');
      ptyProcess.onData((output) => {
        if (session._reattachAttempts) session._reattachAttempts = 0;
        // Append, trim only past 1.5x cap — slicing a fresh 800KB string per
        // delta chunk was hundreds of MB/s of string churn while streaming
        session.buffer += output;
        if (session.buffer.length > 1200000) session.buffer = session.buffer.slice(-800000);
        lineBuf += output;
        let nlIdx;
        while ((nlIdx = lineBuf.indexOf('\n')) !== -1) {
          const line = lineBuf.substring(0, nlIdx).replace(/\r/g, '').trim();
          lineBuf = lineBuf.substring(nlIdx + 1);
          if (!line) continue;
          try {
            const msg = JSON.parse(stripAnsi(line).trim());
            if (msg.type === '_stdin_ack') { session._stdinAckReceived = true; continue; }
            const payload = msg.payload || {};
            // remote transport state (2.139.0 codex remote chat, B-0588) —
            // rides as an event_msg record from the wrapper; mirror the
            // claude branch's broadcast so the status-bar chip works
            if (msg.type === 'event_msg' && payload.type === '_remote_state') {
              session._remoteState = payload.state === 'connected' ? null : { state: payload.state, attempts: payload.attempts || 0, at: Date.now() };
              broadcastToSession(session, id, { type: 'remote-state', sessionId: id, state: payload.state, attempts: payload.attempts || 0 });
              continue;
            }
            const nextThreadId = msg.type === 'session_meta'
              ? payload.id
              : msg.type === 'wrapper_meta'
                ? payload.threadId
                : null;
            // Name ONLY from meta records: every codex function_call carries
            // payload.name = the TOOL name ('shell'…) — ungated, each tool call
            // renamed the session + 2 sync meta writes + 2 broadcasts, forever
            // (audit round-2, high). Real thread names arrive via
            // session_meta/wrapper_meta only.
            const nextThreadName = (msg.type === 'session_meta' || msg.type === 'wrapper_meta')
              ? (payload.session_name || payload.sessionName || payload.threadName || payload.name || payload.thread?.name || null)
              : null;
            const sourceMeta = payload.source ? normalizeCodexSource(payload.source) : null;
            let changed = false;
            if (nextThreadId && session.backendSessionId !== nextThreadId) {
              if (session.backendSessionId) {
                const prev = session.forkedFrom || [];
                if (!prev.includes(session.backendSessionId)) prev.push(session.backendSessionId);
                session.forkedFrom = prev;
              }
              session.backendSessionId = nextThreadId;
              session.claudeSessionId = null;
              changed = true;
            }
            if (nextThreadName && session.name !== nextThreadName) {
              session.name = nextThreadName;
              changed = true;
            }
            if (payload.cwd && session.cwd !== payload.cwd) {
              session.cwd = payload.cwd;
              changed = true;
            }
            if (sourceMeta) {
              const nextFields = {
                sourceKind: sourceMeta.sourceKind || null,
                agentKind: sourceMeta.agentKind || 'primary',
                agentRole: sourceMeta.agentRole || '',
                agentNickname: sourceMeta.agentNickname || '',
                parentThreadId: sourceMeta.parentThreadId || null,
              };
              for (const [key, value] of Object.entries(nextFields)) {
                if ((session[key] || null) !== (value || null)) {
                  session[key] = value;
                  changed = true;
                }
              }
            }
            if (changed && session.sockName) {
              writeSessionMeta(session.sockName, {
                ...(readSessionMeta(session.sockName) || {}), // preserve keys not re-listed (agentToken/taskId/accountId)
                name: session.name,
                cwd: session.cwd,
                backend: session.backend,
                backendSessionId: session.backendSessionId,
                claudeSessionId: null,
                sourceKind: session.sourceKind || null,
                agentKind: session.agentKind || 'primary',
                agentRole: session.agentRole || '',
                agentNickname: session.agentNickname || '',
                parentThreadId: session.parentThreadId || null,
                forkedFrom: session.forkedFrom || null,
                permissionMode: session._permissionMode || null,
                effort: session._effort || null,
                createdAt: session.createdAt,
                webuiSessionId: id,
                mode: session.mode,
              });
              broadcastActiveSessions();
            }
            // Track turn lifecycle: streaming state + activity label
            {
              let newLabel = null;
              if (msg.type === 'event_msg') {
                const evType = payload.type;
                if (evType === 'task_started' && payload.turn_id) { session._isStreaming = true; newLabel = 'thinking...'; }
                else if (evType === 'task_complete' || evType === 'turn_aborted' || evType === 'task_failed') { session._isStreaming = false; newLabel = ''; }
                else if (evType === 'goal_updated' && payload.goal) {
                  session._goal = payload.goal.objective || null;
                  session._goalElapsed = (payload.goal.timeUsedSeconds || payload.goal.time_used_seconds || 0) * 1000;
                  session._goalStatus = payload.goal.status || null;
                  broadcastToSession(session, id, { type: 'goal-updated', sessionId: id, goal: session._goal, goalElapsed: session._goalElapsed, goalStatus: session._goalStatus });
                } else if (evType === 'goal_cleared') {
                  if (session._goal) session._prevGoal = session._goal;
                  session._goal = null; session._goalElapsed = 0; session._goalStatus = null;
                  broadcastToSession(session, id, { type: 'goal-updated', sessionId: id, goal: null, statusMsg: 'Goal cleared' });
                }
              } else if (msg.type === 'response_item') {
                const itemType = payload.type;
                if (itemType === 'message' && payload.role === 'assistant') newLabel = 'responding';
                else if (itemType === 'function_call') newLabel = `running ${payload.name || 'tool'}`;
                else if (itemType === 'reasoning') newLabel = 'thinking...';
              }
              if (newLabel !== null && session._streamingLabel !== newLabel) {
                session._streamingLabel = newLabel;
                broadcastToSession(session, id, { type: 'streaming-label', sessionId: id, label: newLabel });
              }
            }
            // Codex plan tool → the session's live TODO summary (board pill)
            if (msg.type === 'event_msg' && msg.payload?.type === 'plan_updated' && Array.isArray(msg.payload.plan)) {
              updateSessionTodos(session, msg.payload.plan.map((p) => ({
                content: p.step || '',
                status: (p.status === 'inProgress' || p.status === 'in_progress') ? 'in_progress' : (p.status === 'completed' ? 'completed' : 'pending'),
              })));
            }
            if (session._normalizer) session._normalizer.processLive(msg);
          } catch {
            broadcastToSession(session, id, { type: 'output', sessionId: id, data: line + '\n' });
          }
        }
      });
    } else {
      if (!session.subagentBuffers) session.subagentBuffers = new Map();
      if (!session.subagentEmittedUuids) session.subagentEmittedUuids = new Map(); // toolUseId → Set<uuid>
      if (!session.subagentWatchers) session.subagentWatchers = new Map(); // toolUseId → {watcher, offset}

      // Watch a subagent JSONL file for new messages (fills gap: text/thinking not in stream-json)
      const startSubagentWatcher = (toolUseId, agentId, attempt = 0) => {
        if (session.subagentWatchers.has(toolUseId)) return;
        // Find JSONL path
        const projectsDir = path.join(os.homedir(), '.claude', 'projects');
        const projDir = cwdToProjectDir(session.cwd || '');
        const candidates = [];
        if (session.claudeSessionId) {
          candidates.push(path.join(projectsDir, projDir, session.claudeSessionId, 'subagents', `agent-${agentId}.jsonl`));
          try { for (const dir of fs.readdirSync(projectsDir)) { const fp = path.join(projectsDir, dir, session.claudeSessionId, 'subagents', `agent-${agentId}.jsonl`); if (!candidates.includes(fp)) candidates.push(fp); } } catch {}
        }
        const watchFile = candidates.find(f => { try { return fs.existsSync(f); } catch { return false; } });
        if (!watchFile) {
          // File doesn't exist yet — retry with backoff, capped: an agent that
          // failed before writing its JSONL never gets a task_notification, so
          // an uncapped 1s retry (each with a full projects-dir scan) would
          // spin for the session's lifetime
          if (attempt >= 30) { session.subagentWatchers.delete(toolUseId); return; }
          const delay = Math.min(10000, 1000 * Math.pow(1.3, attempt));
          // Belt-and-braces liveness: a killed session must not keep re-scanning
          // the projects dir through this retry chain (audit round-2)
          const retry = setTimeout(() => { session.subagentWatchers.delete(toolUseId); if (!activeSessions.has(id)) return; startSubagentWatcher(toolUseId, agentId, attempt + 1); }, delay);
          session.subagentWatchers.set(toolUseId, { watcher: null, retry, lastActivity: Date.now() });
          return;
        }
        if (!session.subagentEmittedUuids.has(toolUseId)) session.subagentEmittedUuids.set(toolUseId, new Set());
        const emitted = session.subagentEmittedUuids.get(toolUseId);
        let offset = 0;
        // Read existing content first
        const readNewLines = () => {
          try {
            const stat = fs.statSync(watchFile);
            if (stat.size <= offset) return;
            const buf = Buffer.alloc(stat.size - offset);
            const fd = fs.openSync(watchFile, 'r');
            fs.readSync(fd, buf, 0, buf.length, offset);
            fs.closeSync(fd);
            offset = stat.size;
            for (const line of buf.toString('utf-8').split('\n')) {
              const trimmed = line.trim();
              if (!trimmed) continue;
              try {
                const msg = JSON.parse(trimmed);
                if (msg.uuid && emitted.has(msg.uuid)) continue; // already sent via stream-json
                if (msg.uuid) emitted.add(msg.uuid);
                if (msg.type !== 'user' && msg.type !== 'assistant' && msg.type !== 'result') continue;
                // Buffer + broadcast
                if (!session.subagentBuffers.has(toolUseId)) session.subagentBuffers.set(toolUseId, []);
                session.subagentBuffers.get(toolUseId).push(msg);
                broadcastToSession(session, id, { type: 'subagent-message', sessionId: id, parentToolUseId: toolUseId, message: msg });
                // Normalize for subagent viewers
                if (!session._subNormalizers) session._subNormalizers = new Map();
                if (!session._subNormalizers.has(toolUseId)) {
                  const subMM = new MessageManager(`sub-${toolUseId}`);
                  subMM.onOp((op) => broadcastToSession(session, id, { type: 'msg', sessionId: `sub-${toolUseId}`, ...op }));
                  session._subNormalizers.set(toolUseId, subMM);
                }
                session._subNormalizers.get(toolUseId).processLive(msg);
              } catch {}
            }
          } catch {}
        };
        readNewLines(); // read any existing content
        const watcher = fs.watch(watchFile, () => { const e = session.subagentWatchers.get(toolUseId); if (e) e.lastActivity = Date.now(); readNewLines(); });
        session.subagentWatchers.set(toolUseId, { watcher, lastActivity: Date.now() });
      };

      const stopSubagentWatcher = (toolUseId) => {
        const entry = session.subagentWatchers.get(toolUseId);
        if (entry) {
          if (entry.watcher) entry.watcher.close();
          if (entry.retry) clearTimeout(entry.retry);
          session.subagentWatchers.delete(toolUseId);
        }
      };
      // restoreSessions re-arms watchers for agents that span a restart via
      // this handle (the wrapper meta's task map carries their ids); the
      // 10-min inactivity sweep bounds any stale entry it re-creates
      session._startSubagentWatcher = startSubagentWatcher;

      ptyProcess.onData((output) => {
        if (session._reattachAttempts) session._reattachAttempts = 0;
        session.buffer += output;
        if (session.buffer.length > 750000) session.buffer = session.buffer.slice(-500000);
        lineBuf += output;
        let nlIdx;
        while ((nlIdx = lineBuf.indexOf('\n')) !== -1) {
          const line = lineBuf.substring(0, nlIdx).replace(/\r/g, '').trim();
          lineBuf = lineBuf.substring(nlIdx + 1);
          if (!line) continue;
          try {
            const msg = JSON.parse(line);
            // BREADCRUMB for CLI evolution (2.227.8): the claude stream gained
            // `tool_progress` and it silently rode the subagent branch for
            // weeks (2.227.7) — the SECOND time a new upstream record type
            // became an invisible product gap (the first was
            // model_refusal_fallback, 2.227.4). Name-only, deduped per
            // process, so the NEXT new top-level type shows up in Diagnostics
            // instead of waiting for a user to notice something odd.
            if (msg.type && !CLAUDE_STREAM_TYPES.has(msg.type) && !_seenStreamTypes.has(msg.type)) {
              _seenStreamTypes.add(msg.type);
              global.__vsEvent?.('cli-unknown-stream-type', String(msg.type).slice(0, 60));
              console.log(`[claude] new stream record type from the CLI: ${msg.type} (unhandled — see Diagnostics)`);
            }
            if (msg.type === '_stdin_ack') { session._stdinAckReceived = true; continue; }
            // Remote transport state from the chat-wrapper (2.125.0): the ssh
            // pipe died and the wrapper is reconnecting to the host-side keeper
            // (the REMOTE session is fine). Surfaced as a status-bar chip; the
            // attach payload carries the current value for refreshes.
            if (msg.type === '_remote_state') {
              const rs = { state: msg.state, attempts: msg.attempts || 0, at: Date.now(), lastError: msg.lastError || null };
              session._remoteState = msg.state === 'connected' ? null : rs;
              broadcastToSession(session, id, { type: 'remote-state', sessionId: id, ...rs });
              broadcastActiveSessions(); // card chip follows the transport state (2.219.1)
              continue;
            }

            // Claude fork: adopt the new session id. --fork-session makes claude
            // mint a fresh id at startup — the very first system/hook_started
            // line already carries it (verified) — and write a separate JSONL.
            // Without adopting it the WebUI keeps tracking the PARENT id, so the
            // forked window shadows the original (same name/history/resume
            // target) and the fork's transcript is orphaned — indistinguishable
            // from a plain resume. One-shot _forkRequested guard (set only when
            // data.fork) so a normal resume, whose id the parser also sees on
            // every line, can never be hijacked.
            // FIRST-capture is UNCONDITIONAL (2.156.1, userL real incident):
            // a session created with claudeSessionId=null could NEVER adopt its
            // id here — the fork guard vetoed the only parser-side capture.
            // Local sessions were silently rescued by lock-first discovery
            // (local locks visible); REMOTE keeper sessions had no rescuer, so
            // meta kept null forever and attach's transcript prefetch died on
            // it. Hijack-safety is preserved: with NO tracked id there is
            // nothing to hijack, and a CHANGED id still requires _forkRequested.
            // IMPLICIT FORK adoption (2.219.0, userL real incident): a
            // `claude --resume <id>` whose conversation is LOCKED by another
            // live claude (an orphaned keeper child) silently forks to a NEW
            // session id — no fork flag from us, claude's own double-writer
            // protection. The 2.156.1 hijack guard vetoed that change, so
            // VibeSpace kept tracking the OLD id while claude wrote the new
            // file: the live stream showed the turns, every restart-rebuilt
            // history lost them ("compact recap 里有, 窗口里不展示"). An id
            // change on the FIRST id-bearing line of a RESUME spawn is claude
            // telling us the real id — adopt it (mid-stream changes without
            // the fork flag stay vetoed).
            const implicitFork = session._resumeSpawn && !session._sawFirstId
              && session.backendSessionId && msg.session_id !== session.backendSessionId;
            if (typeof msg.session_id === 'string' && msg.session_id && !session._sawFirstId) {
              session._sawFirstId = true;
              // persist the disarm for resumes — a restart between first-id and
              // a later id-bearing line must not re-arm implicit-fork adoption
              if (session._resumeSpawn && session.sockName) {
                try { writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), sawFirstId: true }); } catch {}
              }
            }
            if (typeof msg.session_id === 'string' && msg.session_id
                && (!session.backendSessionId || ((session._forkRequested || implicitFork) && session.backendSessionId !== msg.session_id))) {
              if (session.backendSessionId) {
                const prev = session.forkedFrom || [];
                if (!prev.includes(session.backendSessionId)) prev.push(session.backendSessionId);
                session.forkedFrom = prev;
              }
              session.backendSessionId = msg.session_id;
              session.claudeSessionId = msg.session_id;
              session._forkRequested = false; // adopt once, then stop watching
              if (session.sockName) {
                writeSessionMeta(session.sockName, {
                  ...(readSessionMeta(session.sockName) || {}), // preserve keys not re-listed (agentToken/taskId/accountId)
                  name: session.name,
                  cwd: session.cwd,
                  backend: session.backend,
                  backendSessionId: session.backendSessionId,
                  claudeSessionId: session.claudeSessionId,
                  sourceKind: session.sourceKind || null,
                  agentKind: session.agentKind || 'primary',
                  agentRole: session.agentRole || '',
                  agentNickname: session.agentNickname || '',
                  parentThreadId: session.parentThreadId || null,
                  forkedFrom: session.forkedFrom || null,
                  permissionMode: session._permissionMode || null,
                  effort: session._effort || null,
                  createdAt: session.createdAt,
                  webuiSessionId: id,
                  mode: session.mode,
                });
              }
              broadcastActiveSessions();
            }

            // Billing identity TRUTH: the init record's apiKeySource is the
            // CLI's own statement of what auth it resolved — 'none'=subscription
            // OAuth, '/login managed key'=console login (API billing),
            // 'ANTHROPIC_API_KEY'=env key. Overrides the spawn-time guess.
            if (msg.type === 'system' && msg.subtype === 'init' && typeof msg.apiKeySource === 'string') {
              if (session._apiKeySource !== msg.apiKeySource) {
                session._apiKeySource = msg.apiKeySource;
                if (session.sockName) writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), apiKeySource: msg.apiKeySource });
                broadcastActiveSessions();
              }
            }

            // get_usage control-response (vsu- ids are OURS): payload nests at
            // response.response (live-verified 2026-08-09); resolve the ⟳
            // probe's promise + persist. Other control_responses untouched.
            if (msg.type === 'control_response' && String(msg.response?.request_id || '').startsWith('vsu-')) {
              const pend = _vsuPending.get(msg.response.request_id);
              if (pend) {
                _vsuPending.delete(msg.response.request_id);
                clearTimeout(pend.timer);
                let parsed = null;
                try { parsed = ClaudeCodeAdapter.parseGetUsageResponse(msg.response.response); } catch {}
                pend.resolve(parsed);
              }
            }
            // Served-model truth for the lock re-pin (assistant records carry
            // the model that actually answered; '<synthetic>' rows excluded).
            // MAIN THREAD ONLY (review-caught): subagents/sidechains run their
            // own models — without the guard a haiku subagent both spuriously
            // triggered repins AND masked a real main-thread reroute when it
            // answered last.
            // STEP 3 record REGISTRATION (first-writer-wins, parse-primary):
            // the parse marks every record it processes; the DEVICE feed runs
            // the side-effect families only for records the parse has NOT yet
            // seen (relay lag, wrapper reconnect windows, a dead relay). The
            // parse keeps full authority when healthy — the device stream
            // fills its gaps and beats its latency, never double-fires. Every
            // family is idempotent by design regardless (stdout re-emits the
            // same msg.id up to 3×), so the gate is belt, not the only guard.
            sbSeenFirst(session, msg);
            if (msg.type === 'assistant' && !msg.parent_tool_use_id && !msg.isSidechain
                && msg.message?.model && !String(msg.message.model).startsWith('<')) {
              session._servedModel = msg.message.model; session._servedModelAt = Date.now();
              try { noteModelSeen(session._servedModel); } catch { }
              // Latch a target-less lock (locked before any model was known —
              // restored sessions, pre-first-reply locks): first main-thread
              // served model becomes the target, else repin no-ops forever.
              if (session._modelLocked && !session._lockedModel) {
                session._lockedModel = session._servedModel;
                try { if (session.sockName) writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), lockedModel: session._lockedModel }); } catch {}
              }
            }
            // CLI error-class telemetry (2.207.0, names/enums only — no
            // content): usage-limit sightings and silent model fallbacks are
            // exactly what tonight's incidents needed frequency data for.
            // LIVE odometer feed (event-driven estimation): note every usage-
            // carrying record — main thread AND subagent sidechains — the
            // moment it streams (before the transcript flush, long before the
            // ledger scan), then kick a throttled pool re-evaluation. This is
            // what makes burst burns visible between scan ticks (exhaustion #2:
            // half the Fable bucket evaporated inside one polling interval).
            // Bug B (2.297.0, offline-bias audit): a HOST-LOGIN remote session
            // has no local billing identity — resolveUsageKey fell through to
            // '__global__', crediting the LOCAL machine login's live odometer
            // with another machine's spend (then the harvest landed the real
            // event and the estimate visibly dropped back — spend that
            // un-counts itself). Host-login sessions skip the ring; the
            // harvest is their one ledger path. Account-billed remote
            // sessions keep riding it (their identity is real and global).
            if (msg.type === 'assistant' && msg.message?.usage && (msg.requestId || msg.message?.id)
                && !(session.host && !session._accountId)) {
              try {
                const u = msg.message.usage; const cc = u.cache_creation || {};
                const acctKey = resolveUsageKey(session);
                const usd = usageHistory._cost({ acct: acctKey === '__global__' ? null : acctKey, model: msg.message.model, i: u.input_tokens || 0, o: u.output_tokens || 0, cw5: cc.ephemeral_5m_input_tokens || 0, cw1: cc.ephemeral_1h_input_tokens || 0, cr: u.cache_read_input_tokens || 0 });
                const cwUsd = usageHistory._cost({ acct: acctKey === '__global__' ? null : acctKey, model: msg.message.model, i: 0, o: 0, cw5: cc.ephemeral_5m_input_tokens || 0, cw1: cc.ephemeral_1h_input_tokens || 0, cr: 0 });
                const crUsd = usageHistory._cost({ acct: acctKey === '__global__' ? null : acctKey, model: msg.message.model, i: 0, o: 0, cw5: 0, cw1: 0, cr: u.cache_read_input_tokens || 0 });
                usageEstimator.noteLive({ rid: msg.requestId || msg.message.id, accountId: acctKey, model: msg.message.model, usd, cwUsd, crUsd });
                kickPoolEval();
              } catch { }
            }
            // CLI-native quota push (B-e5c9): emitted when rate limit info
            // changes, riding real API responses — zero extra calls; covers
            // chat sessions the statusline never could, local AND remote.
            if (msg.type === 'rate_limit_event') recordRateLimitEvent(session, msg);
            if (msg.type === 'assistant' && Array.isArray(msg.message?.content)) {
              for (const b of msg.message.content) {
                if (b?.type === 'text' && typeof b.text === 'string' && /You've (?:reached|hit) your .{0,40} limit/.test(b.text)) {
                  global.__vsEvent?.('cli-usage-limit');
                  markLimitBanner(session, b.text); // chat-mode passive exhaustion signal (2.260.0)
                } else if (b?.type === 'fallback') {
                  global.__vsEvent?.('cli-model-fallback', `${b.from?.model || '?'}->${b.to?.model || '?'}`);
                  // main thread only — a SUBAGENT's fallback must not interrupt
                  // the parent turn (same guard class as the served-model capture)
                  if (!msg.parent_tool_use_id && !msg.isSidechain) maybeStopOnFallback(session, id, b.from?.model, b.to?.model);
                }
              }
            }
            // Reactive belt for the CLIENT-lane reroute (system record). The
            // native switchModelsOnFlag=false prevents both lanes for sessions
            // spawned/flipped after the toggle — this belt covers sessions
            // that predate it (their CLI still has fallback armed).
            if (msg.type === 'system' && msg.subtype === 'model_refusal_fallback') {
              maybeStopOnFallback(session, id,
                msg.originalModel || msg.original_model, msg.fallbackModel || msg.fallback_model);
            }

            // Permission-mode TRUTH (2.195.0): 2.1.215 emits a fresh init on
            // EVERY user message carrying the CURRENT effective mode — adopt
            // it so attach/chatStatus/resume never serve the spawn-time value
            // (the old stale _permissionMode is what made a successful
            // mid-session switch look reverted after a restart/reattach).
            if (msg.type === 'system' && msg.subtype === 'init' && typeof msg.permissionMode === 'string' && msg.permissionMode
                && session._permissionMode !== msg.permissionMode) {
              session._permissionMode = msg.permissionMode;
              if (session.sockName) writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), permissionMode: msg.permissionMode });
            }

            // set_permission_mode verdict (2.195.0): the CLI REFUSES a
            // mid-session switch to bypassPermissions unless the session was
            // launched bypass-capable — a clean error control_response we
            // used to swallow (the optimistic badge then flipped back on the
            // next init and the user read the whole feature as broken).
            // Success → adopt + persist; either way tell the session's
            // clients so the UI can confirm, revert, or offer the
            // restart-with-mode path.
            if (msg.type === 'control_response' && session._pendingModeReqs?.has(msg.response?.request_id)) {
              const pend = session._pendingModeReqs.get(msg.response.request_id);
              session._pendingModeReqs.delete(msg.response.request_id);
              const ok = msg.response?.subtype === 'success';
              if (ok) {
                session._permissionMode = pend.mode;
                if (session.sockName) writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), permissionMode: pend.mode });
              }
              if (!ok) global.__vsEvent?.('perm-mode-refused', pend.mode);
              broadcastToSession(session, id, {
                type: 'permission-mode-ack', sessionId: id, ok, mode: pend.mode,
                error: ok ? null : String(msg.response?.error || 'permission mode change refused'),
              });
            }

            // TodoWrite / TaskCreate / TaskUpdate → the session's live TODO
            // summary (board pill). TaskCreate's id arrives in the RESULT.
            if (msg.type === 'assistant' && Array.isArray(msg.message?.content)) {
              for (const b of msg.message.content) {
                if (b?.type !== 'tool_use') continue;
                if (b.name === 'TodoWrite' && Array.isArray(b.input?.todos)) updateSessionTodos(session, b.input.todos);
                else if (b.name === 'TaskCreate') (session._pendingTaskCreates ||= new Map()).set(b.id, b.input || {});
                else if (b.name === 'TaskUpdate' && b.input?.taskId) applyTaskToolUpdate(session, b.input);
              }
            }
            if (msg.type === 'user' && Array.isArray(msg.message?.content) && session._pendingTaskCreates?.size) {
              for (const b of msg.message.content) {
                if (b?.type !== 'tool_result' || !session._pendingTaskCreates.has(b.tool_use_id)) continue;
                const inp = session._pendingTaskCreates.get(b.tool_use_id);
                session._pendingTaskCreates.delete(b.tool_use_id);
                const txt = typeof b.content === 'string' ? b.content : (Array.isArray(b.content) ? b.content.map((c) => c?.text || '').join(' ') : '');
                const m = /Task #(\d+) created/.exec(txt);
                if (m) {
                  (session._taskList ||= new Map()).set(m[1], { content: inp.subject || '', activeForm: inp.activeForm, status: 'pending' });
                  emitTaskListTodos(session);
                }
              }
            }

            // Track turn lifecycle: streaming state + activity label (broadcast to clients)
            {
              let newLabel = null;
              if (msg.type === 'result' || (msg.type === 'system' && msg.subtype === 'compact_boundary')) {
                session._isStreaming = false;
                session._fallbackStopFired = false; // one auto-stop per turn (claude.disableModelFallback belt)
                newLabel = '';
              } else if (msg.type === 'user' && !msg.parent_tool_use_id && !msg.isSidechain) {
                // Local-command echoes (e.g. "<local-command-stdout>Set model
                // to ...") are user records with NO turn behind them — treating
                // them as a turn start left the chat stuck on "thinking..."
                // forever after a model switch.
                const uText = typeof msg.message?.content === 'string'
                  ? msg.message.content
                  : (Array.isArray(msg.message?.content) ? msg.message.content.map(b => b.text || '').join('') : '');
                // A5 (review): "Set model to X (resolved-full-id)" echo is the
                // CLI's authoritative resolution — upgrade a BARE-ALIAS lock
                // target to the full id (alias targets false-match intra-family
                // reroutes via the startsWith rule, e.g. 'opus' vs 'opus-4-8',
                // and the repin never fires).
                if (session._modelLocked && session._lockedModel && !/\d/.test(session._lockedModel)) {
                  const em = /^<local-command-stdout>Set model to \S+ \(([^)]+)\)/.exec(uText.trim());
                  if (em && modelsMatch(session._lockedModel, em[1])) {
                    session._lockedModel = em[1];
                    try { if (session.sockName) writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), lockedModel: em[1] }); } catch {}
                  }
                }
                if (!/^<local-command-/.test(uText.trim())) {
                  session._isStreaming = true;
                  newLabel = 'thinking...';
                }
              } else if (msg.type === 'assistant' && !msg.parent_tool_use_id && !msg.isSidechain) {
                const blocks = msg.message?.content;
                if (Array.isArray(blocks)) {
                  const last = blocks[blocks.length - 1];
                  if (last?.type === 'thinking') newLabel = 'thinking...';
                  else if (last?.type === 'text') newLabel = 'responding';
                  else if (last?.type === 'tool_use') newLabel = `running ${last.name || 'tool'}`;
                }
              } else if (msg.type === 'system' && msg.subtype === 'api_retry') {
                // Anthropic API erroring + CLI auto-retrying (up to 10× with
                // backoff — minutes of apparent freeze). Silently dropped, the
                // user sees a bare spinner and files "everything is stuck"
                // (real fleet incident: API 500 burst read as a product hang).
                // Say what's actually happening in the spinner text.
                const attempt = msg.attempt || '?', max = msg.max_retries || 10;
                const why = msg.error_status ? `HTTP ${msg.error_status}` : (msg.error && msg.error !== 'unknown' ? msg.error : 'connection error');
                newLabel = `API retrying (${attempt}/${max}, ${why})…`;
              }
              if (newLabel !== null && session._streamingLabel !== newLabel) {
                session._streamingLabel = newLabel;
                broadcastToSession(session, id, { type: 'streaming-label', sessionId: id, label: newLabel });
              }
            }

            // Track goal state from CLI /goal command (goal_status attachment).
            // Attachments are JSONL-only in current CLI versions — keep the
            // stdout handler in case that changes, but the authoritative sync
            // happens via checkClaudeGoalStatus after each result.
            if (msg.type === 'attachment' && msg.attachment?.type === 'goal_status') {
              const a = msg.attachment;
              const prevGoal = session._goal;
              if (a.durationMs) session._goalElapsed = a.durationMs;
              if (a.tokens) session._goalTokensUsed = a.tokens;
              if (a.met) {
                if (prevGoal) session._prevGoal = prevGoal;
                session._goal = null;
                session._goalStatus = 'complete';
              } else if (a.condition) {
                session._goal = a.condition;
                session._goalStatus = 'active';
              }
              if (session._goal !== prevGoal) {
                broadcastToSession(session, id, { type: 'goal-updated', sessionId: id, goal: session._goal || null, goalStatus: session._goalStatus, goalElapsed: session._goalElapsed || 0,
                  statusMsg: a.met ? `Goal met: ${a.condition}` : (a.sentinel ? `Goal set: ${a.condition}` : null) });
              }
            }

            // After each turn, tail the JSONL for goal_status (native goal sync).
            // Immediate check + one delayed re-check (the Stop hook may write
            // the attachment slightly after the result reaches stdout).
            if (msg.type === 'result') maybePoolAutoSwitch(session);
            // Event-driven remote ledger harvest (owner question "为什么15分钟
            // 不实时"): a remote session's turn just ENDED — its usage now
            // exists in the remote transcript, so harvest promptly (60s/host
            // floor) instead of waiting out the idle 15-min cadence. The pool
            // control loop never depended on this (it eats the relayed stdout
            // live via noteLive); this closes the LEDGER/billing-popup lag.
            if (msg.type === 'result' && session.host) {
              try {
                hosts?.harvestUsage(session.host, { minIntervalMs: 60 * 1000, scannerPath: USAGE_SCANNER_PATH })
                  .then((txt) => { if (txt) usageHistory.ingestRemoteEvents(session.host, hosts.get(session.host)?.name, txt); })
                  .catch(() => { });
              } catch { }
            }
            if (msg.type === 'result') maybeRepinLockedModel(session);
            if (msg.type === 'result' && session._goal) {
              checkClaudeGoalStatus(session, id);
              setTimeout(() => { if (activeSessions.has(id)) checkClaudeGoalStatus(session, id); }, 2000);
            }

            // Track subagent lifecycle: start/stop JSONL watchers
            if (msg.type === 'system' && msg.subtype === 'task_started' && msg.task_type === 'local_agent' && msg.task_id && msg.tool_use_id) {
              startSubagentWatcher(msg.tool_use_id, msg.task_id);
            }
            // Completed agents are served from DISK on attach (sub-agent-*),
            // so the live buffers are dead weight once done — a long session
            // driving dozens of agents retained every subagent message twice
            // (raw buffer + normalizer), unbounded (audit round-2). Grace
            // period lets an already-open live viewer finish rendering.
            const gcSubagent = (tuid) => setTimeout(() => {
              if (!activeSessions.has(id)) return;
              session.subagentBuffers?.delete?.(tuid);
              session.subagentEmittedUuids?.delete?.(tuid);
              session._subNormalizers?.delete?.(tuid);
            }, 60000);
            if (msg.type === 'system' && msg.subtype === 'task_notification' && msg.tool_use_id) {
              stopSubagentWatcher(msg.tool_use_id);
              gcSubagent(msg.tool_use_id);
            }
            // The CURRENT harness signals a background agent's completion with
            // the <task-notification> WAKEUP user record instead (2.233.0
            // discovery) — without this the fs.watch handle + double-buffered
            // transcript lingered until the 10-min idle sweep.
            // Workflow launch ack → arm the usage tailer (file-level "wrapper"
            // for in-process workflow agents — see armWorkflowUsageWatcher).
            if (msg.type === 'user' && Array.isArray(msg.message?.content)) {
              try {
                for (const b of msg.message.content) {
                  if (b?.type !== 'tool_result') continue;
                  const txt = typeof b.content === 'string' ? b.content
                    : Array.isArray(b.content) ? b.content.map((x) => x?.text || '').join('\n') : '';
                  const wm = /Run ID: (wf_[\w-]+)/.exec(txt);
                  if (wm) armWorkflowUsageWatcher(session, id, wm[1]);
                }
              } catch { }
            }
            if (msg.type === 'user' && (msg.origin?.kind === 'task-notification' || /^\s*<task-notification>/.test(typeof msg.message?.content === 'string' ? msg.message.content : ''))) {
              const notifText = typeof msg.message?.content === 'string' ? msg.message.content : '';
              const tu = notifText.match(/<tool-use-id>([\s\S]*?)<\/tool-use-id>/);
              if (tu && session.subagentWatchers?.has(tu[1].trim())) {
                stopSubagentWatcher(tu[1].trim());
                gcSubagent(tu[1].trim());
              }
              // Limit banners CARRIED BY workflow/agent failure text (real
              // 2026-08-09 incident: 9 workflow agents died on "You've hit
              // your session limit" — the phrase lives only in the task-
              // notification blob, never as a main-stream assistant banner,
              // so the pool switch waited for full exhaustion).
              const lb = /You've (?:reached|hit) your .{0,40}? ?limit/i.exec(notifText.slice(0, 16384));
              if (lb) { global.__vsEvent?.('cli-usage-limit'); markLimitBanner(session, lb[0]); }
            }
            // Inactivity sweep (audit round-3): an agent whose turn was
            // interrupted / whose CLI died NEVER emits task_notification — its
            // fs.watch handle + double-buffered transcript lived for the
            // session's whole (weeks-long) life. At each turn end, tear down
            // watchers idle >10min; genuinely running background agents keep
            // writing JSONL so their lastActivity stays fresh.
            if (msg.type === 'result' && session.subagentWatchers?.size) {
              const now = Date.now();
              for (const [tuid, entry] of [...session.subagentWatchers]) {
                if (now - (entry.lastActivity || 0) > 10 * 60 * 1000) {
                  stopSubagentWatcher(tuid);
                  gcSubagent(tuid);
                }
              }
            }

            // TOOL PROGRESS ≠ SUBAGENT (2.227.7, real report "为什么一个 Bash
            // 卡片里出现了 messages"): newer CLIs stream
            // {type:'tool_progress', tool_use_id, tool_name, parent_tool_use_id,
            // elapsed_time_seconds, heartbeat} for a long-running tool — and it
            // carries parent_tool_use_id, the SAME field subagent messages use.
            // The type-blind branch below then buffered them as subagent
            // messages, spun a sub-normalizer per Bash call, and painted the
            // agent-style "N messages · View Log" line on a Bash card. Route
            // them to their own channel (the elapsed seconds are genuinely
            // useful on a pending card) and never into the subagent path.
            if (msg.type === 'tool_progress') {
              broadcastToSession(session, id, {
                type: 'tool-progress', sessionId: id,
                parentToolUseId: msg.parent_tool_use_id || null,
                toolName: msg.tool_name || null,
                elapsedSeconds: msg.elapsed_time_seconds ?? null,
                heartbeat: !!msg.heartbeat,
              });
            } else if (msg.parent_tool_use_id || msg.isSidechain) {
              const ptuid = msg.parent_tool_use_id;
              if (ptuid) {
                // Mark uuid as emitted (for dedup with JSONL watcher)
                if (msg.uuid) {
                  if (!session.subagentEmittedUuids.has(ptuid)) session.subagentEmittedUuids.set(ptuid, new Set());
                  session.subagentEmittedUuids.get(ptuid).add(msg.uuid);
                }
                // Buffer
                if (!session.subagentBuffers.has(ptuid)) session.subagentBuffers.set(ptuid, []);
                session.subagentBuffers.get(ptuid).push(msg);
              }
              // Broadcast to parent (for tool card status) + normalize for subagent viewers
              broadcastToSession(session, id, { type: 'subagent-message', sessionId: id, parentToolUseId: ptuid, message: msg });
              if (ptuid) {
                if (!session._subNormalizers) session._subNormalizers = new Map();
                if (!session._subNormalizers.has(ptuid)) {
                  const subMM = new MessageManager(`sub-${ptuid}`);
                  subMM.onOp((op) => broadcastToSession(session, id, { type: 'msg', sessionId: `sub-${ptuid}`, ...op }));
                  session._subNormalizers.set(ptuid, subMM);
                }
                session._subNormalizers.get(ptuid).processLive(msg);
              }
              continue;
            }
            // Feed into MessageManager (emits normalized msg ops to all clients)
            if (session._normalizer) session._normalizer.processLive(msg);
          } catch {
            // Non-JSON line (e.g. dtach noise) — send as raw output
            broadcastToSession(session, id, { type: 'output', sessionId: id, data: line + '\n' });
          }
        }
      });
    }
  } else {
    // Terminal mode: raw PTY output.
    // dtach sends the attaching client a clear-screen preamble (\e[H\e[J) as
    // its redraw kickoff. A TUI then repaints fully (SIGWINCH), but a plain
    // SHELL repaints NOTHING — the preamble wiped attached clients live AND
    // poisoned session.buffer's tail, so every later attach rendered BLANK
    // (real report: shell terminals blanked on every server restart / daemon
    // re-exec; probe showed the buffer ending in \e[H\e[J). Strip a LEADING
    // clear burst within 2s of attach — later clears are real program output.
    let attachPreambleUntil = Date.now() + 2000;
    ptyProcess.onData((output) => {
      if (session._reattachAttempts) session._reattachAttempts = 0;
      if (attachPreambleUntil) {
        const inWindow = Date.now() < attachPreambleUntil;
        attachPreambleUntil = 0; // only the FIRST chunk is ever a candidate
        if (inWindow) {
          const stripped = output.replace(/^(?:\x1b\[H|\x1b\[[0-3]?J)+/, '');
          if (!stripped) return; // pure clear preamble — swallow entirely
          output = stripped;
        }
      }
      session.buffer += output;
      if (session.buffer.length > 75000) session.buffer = session.buffer.slice(-50000);
      broadcastToSession(session, id, { type: 'output', sessionId: id, data: output });
    });
  }

  ptyProcess.onExit(() => {
    // Session already torn down (e.g. this is a stale PTY exiting after kill) — nothing to do
    if (!activeSessions.has(id)) return;
    const isCurrent = session.pty === ptyProcess;

    // Detach path: dtach socket still alive → the session survives, only this
    // attach PTY died. Do NOT tear down watchers/normalizer listeners here —
    // the session keeps running and clients stay attached.
    if (cleanupOnExit && session.socketPath && fs.existsSync(session.socketPath)) {
      // Stale PTY (a replacement was already attached, e.g. broken-stdin
      // recovery): must not null the fresh pty or schedule re-attach.
      if (!isCurrent) return;
      session.pty = null;
      // Auto re-attach so the session doesn't become a zombie (LIVE in the
      // sidebar but input-dead). Bounded retries; counter resets on data.
      session._reattachAttempts = (session._reattachAttempts || 0) + 1;
      if (session._reattachAttempts <= 5) {
        setTimeout(() => {
          if (session.pty || !activeSessions.has(id)) return;
          if (!session.socketPath || !fs.existsSync(session.socketPath)) return;
          // repaint: this is a RE-attach — replay the buffer so clients aren't
          // left blank (dtach replays nothing; shells never repaint)
          try { attachToDtach(id, session.socketPath, session, { repaint: true }); } catch {}
        }, 1000 * session._reattachAttempts);
      }
      return;
    }

    // A stale PTY must never tear down a session that has a live replacement
    if (!isCurrent && session.pty) return;

    // Real teardown: clean up subagent file watchers and normalizers
    if (session.subagentWatchers) {
      for (const [, entry] of session.subagentWatchers) {
        if (entry.watcher) entry.watcher.close();
        if (entry.retry) clearTimeout(entry.retry);
      }
      session.subagentWatchers.clear();
    }
    if (session._subNormalizers) { session._subNormalizers.clear(); }
    if (session._normalizer) { session._normalizer.listeners.length = 0; }
    if (session._interruptTimer) { clearTimeout(session._interruptTimer); session._interruptTimer = null; }
    session._isStreaming = false;
    // Child exit code from the wrapper's final meta (2.207.0 — wrappers keep
    // it instead of unlinking; a crash-looping claude previously left zero
    // process-level evidence).
    let childCode = null;
    try { childCode = JSON.parse(fs.readFileSync(path.join(BUFFERS_DIR, id + '.json'), 'utf-8')).childExitCode ?? null; } catch {}
    // CLI-death classifier (2.226.0, user directive "不要静默失败"): known
    // canned errors become a machine reason + the matched line, which rides
    // the `exited` broadcast so the window shows WHY it died (read-only bar /
    // exited overlay) and lands as a telemetry event the admin collector
    // groups fleet-wide. TAIL-scan only — the buffer rotates and an old error
    // hours back must not label a normal exit.
    const death = classifyCliDeath((session.buffer || '').slice(-4096), childCode);
    const exitReason = death?.reason;
    // Unresumable-conversation stamp (2.207.1): the CLI's canned error means
    // the transcript does not exist on this session's machine — arm the
    // create-side circuit breaker so retries get an explanation, not a loop.
    // Tested INDEPENDENTLY of the classifier's first-match precedence (review
    // finding: another pattern winning must not skip arming the breaker).
    if (exitReason === 'no_conversation' || /No conversation found with session ID/.test((session.buffer || '').slice(-4096))) {
      const cid = session.claudeSessionId || session.backendSessionId;
      if (cid) {
        noConvoRef.map.set(cid, Date.now());
        if (noConvoRef.map.size > 100) noConvoRef.map.delete(noConvoRef.map.keys().next().value);
        console.warn(`[session] unresumable conversation ${cid} — transcript missing on its machine; resumes blocked 10min`);
      }
    }
    if (death) global.__vsEvent?.('cli-death', `${session.backend || 'claude'}/${death.reason}`);
    // Lifecycle line for the ops log (2.206.0) — tonight's black-window
    // forensics found NOTHING in opslog about session deaths; this is the
    // minimum breadcrumb an incident needs.
    console.log(`[session] exited ${id} "${session.name || ''}" mode=${session.mode} backend=${session.backend || 'claude'}${childCode != null ? ' code=' + childCode : ''}${exitReason ? ' reason=' + exitReason : ''}`);
    global.__vsEvent?.('session-exited', `${session.mode}/${session.backend || 'claude'}${childCode != null ? '/code=' + childCode : ''}${exitReason ? '/' + exitReason : ''}`);
    broadcastToSession(session, id, { type: 'exited', sessionId: id, reason: exitReason, detail: death?.detail });
    activeSessions.delete(id);
    if (cleanupOnExit && session.sockName) deleteSessionMeta(session.sockName);
    // Buffer + wrapper-meta files are only meaningful while the dtach session
    // lives (restore reads them) — on real teardown they're dead weight that
    // used to accumulate forever (129 files / 28MB observed for 8 live
    // sessions; known-backlog item, fixed 2.81.0).
    // FORENSIC TOMBSTONE (2.206.1): keep the buffer TAIL for a week — a
    // crash's stack trace/stderr lives ONLY in the buffer, and deleting it
    // on exit blinded three "why did this session die" investigations in one
    // night (a claude that crash-looped 4× left zero process-level evidence).
    if (cleanupOnExit) {
      try {
        const bufPath = path.join(BUFFERS_DIR, id + '.buf');
        const st = fs.statSync(bufPath);
        const fd = fs.openSync(bufPath, 'r');
        const take = Math.min(st.size, 65536);
        const tail = Buffer.alloc(take);
        fs.readSync(fd, tail, 0, take, st.size - take);
        fs.closeSync(fd);
        const tombDir = path.join(__dirname, 'data', 'exit-tombs');
        fs.mkdirSync(tombDir, { recursive: true });
        fs.writeFileSync(path.join(tombDir, `${id}.tail`), tail);
        // opportunistic sweep: tombs older than 7 days
        for (const f of fs.readdirSync(tombDir)) {
          try { const s = fs.statSync(path.join(tombDir, f)); if (Date.now() - s.mtimeMs > 7 * 86400e3) fs.unlinkSync(path.join(tombDir, f)); } catch {}
        }
      } catch { /* no buffer / read failed — nothing to keep */ }
      try { fs.unlinkSync(path.join(BUFFERS_DIR, id + '.buf')); } catch {}
      try { fs.unlinkSync(path.join(BUFFERS_DIR, id + '.json')); } catch {}
    }
    broadcastActiveSessions();
  });
}

// Read/write session metadata
function readSessionMeta(sockName) {
  try { return JSON.parse(fs.readFileSync(path.join(META_DIR, sockName + '.json'), 'utf-8')); } catch { return {}; }
}
// Tombstones (2.89.1): teardown deletes the meta, but debounced/straggler
// writers (status flush, todo coalesce, attribution) can fire AFTER the delete
// and resurrect the file from a PARTIAL object — observed as metas with
// sessionId/sockName null, which then confuse the next restore (a real
// restart-data-loss chain). sockNames are unique per spawn, so a deleted one
// is never legitimately written again.
const _metaTombstones = new Map(); // sockName → deletedAt
// COLLISION DETECTOR (a fleet user's 2026-08-11 incident, root-fixed in 2.302.0 —
// this is the belt): a session-meta file belongs to ONE webui session. If a
// write would land on a file already owned by a DIFFERENT session, two
// sessions are sharing a sockName and the identity fields are about to
// cross — that is how a session ended up carrying ANOTHER conversation's
// claudeSessionId (and then resuming the wrong, possibly-live conversation:
// the double-writer hazard, not a cosmetic bug). Never silent.
function sessionMetaOwnerConflict(sockName, meta) {
  try {
    const prev = readSessionMeta(sockName);
    const a = prev && prev.webuiSessionId, b = meta && meta.webuiSessionId;
    if (a && b && a !== b) {
      console.error(`[session] META COLLISION on ${sockName}: owned by ${a}, written by ${b} — two sessions share a socket name (identity fields would cross)`);
      try { global.__vsMetric?.('session-meta-collision', 1); } catch {}
      return true;
    }
  } catch {}
  return false;
}
function writeSessionMeta(sockName, meta) {
  if (_metaTombstones.has(sockName)) return;
  sessionMetaOwnerConflict(sockName, meta);
  // SESSION-BRAIN step 1 (design §session-brain campaign): the buffer's OWNER
  // is EXPLICIT in every session record. Today the server writes
  // data/session-buffers/<id>.buf for every session including remote ones
  // (the relayed stdout) — 'server'. When session.open (R6) moves parsing +
  // buffer ownership device-side, those records say 'device' and the attach
  // path routes by THIS FIELD instead of assuming. Both readers work either
  // way; no behavior changes until a record actually says 'device'.
  if (meta && typeof meta === 'object' && !meta.bufferOwner) meta.bufferOwner = 'server';
  ensureDir(META_DIR);
  // tmp+rename (2.219.0): the most frequently written core store was the only
  // non-atomic one — an OOM kill mid-write left truncated JSON that poisoned
  // the next restore.
  const fp = path.join(META_DIR, sockName + '.json');
  const tmp = fp + '.tmp';
  fs.writeFileSync(tmp, JSON.stringify(meta));
  fs.renameSync(tmp, fp);
  try { recordUsageAttribution(meta); } catch {} // usage-ledger account-by-time
}
function deleteSessionMeta(sockName) {
  _metaTombstones.set(sockName, Date.now());
  if (_metaTombstones.size > 4096) _metaTombstones.delete(_metaTombstones.keys().next().value);
  try { fs.unlinkSync(path.join(META_DIR, sockName + '.json')); } catch {}
}

// Attach a PTY to an existing dtach socket for I/O.
// opts.repaint (the RE-attach path): dtach replays nothing on attach and a
// plain shell never repaints, so after healing the bridge we push the buffer
// FILE tail (clear + replay) to attached clients — a daemon self-upgrade
// re-exec otherwise left visually-blank terminals until a page reload.
function attachToDtach(id, socketPath, session, { repaint = false } = {}) {
  const repaintClients = () => {
    if (!repaint || session.mode === 'chat') return;
    try {
      const buf = fs.readFileSync(path.join(BUFFERS_DIR, id + '.buf'));
      const tail = buf.length > 200000 ? buf.subarray(buf.length - 200000) : buf;
      const data = '\x1b[2J\x1b[3J\x1b[H' + tail.toString('utf-8');
      session.buffer = tail.toString('utf-8').slice(-50000);
      broadcastToSession(session, id, { type: 'output', sessionId: id, data });
    } catch { /* no buffer file — nothing to repaint */ }
  };
  const localAttach = () => {
    const attachPty = pty.spawn(DTACH_CMD, ['-a', socketPath, '-E', '-r', 'winch'], {
      name: 'xterm-256color', cols: 120, rows: 30,
      env: { ...process.env, TERM: 'xterm-256color', COLORTERM: 'truecolor' },
    });
    setupSessionPty(session, id, attachPty);
    repaintClients();
  };
  // M1: daemon owns the pty when enabled — the dtach attach runs INSIDE agentd
  // and relays over the mux. On ANY failure fall back to the local pty so a
  // daemon hiccup never loses a session.
  if (deviceMgr && !session.host) {
    deviceMgr.openSession({ cmd: DTACH_CMD, args: ['-a', socketPath, '-E', '-r', 'winch'], cols: 120, rows: 30 })
      .then((h) => { setupSessionPty(session, id, daemonPtyShim(h)); repaintClients(); })
      .catch((e) => { console.warn('[device] session attach failed — local pty fallback:', e.message); localAttach(); });
    return;
  }
  localAttach();
}

// On startup, reconnect to existing dtach sockets
// ── Personalized-username migration self-heal (2.236.1, userW's real
// incident): the 3.5.0 image renames the container user vibe→<name> and
// symlinks /home/vibe → /home/<name>, which covers every recorded ABSOLUTE
// path — but claude encodes its per-project transcript dirs from the
// RESOLVED cwd, so pre-migration transcripts live under
// projects/-home-vibe-* while post-migration resumes look in
// -home-<name>-* → "No conversation found with session ID". Heal at boot:
// rename each -home-vibe-* dir to the new encoding and leave the old name
// as a symlink (VibeSpace's own cwdToProjectDir over recorded /home/vibe
// cwds keeps working through it). Idempotent; collisions skipped with a log.
function migrateLegacyHomeProjects() {
  try {
    const home = os.homedir();
    if (path.basename(home) === 'vibe') return;
    let st; try { st = fs.lstatSync('/home/vibe'); } catch { return; }
    if (!st.isSymbolicLink()) return;
    const projectsDir = path.join(home, '.claude', 'projects');
    const newPrefix = cwdToProjectDir(home); // e.g. -home-userW
    let names; try { names = fs.readdirSync(projectsDir); } catch { return; }
    let n = 0;
    for (const d of names) {
      if (!d.startsWith('-home-vibe-')) continue;
      const full = path.join(projectsDir, d);
      let ds; try { ds = fs.lstatSync(full); } catch { continue; }
      if (!ds.isDirectory()) continue; // already a symlink from a prior run
      const target = newPrefix + '-' + d.slice('-home-vibe-'.length);
      const targetFull = path.join(projectsDir, target);
      if (fs.existsSync(targetFull)) { console.warn(`[migrate] projects collision, left in place: ${d}`); continue; }
      try {
        fs.renameSync(full, targetFull);
        fs.symlinkSync(target, full);
        n++;
      } catch (e) { console.warn(`[migrate] projects rename failed for ${d}: ${e.message}`); }
    }
    if (n) console.log(`[migrate] personalized-username: re-encoded ${n} claude project dir(s) -home-vibe-* -> ${newPrefix}-* (old names symlinked)`);
  } catch (e) { console.warn('[migrate] legacy home projects check failed:', e.message); }
}

function restoreSessions() {
  ensureDir(SOCKETS_DIR);
  ensureDir(BUFFERS_DIR);
  const sockets = fs.readdirSync(SOCKETS_DIR).filter(f => f.startsWith('cw-'));
  if (!sockets.length) return;

  console.log(`  Found ${sockets.length} existing session(s), reconnecting...`);
  // Dial-session bridges live in THIS process — recreate them on the SAME
  // recorded port so the surviving wrapper's attach reconnect lands (the
  // host-mounts tunnel re-own pattern). Must happen before wrappers retry.
  for (const sockFile of sockets) {
    try {
      // Metas are keyed by the FULL sockName (cw-N-TS) — the old cw-stripped
      // read NEVER matched, so no dial bridge was ever restored and every
      // dial session died on any server restart (2.219.0 audit CRITICAL;
      // wrapper reconnected forever against the dead port). Bridge keyed by
      // the recorded webui id so kill's dialBridge.close(sessionId) finds it.
      const m = readSessionMeta(sockFile) || {};
      if (m.dialDeviceId && m.bridgePort) {
        dialBridge.ensure({ sid: m.webuiSessionId || sockFile, deviceId: m.dialDeviceId, port: m.bridgePort })
          .catch((e) => console.warn('[dial-bridge] restore failed:', e.message));
      }
    } catch { }
  }
  // Dedup by conversation BEFORE adoption: a plain `claude --resume` reuses the
  // conversation id, so a resume of a session whose claude had already died
  // minted a SECOND dtach session for the SAME claudeSessionId → two sidebar
  // cards (real owner report; userW's local double-writer class). Keep one
  // socket per conversation (alive-claude > dead, then newest), retire the rest.
  const dedupMetas = [];
  for (const sockFile of sockets) {
    let m; try { m = readSessionMeta(sockFile); } catch { continue; }
    if (m && m.claudeSessionId) dedupMetas.push({ sockFile, m });
  }
  // ONE /proc pass: which conversations have a live claude holding their JSONL?
  // (a lingering dtach husk whose claude crashed has a DEAD conversation and
  // must lose to a live one). Cheap alternation grep over all readlinks.
  let liveConvos = new Set();
  if (dedupMetas.length) {
    try {
      const pat = dedupMetas.map(({ m }) => m.claudeSessionId).join('\\|');
      const out = execFileSync('sh', ['-c', `for p in /proc/[0-9]*/fd/*; do readlink "$p" 2>/dev/null; done | grep -o '[0-9a-f-]*\\.jsonl' | grep -o '${pat}'`], { encoding: 'utf-8', timeout: 6000 });
      liveConvos = new Set(out.split('\n').map((s) => s.trim()).filter(Boolean));
    } catch {} // grep exits 1 when nothing matched — leaves the set empty
  }
  // REMOTE sockets: the /proc scan can't see a claude running ON THE HOST, so
  // claudeAlive was unconditionally false and duplicate sockets of one remote
  // conversation could retire the wrong one (audit 2.192.0/B-82ea). Substitute
  // the LOCAL transport liveness (dtach socket has an owner = the ssh/agentd
  // pipe survived the restart) — the same signal the adoption loop uses below.
  const remoteSockAlive = new Set();
  for (const { sockFile, m } of dedupMetas) {
    if (!m.host) continue;
    try {
      const out = execFileSync('fuser', [path.join(SOCKETS_DIR, sockFile)], { encoding: 'utf-8', timeout: 2000, stdio: ['pipe', 'pipe', 'pipe'] });
      if (out.trim().length > 0) remoteSockAlive.add(sockFile);
    } catch {}
  }
  const { retire: retireSockets } = dedupWebuiSockets(dedupMetas.map(({ sockFile, m }) => ({
    sockFile, backend: m.backend || 'claude', host: m.host || 'local',
    claudeSessionId: m.claudeSessionId, createdAt: m.createdAt || 0,
    claudeAlive: m.host ? remoteSockAlive.has(sockFile) : liveConvos.has(m.claudeSessionId),
  })));

  for (const sockFile of sockets) {
    const socketPath = path.join(SOCKETS_DIR, sockFile);
    try { fs.statSync(socketPath); } catch { continue; }

    // Verify socket is live — check if any process owns it
    let socketAlive = false;
    try {
      const out = execFileSync('fuser', [socketPath], { encoding: 'utf-8', timeout: 2000, stdio: ['pipe', 'pipe', 'pipe'] });
      socketAlive = out.trim().length > 0;
    } catch {
      // fuser returns non-zero if no process found, also try pgrep
      try {
        execFileSync('pgrep', ['-f', socketPath], { encoding: 'utf-8', timeout: 2000 });
        socketAlive = true;
      } catch { socketAlive = false; }
    }

    if (!socketAlive) {
      console.log(`  ✗ Dead socket: ${sockFile} — cleaning up`);
      try { fs.unlinkSync(socketPath); } catch {}
      // B-1525 (2.219.0): a REMOTE session's meta holds the ONLY local record
      // of its keeper sid / dial device — the remote half (keeper daemon,
      // device pipe session) survives a pod-level death, and deleting the
      // meta here orphaned it forever (userL's h200 keeper claudes needed
      // manual surgery). Keep those metas tagged orphanedAt for re-adopt
      // (resume host-inference + findKeeperFor consume them); local-only
      // sessions keep the old cleanup.
      try {
        const dm = readSessionMeta(sockFile) || {};
        if ((dm.host || dm.dialDeviceId) && !dm.orphanedAt) {
          writeSessionMeta(sockFile.replace(/\.orphan$/, ''), { ...dm, orphanedAt: Date.now() });
          const op = path.join(META_DIR, sockFile + '.json');
          fs.renameSync(op, op + '.orphan');
          console.log(`    ↳ remote session meta preserved as orphan (${dm.keeperSid || dm.dialDeviceId || dm.host})`);
          continue;
        }
      } catch { }
      deleteSessionMeta(sockFile);
      continue;
    }

    const meta = readSessionMeta(sockFile);
    const id = meta.webuiSessionId || ('sess-' + (++sessionCounterRef.value) + '-' + Date.now());

    // stale duplicate of a conversation another socket owns — do NOT adopt (two
    // cards); retire the husk so it can't double-write the JSONL. SIGTERM the
    // socket's dtach session (claude, if any, is the older/losing writer) then
    // clean socket + buffer + meta.
    if (retireSockets.has(sockFile)) {
      console.log(`  ⤫ Duplicate of ${meta.claudeSessionId} — retiring stale ${sockFile}`);
      try {
        for (const p of execFileSync('pgrep', ['-f', socketPath], { encoding: 'utf-8', timeout: 2000 }).split('\n')) {
          const pid = Number(p.trim());
          if (pid > 1 && pid !== process.pid) { try { process.kill(pid, 'SIGTERM'); } catch {} }
        }
      } catch {}
      try { fs.unlinkSync(socketPath); } catch {}
      try { fs.unlinkSync(path.join(BUFFERS_DIR, id + '.buf')); } catch {}
      try { fs.unlinkSync(path.join(BUFFERS_DIR, id + '.json')); } catch {}
      deleteSessionMeta(sockFile);
      continue;
    }

    // Detect mode and streaming state from wrapper metadata
    let sessionMode = meta.mode || 'terminal';
    let wrapperStreaming = false;
    let wrapperGoal = null, wrapperGoalStatus = null, wrapperGoalElapsed = 0, wrapperGoalTokens = 0;
    let bareRemote = false;
    let restoredRemote = null;
    let wrapperAgentTasks = null;
    try {
      const wrapperMeta = JSON.parse(fs.readFileSync(path.join(BUFFERS_DIR, id + '.json'), 'utf-8'));
      if (wrapperMeta.mode === 'chat') sessionMode = 'chat';
      if (wrapperMeta.streaming != null) wrapperStreaming = !!wrapperMeta.streaming;
      if (wrapperMeta.goal) { wrapperGoal = wrapperMeta.goal; wrapperGoalStatus = wrapperMeta.goalStatus || null; wrapperGoalElapsed = wrapperMeta.goalElapsed || 0; wrapperGoalTokens = wrapperMeta.goalTokensUsed || 0; }
      // Agent's live todo list survives the restart (2.219.0 audit — the
      // card's progress pill/Steps went blank until the next TodoWrite)
      if (Array.isArray(wrapperMeta.todos) && wrapperMeta.todos.length) {
        const done = wrapperMeta.todos.filter((t) => t?.status === 'completed').length;
        const cur = wrapperMeta.todos.find((t) => t?.status === 'in_progress');
        var wrapperTodos = { done, total: wrapperMeta.todos.length, current: cur ? String(cur.content || cur.activeForm || cur.step || '').slice(0, 140) : null };
      }
      // Agents still RUNNING per the wrapper's task map (chat-wrapper keeps
      // them until task_notification) need their JSONL watchers re-armed —
      // startSubagentWatcher's only other call site is the live task_started
      // parse, so an agent spanning the restart went monitoring-dark (frozen
      // tool card, empty live View Log) until it completed.
      if (sessionMode === 'chat' && wrapperMeta.tasks) {
        const running = Object.entries(wrapperMeta.tasks)
          .filter(([, t]) => t && t.type === 'agent' && t.status === 'running' && t.id)
          .map(([tuid, t]) => ({ tuid, agentId: t.id }));
        if (running.length) wrapperAgentTasks = running;
      }
      // B-0845: a REMOTE chat session restored WITHOUT the wrapper's remote
      // field predates the keeper (2.124.0) — claude hangs bare off the ssh
      // pipe and one network wobble kills the conversation. Surface it.
      if (meta.host && sessionMode === 'chat' && !wrapperMeta.remote) bareRemote = true;
      if (wrapperMeta.remote && wrapperMeta.remote.state && wrapperMeta.remote.state !== 'connected') {
        restoredRemote = { state: wrapperMeta.remote.state, attempts: wrapperMeta.remote.attempts || 0, at: wrapperMeta.remote.at || Date.now() };
      }
    } catch {}

    let savedBuffer = '';
    try { savedBuffer = fs.readFileSync(path.join(BUFFERS_DIR, id + '.buf'), 'utf-8'); } catch {}

    const session = {
      mode: sessionMode,
      pty: null, clients: new Map(),
      cwd: meta.cwd || os.homedir(),
      host: meta.host || null,
      _bareRemote: bareRemote,
      keeperSid: meta.keeperSid || null,
      _agentdSession: !!meta.agentdSession, // transport mechanism (2.219.0 — kill branch correctness)
      _cwdRecreated: !!meta.cwdRecreated, // B-7812: undelivered recreated-cwd agent notice survives restarts
      _remoteState: restoredRemote,
      _todos: (typeof wrapperTodos !== 'undefined' && wrapperTodos) || null,
      _restoreAgentTasks: wrapperAgentTasks, // re-armed post-attach (setupSessionPty defines the watcher)
      _pendingEditor: meta.pendingEditor || null, // Ctrl+G edit in flight — re-broadcast on attach
      _prevGoal: meta.prevGoal || null, // /goal resume works across restarts
      _forkRequested: !!meta.forkRequested, // pending fork-id adoption survives restart
      _resumeSpawn: !!meta.resumeSpawn, // implicit-fork adoption stays armed across restarts (B-b87b)
      _sawFirstId: !!meta.sawFirstId,
      _dialDeviceId: meta.dialDeviceId || null,
      _bridgePort: meta.bridgePort || null,
      _dialReversePort: meta.dialReversePort || null, // VIBESPACE_API back-tunnel, re-owned at the next dial-in (audit #49)
      hostName: meta.hostName || null,
      name: meta.name || sockFile,
      createdAt: meta.createdAt || Date.now(),
      backend: meta.backend || 'claude',
      backendSessionId: meta.backendSessionId || meta.claudeSessionId || null,
      claudeSessionId: meta.claudeSessionId || null,
      sourceKind: meta.sourceKind || null,
      agentKind: meta.agentKind || 'primary',
      agentRole: meta.agentRole || '',
      agentNickname: meta.agentNickname || '',
      parentThreadId: meta.parentThreadId || null,
      forkedFrom: meta.forkedFrom || null,
      // Permission mode isn't recoverable from the JSONL (init records are
      // stdout-only) — restore what the session was launched with
      _permissionMode: meta.permissionMode || null,
      _effort: meta.effort || null,
      _modelLocked: !!meta.modelLocked,
      _lockedModel: meta.lockedModel || null,
      agentToken: meta.agentToken || null, // vibespace-status auth survives restarts
      _initialGroupId: meta.taskId || null, // group spawned into; belonging is live-derived, this only covers the pre-bind window
      _accountId: meta.accountId || null, // billing identity the session was spawned with (badge only — env lives in the surviving dtach process)
      _authAtSpawn: meta.authAtSpawn || null,
      _apiKeySource: meta.apiKeySource || null, // CLI-confirmed auth (init record); backfilled from the buffer below when absent
      sockName: sockFile,
      socketPath,
      buffer: savedBuffer,
      _isStreaming: wrapperStreaming,
      _goal: wrapperGoal,
      _goalStatus: wrapperGoalStatus,
      _goalElapsed: wrapperGoalElapsed,
      _goalTokensUsed: wrapperGoalTokens,
    };
    // Create normalizer for chat sessions (populated on first attach from JSONL + buffer)
    if (sessionMode === 'chat') {
      session._normalizer = createMessageManager(session.backend || 'claude', id);
      session._normEpoch = Date.now();
      session._normalizer.onOp((op) => {
        try { if (session.host && session.keeperSid) sbNoteServerOp(session.host, session.keeperSid, op); } catch { } // step-2 dark tap (the daemon streams by ITS sid = keeperSid)
        broadcastToSession(session, id, { type: 'msg', sessionId: id, ...op });
      });
    }
    activeSessions.set(id, session);
    session._webuiId = id; // per-session pool link key (plan C) — the id the session is registered under
    session._spawnModel = meta.spawnModel || null; session._pickedModel = meta.pickedModel || null; session._pickedModelAt = meta.pickedModelAt || 0; // plan C model ladder survives restarts
    attachToDtach(id, socketPath, session);

    console.log(`  ✓ Reconnected: ${session.name} (${session.cwd})`);
  }

  // Populate webuiPids cache after all sessions are restored
  refreshWebuiPids();

  // Backfill billing identity for sessions restored WITHOUT a recorded
  // apiKeySource (spawned before tracking): chat sessions carry the init
  // record in their buffer (grep the last occurrence — bounded child
  // process, off the boot critical path); terminal sessions get a /proc env
  // probe (env key = definite API). One broadcast when done.
  setTimeout(() => {
    const { execFile } = require('child_process');
    let pending = 0, changed = false;
    const finish = () => { if (--pending === 0 && changed) broadcastActiveSessions(); };
    for (const [id, s] of activeSessions) {
      if (s.backend !== 'claude' || s._apiKeySource) continue;
      const buf = path.join(BUFFERS_DIR, `${id}.buf`);
      pending++;
      execFile('sh', ['-c', `grep -o 'apiKeySource":"[^"]*"' ${JSON.stringify(buf)} 2>/dev/null | tail -1`], { timeout: 20000 }, (err, out) => {
        const m = /apiKeySource":"([^"]*)"/.exec(String(out || ''));
        if (m) {
          s._apiKeySource = m[1];
          if (s.sockName) { try { writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), apiKeySource: m[1] }); } catch { } }
          changed = true;
        } else if (!s._authAtSpawn && s._childPid) {
          // terminal session: env probe (only the env-key case is provable)
          try {
            const env = fs.readFileSync(`/proc/${s._childPid}/environ`, 'utf-8');
            if (env.includes('ANTHROPIC_API_KEY=')) { s._apiKeySource = 'ANTHROPIC_API_KEY'; changed = true; }
          } catch { }
        }
        finish();
      });
    }
    if (!pending) { /* nothing to backfill */ }
  }, 3000);

  // Re-arm live subagent monitoring for agents that span the restart: the
  // wrapper meta's task map (captured into _restoreAgentTasks above) still
  // lists them as running, but startSubagentWatcher's only live call site is
  // the task_started stream parse. The handle lands on the session when
  // setupSessionPty runs — async for agentd-restored sessions, hence the
  // delayed pass + one late retry.
  const rearmSubagentWatchers = (retry) => {
    for (const [, s] of activeSessions) {
      const tasks = s._restoreAgentTasks;
      if (!tasks || !tasks.length) continue;
      if (typeof s._startSubagentWatcher !== 'function') { if (!retry) s._restoreAgentTasks = null; continue; }
      s._restoreAgentTasks = null;
      for (const t of tasks) { try { s._startSubagentWatcher(t.tuid, t.agentId); } catch {} }
    }
  };
  setTimeout(() => rearmSubagentWatchers(true), 5000);
  setTimeout(() => rearmSubagentWatchers(false), 20000);

  // Re-arm the backend-id capture for restored sessions still missing their id
  // (server restarted inside the create-time ~2-17s/60s capture window — those
  // retry chains died with the old process). Claude CHAT self-heals via the
  // stream parser's first-capture on the next line; claude TERMINAL and codex
  // have NO other backfill and stayed id-less for life (sessionKey '' → no
  // status/config/star binding, no transcript link). LOCAL sessions only —
  // scanning the local lock dir for a remote session false-matches (2.156.2).
  // Idempotent: same claimed-id + cwd + startedAt guards as the create chains.
  const recaptureIds = (attempts) => {
    let changed = false, missing = false;
    const claimed = new Set();
    for (const [, s] of activeSessions) { if (s.backend === 'claude' && s.claudeSessionId) claimed.add(s.claudeSessionId); }
    for (const [id, s] of activeSessions) {
      if (s.host) continue;
      if (s.backend === 'claude' && !s.claudeSessionId) {
        try {
          const { SESSIONS_DIR } = require('./src/session-store');
          for (const f of fs.readdirSync(SESSIONS_DIR).filter((n) => n.endsWith('.json'))) {
            const lockData = JSON.parse(fs.readFileSync(path.join(SESSIONS_DIR, f), 'utf-8'));
            if (claimed.has(lockData.sessionId)) continue;
            if (lockData.cwd === s.cwd && lockData.startedAt > s.createdAt - 5000) {
              s.claudeSessionId = lockData.sessionId;
              s.backendSessionId = lockData.sessionId;
              claimed.add(lockData.sessionId);
              if (s.sockName) { try { writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), backendSessionId: s.backendSessionId, claudeSessionId: s.claudeSessionId }); } catch {} }
              changed = true;
              break;
            }
          }
        } catch {}
        if (!s.claudeSessionId) missing = true;
      } else if (s.backend === 'codex' && !s.backendSessionId) {
        try {
          const matched = pickCodexThreadCandidate({ activeSessions, webuiSessionId: id, cwd: s.cwd, createdAt: s.createdAt, baselineThreadIds: null, pathLib: path });
          // no create-time baseline here — refuse clearly-stale threads (the
          // same startedAt window the claude lock guard uses)
          if (matched && (Number(matched.startedAt) || 0) > (s.createdAt || 0) - 5000) {
            s.backendSessionId = matched.backendSessionId || matched.sessionId || null;
            s.claudeSessionId = null;
            if (matched.name) s.name = matched.name;
            if (matched.cwd) s.cwd = matched.cwd;
            if (s.backendSessionId && s.sockName) {
              try { writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), name: s.name, cwd: s.cwd, backendSessionId: s.backendSessionId, claudeSessionId: null }); } catch {}
              changed = true;
            }
          }
        } catch {}
        if (!s.backendSessionId) missing = true;
      }
    }
    if (changed) broadcastActiveSessions();
    if (missing && attempts > 1) setTimeout(() => recaptureIds(attempts - 1), 2000);
  };
  setTimeout(() => recaptureIds(5), 4000);

  // Warn about surviving sessions whose CLI is still running in child-session
  // mode (spawned while the server env carried CLAUDE_CODE_CHILD_SESSION —
  // e.g. a pre-fix server restarted from inside a Claude session). Those CLIs
  // keep their poisoned env until recreated: their conversations are NOT being
  // written to any transcript and will be lost on terminate+resume.
  if (process.platform === 'linux') {
    setTimeout(() => {
      const affected = [];
      for (const [id, s] of activeSessions) {
        const pid = s._childPid;
        if (!pid) continue;
        try {
          const env = fs.readFileSync(`/proc/${pid}/environ`, 'utf-8');
          if (env.includes('CLAUDE_CODE_CHILD_SESSION=1')) affected.push(`${s.name} (${s.cwd})`);
        } catch {}
      }
      if (affected.length) {
        console.warn(`[env] ${affected.length} running session(s) were spawned with CLAUDE_CODE_CHILD_SESSION=1 and are NOT persisting transcripts — finish + recreate them to restore persistence:\n  - ${affected.join('\n  - ')}`);
      }
    }, 3000); // after refreshWebuiPids has populated _childPid
  }
}

// ── R6: boot RE-OPEN of local daemon PIPE sessions (agentdPipe metas) ────────
// These sessions have NO dtach socket — the daemon supervises the wrapper and
// survives server restarts by itself. Restore = re-open the pipe by sid with
// the daemon's offset-reattach; failure leaves the meta for the view-only
// rescue (never deletes — the transcript is intact either way).
function restoreAgentdPipeSessions() {
  let metas = [];
  try { metas = fs.readdirSync(META_DIR).filter((f) => f.endsWith('.json')); } catch { return; }
  for (const mf of metas) {
    let meta = null; try { meta = JSON.parse(fs.readFileSync(path.join(META_DIR, mf), 'utf-8')); } catch { continue; }
    if (!meta?.agentdPipe) continue;
    const sockFile = mf.slice(0, -5);
    const id = 'sess-' + sockFile.replace(/^cw-/, '');
    if (activeSessions.has(id)) continue;
    const session = {
      mode: 'chat', backend: meta.backend || 'claude', cwd: meta.cwd || os.homedir(),
      name: meta.name || 'Session', createdAt: meta.createdAt || Date.now(), sockName: sockFile,
      clients: new Map(), buffer: '', agentToken: meta.agentToken || null, taskId: meta.taskId || null,
      _accountId: meta.accountId || null, claudeSessionId: meta.claudeSessionId || null,
      backendSessionId: meta.claudeSessionId || meta.backendSessionId || null,
      agentdSession: true, keeperSid: id, agentdPipe: true,
      _permissionMode: meta.permissionMode || null, _effort: meta.effort || null,
      _spawnModel: meta.spawnModel || null, _pickedModel: meta.pickedModel || null, _pickedModelAt: meta.pickedModelAt || 0,
    };
    hosts.device(null).then(async (dm) => {
      let offset = 0;
      try { offset = fs.statSync(path.join(BUFFERS_DIR, id + '.buf')).size; } catch { }
      const h = await dm.openPipeSession({ sid: id, offset });
      const shim = {
        pid: h.pid || -1,
        onData: (cb) => { h.onData = (buf) => cb(buf.toString('utf-8')); },
        onExit: (cb) => { h.onExit = (code) => cb({ exitCode: code ?? 0 }); },
        write: (str) => { try { h.write(str); } catch { } },
        resize: () => { }, kill: () => { try { h.kill(); } catch { } },
      };
      activeSessions.set(id, session);
      session._webuiId = id;
      setupSessionPty(session, id, shim);
      console.log(`[restore] re-opened daemon pipe session ${id} "${session.name}"`);
    }).catch((e) => console.warn(`[restore] daemon pipe session ${id} not re-opened (view-only rescue covers it): ${e.message}`));
  }
}
try { restoreAgentdPipeSessions(); } catch (e) { console.warn('[restore] agentd pipe scan failed:', e.message); }

// ── B-1525 second half: boot AUTO RE-ADOPT of orphaned remote keeper sessions ──
// Pod-level death kills every local dtach; the dead-socket cleanup preserves
// REMOTE sessions' metas as .orphan files. For each orphan whose keeper child
// (the remote claude) is STILL ALIVE on its ssh host, respawn the local
// transport half attached to the SAME keeper sid — the session comes back
// LIVE by itself (the userL manual-surgery class, automated).
// Attach ≠ create, which keeps this spawn MINIMAL and safe:
//  - keeper `run <sid> <offset>` on a LIVE sid only ATTACHES (never spawns a
//    claude) → billing env and tools shipping are irrelevant here;
//  - session.agentToken REUSES the original vsst_ value, so the remote
//    claude's baked env token maps straight onto the re-adopted session;
//  - the remote claude's baked VIBESPACE_API port is read from its
//    /proc/<pid>/environ and the new `ssh -R` binds the SAME port, so the
//    agent tools' back-tunnel heals completely.
async function readoptOrphanKeeperSessions() {
  let files = [];
  try { files = fs.readdirSync(META_DIR).filter((f) => f.endsWith('.json.orphan')); } catch { return; }
  if (!files.length) return;
  const { execFile } = require('child_process');
  const sshOut = (h, script) => new Promise((resolve) => {
    execFile('ssh', [...hosts.sshArgs(h, { multiplex: true }), '--', script],
      { timeout: 15000, maxBuffer: 256 * 1024 }, (err, out) => resolve(err ? null : String(out || '')));
  });
  let adopted = 0;
  for (const f of files) {
    if (adopted >= 8) break; // per-boot cap — a huge orphan pile shouldn't storm hosts
    let meta = null;
    try { meta = JSON.parse(fs.readFileSync(path.join(META_DIR, f), 'utf-8')); } catch { continue; }
    if (!meta?.host || !meta.keeperSid || meta.mode !== 'chat' || (meta.backend || 'claude') !== 'claude') continue;
    const h = hosts.get?.(meta.host);
    if (!h || h.transport === 'dial') continue; // dial pipe re-adopt is a separate path
    // A live session already tracking this conversation wins — never double up
    let dup = false;
    for (const [, s] of activeSessions) {
      if (meta.claudeSessionId && (s.claudeSessionId === meta.claudeSessionId || s.backendSessionId === meta.claudeSessionId)) { dup = true; break; }
    }
    if (dup) continue;
    // Liveness probe: keeper meta → childPid alive → baked VIBESPACE_API port
    const probe = `K="$HOME/.vibespace/run/${meta.keeperSid}.json"; [ -e "$K" ] || exit 3; `
      + `P=$(sed -n 's/.*"childPid":\\([0-9]*\\).*/\\1/p' "$K" | head -1); `
      + `[ -n "$P" ] && kill -0 "$P" 2>/dev/null || exit 4; echo "PID=$P"; `
      + `tr '\\0' '\\n' < /proc/$P/environ 2>/dev/null | grep '^VIBESPACE_API=' | head -1`;
    const out = await sshOut(h, probe);
    if (!out || !out.includes('PID=')) continue; // host down or claude gone — leave the orphan for a later boot
    const rport = Number((/VIBESPACE_API=http:\/\/127\.0\.0\.1:(\d+)/.exec(out) || [])[1]) || null;

    // sockName DERIVED from the id (2.304.0 root fix — one identity, not two;
    // see the ws-handler create path)
    const id = 'sess-' + (++sessionCounterRef.value) + '-' + Date.now();
    const sockName = 'cw-' + id.slice('sess-'.length);
    const socketPath = path.join(SOCKETS_DIR, sockName);
    const bufFile = path.join(BUFFERS_DIR, id + '.buf');
    const metaFileW = path.join(BUFFERS_DIR, id + '.json');
    const inner = `export PATH="$HOME/.vibespace/bin:$HOME/.local/bin:$PATH"; [ -s "$HOME/.nvm/nvm.sh" ] && . "$HOME/.nvm/nvm.sh" >/dev/null 2>&1; `
      + `exec node "$HOME/.vibespace/bin/vibespace-remote-keeper" run ${meta.keeperSid} __VS_OFFSET__`;
    const sshArgs = [...hosts.sshArgs(h, rport ? { reverse: `${rport}:127.0.0.1:${PORT}` } : {}), '-T', '--', inner];
    let ptyProc;
    try {
      ptyProc = pty.spawn(DTACH_CMD, ['-c', socketPath, '-E', '-r', 'none',
        NODE_CMD, CHAT_WRAPPER, bufFile, metaFileW,
        ENV_CMD, `CLAUDE_WEBUI_PORT=${PORT}`, `CLAUDE_WEBUI_SESSION_ID=${id}`,
        `TERM=xterm-256color`, 'ssh', ...sshArgs,
      ], {
        name: 'xterm-256color', cols: 190, rows: 45, cwd: os.homedir(),
        env: { ...process.env, TERM: 'xterm-256color', VIBESPACE_REMOTE_SID: id },
      });
    } catch (e) { console.warn(`[readopt] spawn failed for ${meta.keeperSid}: ${e.message}`); continue; }
    const session = {
      mode: 'chat', pty: null, clients: new Map(),
      cwd: meta.cwd || os.homedir(),
      host: meta.host, hostName: meta.hostName || null,
      keeperSid: meta.keeperSid,
      name: meta.name || 'Session',
      createdAt: meta.createdAt || Date.now(),
      backend: 'claude',
      backendSessionId: meta.claudeSessionId || meta.backendSessionId || null,
      claudeSessionId: meta.claudeSessionId || null,
      agentToken: meta.agentToken || null,
      _accountId: meta.accountId || null,
      _authAtSpawn: meta.authAtSpawn || null,
      _permissionMode: meta.permissionMode || null,
      _effort: meta.effort || null,
      _modelLocked: !!meta.modelLocked,
      _lockedModel: meta.lockedModel || null,
      _initialGroupId: meta.taskId || null,
      _remotePort: rport,
      sockName, socketPath, buffer: '',
    };
    session._normalizer = createMessageManager('claude', id);
    session._normEpoch = Date.now();
    session._normalizer.onOp((op) => broadcastToSession(session, id, { type: 'msg', sessionId: id, ...op }));
    activeSessions.set(id, session);
    session._webuiId = id; // per-session pool link key (plan C) — the id the session is registered under
    session._spawnModel = meta.spawnModel || null; session._pickedModel = meta.pickedModel || null; session._pickedModelAt = meta.pickedModelAt || 0; // plan C model ladder survives restarts
    setupSessionPty(session, id, ptyProc);
    writeSessionMeta(sockName, { ...meta, orphanedAt: undefined, readoptedAt: Date.now(), webuiSessionId: id, mode: 'chat' });
    try { fs.unlinkSync(path.join(META_DIR, f)); } catch { }
    adopted++;
    console.log(`[readopt] re-adopted orphan keeper session ${meta.keeperSid} (${(meta.claudeSessionId || '').slice(0, 8)}) on ${h.name || meta.host} → ${id}${rport ? ` (tools tunnel :${rport} revived)` : ''}`);
    await new Promise((r) => setTimeout(r, 500));
  }
  if (adopted) { refreshWebuiPids(); broadcastActiveSessions(); }
}

// ── Create editor helper script ──
// Communicates via HTTP (not terminal output) so Claude Code treats it as a GUI editor
// and does NOT clear the screen. The server broadcasts via WebSocket to the client.
// Claude Code checks if EDITOR is in a hardcoded set of GUI editor names:
// ["code","cursor","windsurf","codium"] — if it is, it does NOT clear the screen.
// So we create a fake "code" wrapper script and set EDITOR to its path.
// This tricks Claude Code into treating our editor as a GUI editor.
// The tools dir (agent CLIs, PATH-prepended into sessions) and the editor
// helper are SEPARATE dirs since B-b87b: the fake `code` on the session PATH
// shadowed a real VS Code `code` binary for every local shell/claude/codex
// terminal (a `code file.txt` hung forever waiting for the Ctrl+G signal).
// EDITOR= stays the absolute path, so Ctrl+G is unaffected; only PATH
// resolution loses the fake. (Remote already ships it to ~/.vibespace/editor.)
const AGENT_BIN_DIR = path.join(__dirname, 'data', 'bin');
const EDITOR_DIR = path.join(AGENT_BIN_DIR, 'editor');
const EDITOR_CMD = path.join(EDITOR_DIR, 'code'); // named "code" to match GUI editor check

function createEditorHelper() {
  ensureDir(EDITOR_DIR);
  // The script: "code -w <file>" is how Claude Code invokes it.
  // -w (--wait) flag is passed by Claude Code for known GUI editors.
  // We accept all flags, extract the filename, notify server via HTTP, and wait.
  const script = `#!/bin/bash
# WebUI editor disguised as "code" so Claude Code treats it as GUI (no screen clear).
# Parse args: skip flags, last arg is the file
FILE="\${@: -1}"
SIGNAL="/tmp/claude-webui-edit-signal-\$\$"
PORT="\${CLAUDE_WEBUI_PORT:-${PORT}}"
SESS="\${CLAUDE_WEBUI_SESSION_ID}"
curl -sf -X POST "http://localhost:\${PORT}/api/editor/open" \\
  -H "Content-Type: application/json" \\
  -H "Authorization: Bearer \${VIBESPACE_SESSION_TOKEN}" \\
  -d "{\\"file\\":\\"\$FILE\\",\\"signal\\":\\"\$SIGNAL\\",\\"sessionId\\":\\"\$SESS\\"}" >/dev/null 2>&1 &
while [ ! -f "\$SIGNAL" ]; do sleep 0.2; done
rm -f "\$SIGNAL"
`;
  fs.writeFileSync(EDITOR_CMD, script, { mode: 0o755 });
  // pre-B-b87b installs left the fake at data/bin/code — still on the session
  // PATH; remove it or the shadow survives the move
  try { fs.unlinkSync(path.join(AGENT_BIN_DIR, 'code')); } catch {}
}
createEditorHelper();

// vibespace-status — the agent-facing status tool (session-status feature).
// Spawned sessions get data/bin on PATH + VIBESPACE_API/VIBESPACE_SESSION_TOKEN
// in env, so an agent can run e.g. `vibespace-status blocked --urgency high
// --reason "waiting for DB credentials"` from its ordinary shell tool.
const STATUS_CMD = path.join(AGENT_BIN_DIR, 'vibespace-status');
function createStatusHelper() {
  ensureDir(AGENT_BIN_DIR);
  const script = `#!/usr/bin/env node
// vibespace-status — report THIS session's own state to the VibeSpace board.
// (For the whole task's status, use vibespace-task status instead.) Run with
// NO arguments to print usage AND the current state. The user sees this on your
// session card and may adjust it; if they do, you'll be told on their next turn.
const api = process.env.VIBESPACE_API;
const token = process.env.VIBESPACE_SESSION_TOKEN;
if (!api || !token) { console.error('vibespace-status: not running inside a VibeSpace session (missing env)'); process.exit(2); }
const args = process.argv.slice(2);
if (args[0] === 'set') args.shift(); // tolerated alias: "vibespace-status set working" — agents guess it
const cmd = args[0];
const opt = (name) => { const i = args.indexOf('--' + name); return i >= 0 ? args[i + 1] : undefined; };
const STATES = ['working', 'needs-input', 'blocked', 'review', 'done'];
const USAGE = [
  'usage — report THIS Task\\'s (this session\\'s) own state; done = this work is finished:',
  '  vibespace-status <working|needs-input|blocked|review|done> ["why"] [--urgency low|normal|high|urgent] [--reason "one-line why"] [--detail "full context"]',
  '  vibespace-status clear      remove the indicator',
  '  vibespace-status show       print the current indicator',
  '',
  'The user reads this on the board — keep it honest and current. blocked/needs-input/review REQUIRE',
  '--reason (one line) + --detail (full context). Set them the MOMENT you are stuck or waiting;',
  'done when finished.',
  'If you are waiting on the user, ALSO ask in chat + file it with vibespace-ask (both).',
].join('\\n');
async function post(body) {
  const res = await fetch(api + '/api/agent/session-status', { method: 'POST', headers: { 'Content-Type': 'application/json', Authorization: 'Bearer ' + token }, body: JSON.stringify(body) });
  const data = await res.json().catch(() => ({}));
  if (!res.ok) { console.error('vibespace-status:', data.error || res.status); process.exit(1); }
  return data;
}
function printStatus(data) {
  const s = data.status;
  console.log(s ? \`state=\${s.state || 'unset'} urgency=\${s.urgency || 'unset'}\${s.reason ? ' reason=' + JSON.stringify(s.reason) : ''} (set by \${s.setBy})\` : 'no status set');
  if (s && s.detail) console.log('  detail: ' + s.detail);
}
async function main() {
  if (cmd === '--help' || cmd === '-h') { console.log(USAGE); return; }
  if (!cmd) { console.log(USAGE); console.log(''); try { printStatus(await post({ show: true })); } catch {} return; }
  if (cmd === 'show') { printStatus(await post({ show: true })); return; }
  if (cmd === 'clear') { await post({ clear: true }); console.log('status cleared'); return; }
  if (!STATES.includes(cmd)) {
    console.error('vibespace-status: unknown state "' + cmd + '"\\n  valid states: ' + STATES.join('/') + '\\n' + USAGE);
    process.exit(1);
  }
  // A bare quoted string after the state is a reason too — agents pass it
  // positionally at least as often as via --reason; dropping it silently
  // meant boards showed states with no explanation.
  const posReason = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
  const reasonVal = opt('reason') ?? posReason;
  const detailVal = opt('detail');
  if (['blocked', 'needs-input', 'review'].includes(cmd) && (!(reasonVal || '').trim() || !(detailVal || '').trim())) {
    // A same-state record that already carries BOTH may be tweaked
    // (e.g. bumping --urgency) without re-sending them — check before failing.
    let existing = null;
    try { existing = (await post({ show: true })).status; } catch {}
    if (!(existing && existing.state === cmd && (existing.reason || '').trim() && (existing.detail || '').trim())) {
      console.error('vibespace-status: "' + cmd + '" needs BOTH --reason (one line) AND --detail (full context).');
      console.error('  e.g. vibespace-status ' + cmd + ' --reason "waiting for the S3 credentials" --detail "Deploy needs the bucket keys; checked .env and the mounts config, not there. Recommend pasting them in chat." --urgency high');
      console.error('  (then say it in your chat reply and mirror it with: vibespace-ask "...")');
      process.exit(1);
    }
  }
  await post({ state: cmd, urgency: opt('urgency'), reason: reasonVal, detail: detailVal });
  console.log('status set: ' + cmd + (opt('urgency') ? ' / ' + opt('urgency') : ''));
  if (cmd === 'blocked' || cmd === 'needs-input' || cmd === 'review') {
    console.log('REMINDER: you are waiting on the user — write what you need (with your recommendation) in your CHAT REPLY now, and mirror it with: vibespace-ask "..."');
  }
}
main().catch((e) => { console.error('vibespace-status:', e.message); process.exit(1); });
`;
  fs.writeFileSync(STATUS_CMD, script, { mode: 0o755 });
}
createStatusHelper();

// vibespace-usage — PASSIVE subscription-usage capture (statusLine hook). It's a
// STATIC tracked file (data/bin/vibespace-usage), not generated — just make sure
// it's present + executable and the cache dir exists. See §ban-safety: this
// replaces all background /api/oauth/usage polling with a zero-API-call source.
const USAGE_STATUSLINE_CMD = path.join(AGENT_BIN_DIR, 'vibespace-usage');
try { ensureDir(USAGE_CACHE_DIR); } catch {}
try { if (fs.existsSync(USAGE_STATUSLINE_CMD)) fs.chmodSync(USAGE_STATUSLINE_CMD, 0o755); } catch {}
// The user's OWN statusLine command (from ~/.claude/settings.json), so injected
// VibeSpace terminal sessions render it transparently (pass-through) instead of
// replacing it. Read fresh each spawn — cheap, and the user may change it.
function userStatuslineCmd() {
  try {
    const s = JSON.parse(fs.readFileSync(path.join(os.homedir(), '.claude', 'settings.json'), 'utf-8'));
    const sl = s && s.statusLine;
    if (sl && sl.type === 'command' && typeof sl.command === 'string' && sl.command.trim()) return sl.command;
  } catch {}
  return '';
}

// vibespace-hook — dual-harness SessionStart hook (task context injection, P2).
// Registered in ~/.claude/settings.json AND ~/.codex/hooks.json (same schema,
// proven by the org's claude-task-tracker plugin). GATED on env: sessions not
// spawned by VibeSpace with a task have no VIBESPACE_TASK_ID → instant no-op,
// so global registration never affects other sessions. Output contract copied
// from the live-verified plugin: top-level {additionalContext} JSON on stdout.
const HOOK_CMD = path.join(AGENT_BIN_DIR, 'vibespace-hook.mjs');
function createHookHelper() {
  ensureDir(AGENT_BIN_DIR);
  const script = `#!/usr/bin/env node
// vibespace-hook — delivers VibeSpace task context through the harness's OWN
// native hooks (never by rewriting the user's message):
//   SessionStart     → the task's context (goal, plan, files, rules)
//   UserPromptSubmit → any pending status-override notice for this session
// No-op unless the session was spawned by VibeSpace (VIBESPACE_* env present).
let buf = '';
let ran = false;
async function run(input) {
  if (ran) return;
  ran = true;
  try {
    const event = input.hook_event_name;
    const api = process.env.VIBESPACE_API;
    const token = process.env.VIBESPACE_SESSION_TOKEN;
    if (!api || !token) return process.exit(0);
    let path;
    if (event === 'SessionStart') {
      // Which Task Group(s) this session belongs to is resolved SERVER-SIDE from
      // the token (live-derived — explicit tag / auto-include folder / spawned-
      // into group), so the hook passes no id. With groups it returns their
      // shared context; with none, the baseline VibeSpace tools intro (so every
      // session still learns to report its status).
      path = '/api/agent/task-context';
    } else if (event === 'UserPromptSubmit') {
      path = '/api/agent/prompt-context';
    } else if (event === 'Stop') {
      // Bookkeeping nudge with teeth: the SERVER decides (status freshness +
      // 30min cooldown) whether the agent must update its board before this
      // stop sticks. stop_hook_active = we already nudged — never loop.
      if (input.stop_hook_active) return process.exit(0);
      const c2 = new AbortController();
      const t2 = setTimeout(() => c2.abort(), 2500);
      const r = await fetch(api + '/api/agent/stop-check', { headers: { Authorization: 'Bearer ' + token }, signal: c2.signal });
      clearTimeout(t2);
      if (r.ok) {
        const d = await r.json();
        if (d && d.block && d.reason) process.stdout.write(JSON.stringify({ decision: 'block', reason: d.reason }));
      }
      return process.exit(0);
    } else {
      return process.exit(0);
    }
    const ctl = new AbortController();
    const timer = setTimeout(() => ctl.abort(), 3000);
    const res = await fetch(api + path, { headers: { Authorization: 'Bearer ' + token }, signal: ctl.signal });
    clearTimeout(timer);
    if (res.ok) {
      const data = await res.json();
      if (data && data.context) {
        // BOTH harnesses read the NESTED hookSpecificOutput.additionalContext
        // (verified against the Claude 2.1.201 binary — it suggests "Did you
        // mean hookSpecificOutput" — and the Codex *HookSpecificOutputWire
        // JSON schema). Emit ONLY that: Codex's output schema is strict
        // (additionalProperties:false), so an extra top-level additionalContext
        // key makes Codex reject the whole object and inject nothing.
        process.stdout.write(JSON.stringify({
          hookSpecificOutput: { hookEventName: event, additionalContext: data.context },
        }));
      }
    }
  } catch { }
  process.exit(0);
}
process.stdin.setEncoding('utf-8');
process.stdin.on('data', (c) => { buf += c; try { run(JSON.parse(buf)); } catch { } });
process.stdin.on('end', () => { try { run(JSON.parse(buf)); } catch { } if (!ran) process.exit(0); });
setTimeout(() => process.exit(0), 8000); // never hang a session start
`;
  fs.writeFileSync(HOOK_CMD, script, { mode: 0o755 });

  // Remote-side registration script (P3): distributed to remote hosts alongside
  // the hook so a REMOTE session's own Claude/Codex fires the hook natively
  // (our LOCAL registration can't reach the remote box). Self-locating: it
  // registers `node <its own dir>/vibespace-hook.mjs`. Same non-destructive
  // logic as ensureAgentHooks; best-effort (a failure just means no injection).
  // `--uninstall` (2.129.0, Manage Agents remote Remove) strips ONLY our entry
  // from the remote configs — mirror of the local removeAgentHooks.
  const reg = `#!/usr/bin/env node
import { readFileSync, writeFileSync, renameSync, existsSync } from 'fs';
import { join, dirname } from 'path';
import { homedir } from 'os';
import { fileURLToPath } from 'url';
const UNINSTALL = process.argv.includes('--uninstall');
// ABSOLUTE interpreter (2.244.2, userN's Novita: hook error '/bin/sh: 1:
// node: not found'): hooks run as claude children via /bin/sh with claude's
// PATH — hosts with nvm-style node installs (and claude as a native binary)
// have NO node on that PATH. The register itself runs under node, so its own
// process.execPath is an interpreter that provably exists on this machine.
const hookCmd = JSON.stringify(process.execPath) + ' ' + join(dirname(fileURLToPath(import.meta.url)), 'vibespace-hook.mjs');
const files = [
  { f: join(homedir(), '.claude', 'settings.json'), create: false, EVENTS: ['SessionStart', 'UserPromptSubmit', 'Stop'] },
  { f: join(homedir(), '.codex', 'hooks.json'), create: true, EVENTS: ['SessionStart', 'UserPromptSubmit'] },
];
const findOur = (list) => { for (const g of (Array.isArray(list) ? list : [])) { const h = (g.hooks || []).find(h => typeof h.command === 'string' && h.command.includes('vibespace-hook.mjs')); if (h) return h; } return null; };
for (const { f, create, EVENTS } of files) {
  try {
    let root = null; try { root = JSON.parse(readFileSync(f, 'utf-8')); } catch { root = null; }
    if (!root) { if (existsSync(f)) continue; if (UNINSTALL || !create) continue; root = {}; }
    if (!root.hooks || typeof root.hooks !== 'object') { if (UNINSTALL) continue; root.hooks = {}; }
    let changed = false;
    if (UNINSTALL) {
      for (const ev of Object.keys(root.hooks)) {
        if (!Array.isArray(root.hooks[ev])) continue;
        for (const g of root.hooks[ev]) {
          if (!g || !Array.isArray(g.hooks)) continue;
          const before = g.hooks.length;
          g.hooks = g.hooks.filter(h => !(h && typeof h.command === 'string' && h.command.includes('vibespace-hook.mjs')));
          if (g.hooks.length !== before) changed = true;
        }
        root.hooks[ev] = root.hooks[ev].filter(g => g && Array.isArray(g.hooks) && g.hooks.length);
      }
    } else {
      for (const ev of EVENTS) {
        if (!Array.isArray(root.hooks[ev])) root.hooks[ev] = [];
        const ours = findOur(root.hooks[ev]);
        if (ours) { if (ours.command !== hookCmd) { ours.command = hookCmd; changed = true; } }
        else { root.hooks[ev].push({ hooks: [{ type: 'command', command: hookCmd, timeout: 10 }] }); changed = true; }
      }
    }
    if (changed) { const tmp = f + '.tmp'; writeFileSync(tmp, JSON.stringify(root, null, 2) + '\\n'); renameSync(tmp, f); }
  } catch { }
}
`;
  fs.writeFileSync(path.join(AGENT_BIN_DIR, 'vibespace-hook-register.mjs'), reg, { mode: 0o755 });
}
createHookHelper();

// Idempotent, NON-DESTRUCTIVE hook registration for both harnesses: only our
// own entry (matched by 'vibespace-hook.mjs') is ever added or updated; every
// other key/entry (e.g. the task-tracker plugin's hooks) is left untouched.
// Runs at every startup AND on demand from the Manage Agents dialog, which
// shows per-harness status so non-engineers can see + repair the integration.
const HOOK_FILES = {
  claude: { file: () => path.join(os.homedir(), '.claude', 'settings.json'), createIfMissing: false },
  codex: { file: () => path.join(os.homedir(), '.codex', 'hooks.json'), createIfMissing: true },
};
// Both events are natively supported by Claude Code and Codex; SessionStart
// delivers task context, UserPromptSubmit delivers pending status notices.
const HOOK_EVENTS = ['SessionStart', 'UserPromptSubmit'];
// Stop is CLAUDE-ONLY: codex's app-server (JSON-RPC mode) has no blockable
// Stop hook — its stop-time nudge rides the codex wrapper's turn/completed.
const HOOK_EVENTS_FOR = (harness) => harness === 'claude' ? [...HOOK_EVENTS, 'Stop'] : HOOK_EVENTS;
// Persisted opt-out: when the user clicks Remove in Manage Agents, we drop this
// marker so startup does NOT silently re-register the hooks they removed.
const HOOK_OPTOUT_FILE = path.join(__dirname, 'data', '.agent-hooks-optout');
// DEFENSIVE: a user can hand-edit settings.json into any shape (a null group, a
// string `hooks`, …). Never throw walking it — skip non-conforming entries so
// agentHooksStatus/ensure/remove degrade gracefully instead of 500ing the UI.
function _findOurHookIn(list) {
  for (const group of Array.isArray(list) ? list : []) {
    if (!group || !Array.isArray(group.hooks)) continue;
    const h = group.hooks.find(h => h && typeof h.command === 'string' && h.command.includes('vibespace-hook.mjs'));
    if (h) return h;
  }
  return null;
}
// Read → mutate → write with a compare-and-swap re-read right before the atomic
// rename: shrinks the lost-update window (a concurrent CLI write to the same
// settings file between our read and write) to the two-syscall rename gap. The
// mutate is idempotent, so re-applying it to fresher on-disk content is safe.
function _patchHookFile(file, createIfMissing, mutate) {
  const parse = () => { try { return { text: fs.readFileSync(file, 'utf-8') }; } catch { return { text: null }; } };
  for (let attempt = 0; attempt < 4; attempt++) {
    const { text } = parse();
    let root = null;
    if (text != null) { try { root = JSON.parse(text); } catch { throw new Error(`${file} exists but is not valid JSON — not touching it`); } }
    if (!root) {
      if (text != null) throw new Error(`${file} exists but is not valid JSON — not touching it`);
      if (!createIfMissing) throw new Error(`${file} not found (start the CLI once to create it)`);
      // createIfMissing only creates the FILE — never the CLI's config DIR.
      // A missing ~/.codex means codex isn't installed; manufacturing the dir
      // (with our umask, holding only our hook) would be VibeSpace writing
      // config for a CLI that was never present — the tmp-write below ENOENTs
      // and registration reports "skipped", which is the correct outcome.
      if (!fs.existsSync(path.dirname(file))) throw new Error(`${path.dirname(file)} not found (install the CLI first)`);
      root = {};
    }
    if (!root.hooks || typeof root.hooks !== 'object') root.hooks = {};
    const changed = mutate(root);
    if (!changed) return false;
    const out = JSON.stringify(root, null, 2) + '\n';
    // CAS: only commit if the file hasn't changed under us since we read it.
    const cur = parse();
    if (cur.text !== text) continue; // someone wrote it — re-read + re-apply
    const tmp = file + '.tmp';
    fs.writeFileSync(tmp, out);
    fs.renameSync(tmp, file);
    return true;
  }
  throw new Error(`${file} kept changing under concurrent writes — gave up`);
}
// Known CLI death signatures → { reason, detail } (2.226.0, probe batch).
// Patterns are the CLIs' OWN canned strings; keep them TIGHT — the buffer
// tail can contain tool output, and a loose pattern would mislabel normal
// exits. cli_missing additionally requires the shell's 126/127 exit code
// (a bare "No such file or directory" also appears in ordinary tool output).
function classifyCliDeath(tail, code) {
  if (!tail) return null;
  const line = (re) => { const m = tail.match(re); return m ? String(m[0]).replace(/[\x00-\x1f\x7f]+/g, ' ').trim().slice(0, 200) : null; };
  let d;
  if ((d = line(/(?:Not logged in|Please run \/login|OAuth token revoked)[^\n]*/))) return { reason: 'not_logged_in', detail: d };
  if ((d = line(/No conversation found with session ID[^\n]*/))) return { reason: 'no_conversation', detail: d };
  if ((d = line(/error: unknown (?:option|command)[^\n]*/))) return { reason: 'cli_arg_error', detail: d };
  if ((d = line(/(?:Invalid API key|invalid x-api-key|authentication_error)[^\n]*/i))) return { reason: 'auth_error', detail: d };
  if ((d = line(/Credit balance is too low[^\n]*/i))) return { reason: 'billing_error', detail: d };
  if ((code === 127 || code === 126) && (d = line(/[^\n]*(?:command not found|No such file or directory)[^\n]*/))) return { reason: 'cli_missing', detail: d };
  return null;
}
function agentHooksStatus() {
  const hookCmd = `${JSON.stringify(process.execPath)} ${HOOK_CMD}`; // absolute interpreter (2.244.2 — see the register template note)
  const out = { hookPath: HOOK_CMD, optedOut: fs.existsSync(HOOK_OPTOUT_FILE) };
  for (const [key, def] of Object.entries(HOOK_FILES)) {
    const file = def.file();
    let root = null, parseError = false;
    try { root = JSON.parse(fs.readFileSync(file, 'utf-8')); }
    catch { parseError = fs.existsSync(file); }
    let found = [];
    const evs = HOOK_EVENTS_FOR(key);
    try { found = evs.map(ev => root ? _findOurHookIn(root.hooks?.[ev]) : null); } catch { found = evs.map(() => null); }
    out[key] = {
      file,
      fileExists: fs.existsSync(file),
      parseError,
      installed: found.every(h => h && h.command === hookCmd),
      stale: found.some(h => h && h.command !== hookCmd) || (found.some(Boolean) && !found.every(Boolean)),
    };
  }
  return out;
}
// A THROWAWAY server must never touch the machine's GLOBAL CLI hook
// registration (real incident 2026-07-21: a rail-smoke WORKTREE server under
// /tmp booted with the real HOME and rewrote ~/.claude/settings.json's hook
// command to its /tmp path; after worktree cleanup every Stop/UserPromptSubmit
// hook errored MODULE_NOT_FOUND for two days — and the CLI snapshots hook
// config per session, so healing the file doesn't reach already-running
// sessions). Rule: a server whose own code lives under the OS temp dir skips
// ALL global hook writes (register AND strip). Escape hatches:
// VIBESPACE_SKIP_AGENT_HOOKS=1 forces skip anywhere (test harness belt),
// VIBESPACE_FORCE_AGENT_HOOKS=1 overrides the tmp guard.
function hookRegistrationSafe() {
  if (process.env.VIBESPACE_FORCE_AGENT_HOOKS === '1') return true;
  if (process.env.VIBESPACE_SKIP_AGENT_HOOKS === '1') return false;
  const here = path.resolve(__dirname) + path.sep;
  const tmp = path.resolve(os.tmpdir()) + path.sep;
  return !here.startsWith(tmp) && !here.startsWith('/tmp/');
}
// auto=true (startup): respect the opt-out marker. auto=false (explicit Install
// from the UI): always register + clear the marker.
function ensureAgentHooks({ auto = false } = {}) {
  const hookCmd = `${JSON.stringify(process.execPath)} ${HOOK_CMD}`; // absolute interpreter (2.244.2 — see the register template note)
  if (!hookRegistrationSafe()) { console.log('Agent-hook registration skipped (throwaway/temp server root)'); return { skipped: true }; }
  if (auto && fs.existsSync(HOOK_OPTOUT_FILE)) return { optedOut: true };
  if (!auto) { try { fs.rmSync(HOOK_OPTOUT_FILE, { force: true }); } catch {} }
  const results = {};
  for (const [key, def] of Object.entries(HOOK_FILES)) {
    try {
      _patchHookFile(def.file(), def.createIfMissing, (root) => {
        let changed = false;
        for (const ev of HOOK_EVENTS_FOR(key)) {
          if (!Array.isArray(root.hooks[ev])) root.hooks[ev] = [];
          const ours = _findOurHookIn(root.hooks[ev]);
          if (ours) { if (ours.command !== hookCmd) { ours.command = hookCmd; changed = true; } }
          else { root.hooks[ev].push({ hooks: [{ type: 'command', command: hookCmd, timeout: 10 }] }); changed = true; }
        }
        return changed;
      }) && console.log(`Registered VibeSpace hooks in ${def.file()}`);
      results[key] = { ok: true };
    } catch (e) {
      console.log(`Hook registration (${key}) skipped:`, e.message);
      results[key] = { ok: false, error: e.message };
    }
  }
  return results;
}
// Strip ONLY our entries from both CLI configs — no opt-out marker. Used by
// the Integration master switch (agents.vibespaceIntegration OFF), which is a
// SETTING-driven state: boot re-checks the setting, so no marker is needed
// (and writing one would make a later re-enable silently not re-register).
function stripAgentHookEntries() {
  if (!hookRegistrationSafe()) return; // temp/worktree server: never edit global CLI configs
  for (const def of Object.values(HOOK_FILES)) {
    try {
      _patchHookFile(def.file(), false, (root) => {
        let changed = false;
        for (const ev of [...HOOK_EVENTS, 'Stop']) {
          if (!Array.isArray(root.hooks[ev])) continue;
          for (const group of root.hooks[ev]) {
            if (!group || !Array.isArray(group.hooks)) continue;
            const before = group.hooks.length;
            group.hooks = group.hooks.filter(h => !(h && typeof h.command === 'string' && h.command.includes('vibespace-hook.mjs')));
            if (group.hooks.length !== before) changed = true;
          }
          root.hooks[ev] = root.hooks[ev].filter(g => g && Array.isArray(g.hooks) && g.hooks.length);
        }
        return changed;
      }) && console.log(`Removed VibeSpace hooks from ${def.file()}`);
    } catch { }
  }
}
function removeAgentHooks() {
  // Durable: record the opt-out so startup won't re-register (finding #3).
  try { fs.writeFileSync(HOOK_OPTOUT_FILE, new Date().toISOString() + '\n'); } catch {}
  stripAgentHookEntries();
}
// Generic operator-visible notice channel (2.226.0, user directive "不要静默
// 失败"): server-side probes report through this instead of dying in the log —
// every connected client toasts it (+ it lands in toast/notification history)
// and a telemetry event carries the key to the fleet collector. Key-deduped
// per boot so a recurring probe can't spam.
const _sentNotices = new Set();
function serverNotice(key, text, { level = 1 } = {}) {
  if (_sentNotices.has(key)) return;
  console.warn('[notice]', text);
  global.__vsEvent?.('server-notice', key);
  let delivered = 0;
  try {
    const payload = JSON.stringify({ type: 'server-notice', key, text, level });
    for (const c of wss.clients) { try { if (c.readyState === WS_OPEN) { c.send(payload); delivered++; } } catch {} }
  } catch {}
  // No client connected (e.g. the 60s post-boot probe right after a pod
  // restart) → don't burn the key; the next probe run re-notices when
  // someone is actually there to see it (review finding).
  if (delivered > 0) _sentNotices.add(key);
}
// Agent-hook health probe (2.226.0; born from the 2-day silent MODULE_NOT_FOUND
// outage whose CAUSE 2.225.1 fixed): a registration that goes stale or points
// at a missing script MID-RUN now self-heals + notifies instead of silently
// dropping every Stop/SessionStart/UserPromptSubmit delivery. Boot(+60s) +
// every 6h. NOTE the heal only fixes the FILE — running CLI sessions snapshot
// hook config and pick it up after restart/compaction; the notice says so.
function checkAgentHookHealth() {
  try {
    if (!hookRegistrationSafe() || !integrationEnabled() || fs.existsSync(HOOK_OPTOUT_FILE)) return;
    const scriptMissing = !fs.existsSync(HOOK_CMD);
    if (scriptMissing) { try { createHookHelper(); } catch {} }
    const st = agentHooksStatus();
    for (const [key, info] of Object.entries(st)) {
      if (!info || typeof info !== 'object' || !('installed' in info)) continue; // hookPath/optedOut fields
      if (!info.fileExists || info.parseError) continue; // that CLI isn't set up here / unreadable
      if (info.stale || !info.installed || scriptMissing) {
        global.__vsEvent?.('agent-hook-broken', `${key}${info.stale ? '/stale' : ''}${!info.installed ? '/missing-entry' : ''}${scriptMissing ? '/script-missing' : ''}`);
        ensureAgentHooks({ auto: true }); // self-heal the registration in place
        serverNotice(`hook-health-${key}`,
          `VibeSpace's ${key} agent-hook registration was broken (stale or missing path) and has been repaired — CLI sessions already running pick the fix up only after they restart or compact.`,
          { level: 2 });
      }
    }
  } catch (e) { console.warn('[hook-health] probe failed:', e.message); }
}

// Long-lived-token expiry sweep (B-211a): setup-token tokens live exactly 1
// year and a 401 has NO self-heal — warn while there's still time to re-mint.
// Once per boot, notice-deduped per account.
function checkOatExpiry() {
  try {
    for (const a of accounts.list().accounts) {
      if (!a.oat || typeof a.oatDaysLeft !== 'number') continue;
      if (a.oatDaysLeft <= 0) {
        serverNotice(`oat-expired-${a.id}`, `The long-lived token for "${a.name}" has EXPIRED — sessions using it will fail until you re-mint one (Manage agents → the account's ⋯ menu → Long-lived token).`, { level: 2 });
      } else if (a.oatDaysLeft <= 21) {
        serverNotice(`oat-expiring-${a.id}`, `The long-lived token for "${a.name}" expires in ${a.oatDaysLeft} days — re-mint it soon (Manage agents → ⋯ → Long-lived token).`, { level: 2 });
      }
    }
  } catch { }
}
setTimeout(checkOatExpiry, 20000);
setInterval(checkOatExpiry, 6 * 3600e3); // stable instances stay up for weeks — a one-shot sweep would sail past the threshold (serverNotice keys dedupe per boot, so re-fires are cheap)
// Boot-time hook registration is DEFERRED until settings are readable (after
// setupPersistence below) — the Integration master switch decides whether we
// register or actively strip. See "Agent-hook boot registration".

// ── File System API (extracted to src/routes/files.js) ──
app.locals.xEnv = X_ENV;
app.locals.refreshXEnv = refreshXEnv; // paste route retries through this after an X cookie rotation
app.locals.activeSessions = activeSessions; // paste-image resolves a session's host server-side (B-65ec)
// Remote fs (Files cross-host) — resolved lazily; `hosts` is created below.
app.locals.getRemoteFs = () => remoteFs;
// ── SafeFs: dedicated worker_threads pool for LOCAL user-path fs ops ──
// STRUCTURAL isolation for the hung-mount class (complements the tactical
// canary/watchdog/circuit-breaker + UV_THREADPOOL_SIZE=32 above): every local
// file-route fs call runs on a worker's own thread with a per-op deadline and
// kill-and-respawn, so a wedged mount can never again saturate the shared libuv
// pool and freeze /login. path.resolve/permission decisions stay in-main; the
// worker only executes the already-resolved absolute path. mounts.pathBlocked
// still fails known-hung roots fast in the route middleware BEFORE dispatch.
try {
  app.locals.safeFs = new SafeFs({
    poolSize: parseInt(process.env.VIBESPACE_SAFEFS_POOL || '', 10) || 4,
  });
  console.log(`[safe-fs] worker pool up (${app.locals.safeFs.poolSize} workers)`);
} catch (e) {
  console.error('[safe-fs] pool init failed, file ops fall back to in-main fs:', e.message);
}
app.use(fileRoutes);

// Browser proxy — full-rewriting web proxy via node-unblocker
// Rewrites all URLs in HTML/CSS, injects JS to rewrite XHR/WebSocket, strips security headers
const Unblocker = require('unblocker');
const unblocker = new Unblocker({
  prefix: '/proxy/',
  responseMiddleware: [
    function stripFrameHeaders(data) {
      delete data.headers['x-frame-options'];
    }
  ],
});
app.use(unblocker);

// Editor: open request from the `code` helper script (via HTTP, not terminal
// output). The caller lives INSIDE the session shell — no cookie exists there,
// so auth.middleware exempts this path and WE validate the per-session vsst_
// token instead (same trust model as /api/agent/*). Without this, enabling
// password auth silently broke Ctrl+G: the script's POST got 401 and claude
// sat on "Save and close editor to continue…" forever.
app.post('/api/editor/open', (req, res) => {
  if (app.locals.authEnabled) {
    const token = (req.headers.authorization || '').replace(/^Bearer\s+/i, '');
    let ok = false;
    if (token && token.startsWith('vsst_')) {
      for (const [, s] of activeSessions) { if (s.agentToken === token) { ok = true; break; } }
    }
    if (!ok) return res.status(401).json({ error: 'unauthorized (session token required)' });
  }
  const { file, signal, sessionId } = req.body;
  // Remote Ctrl+G (B-2de8): the POST came from the fake `code` helper running
  // ON THE HOST (over the reverse tunnel) — the tmpfile + signal file live
  // there. Resolve the session's host server-side and ship it in the
  // broadcast so the client editor reads/writes/signals the right machine.
  const editorHost = (sessionId && activeSessions.get(sessionId)?.host) || null;
  // Persist the pending edit on the session + its meta: the helper script
  // waits FOREVER on the signal file while claude shows "Save and close
  // editor to continue…" — a server restart + page reload (or pod recreation
  // for remote sessions, whose helper+claude survive on the host) otherwise
  // loses the only record of it and the session silently hangs mid-turn.
  // Cleared by /api/editor/signal; re-broadcast on terminal attach.
  if (sessionId && activeSessions.has(sessionId)) {
    const s = activeSessions.get(sessionId);
    s._pendingEditor = { filePath: file, signalPath: signal, host: editorHost, at: Date.now() };
    try { if (s.sockName) writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), pendingEditor: s._pendingEditor }); } catch {}
  }
  // Broadcast to all WebSocket clients — include sessionId so each client opens editor on the right window
  const msg = JSON.stringify({ type: 'editor-open', filePath: file, signalPath: signal, sessionId: sessionId || null, host: editorHost });
  wss.clients.forEach(client => {
    if (client.readyState === WS_OPEN) {
      try { client.send(msg); } catch {}
    }
  });
  res.json({ success: true });
});

// Editor: signal completion (called by client when user saves/closes editor)
app.post('/api/editor/signal', async (req, res) => {
  const { signalPath, filePath, content, host } = req.body;
  try {
    if (host && remoteFs) {
      // remote Ctrl+G: the CLI polls the signal file ON ITS machine
      if (content !== undefined) await remoteFs.write(String(host), filePath, Buffer.from(content));
      await remoteFs.write(String(host), signalPath, Buffer.from('done'));
    } else {
      if (content !== undefined) fs.writeFileSync(filePath, content);
      fs.writeFileSync(signalPath, 'done');
    }
    // The edit is settled — drop the persisted pending-editor record so a
    // later restart/attach doesn't re-open a dead pane
    for (const [, s] of activeSessions) {
      if (s._pendingEditor?.signalPath === signalPath) {
        s._pendingEditor = null;
        try { if (s.sockName) writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), pendingEditor: null }); } catch {}
      }
    }
    // Broadcast editor-close to all clients so they remove the split pane
    const msg = JSON.stringify({ type: 'editor-close', filePath, signalPath });
    wss.clients.forEach(client => {
      if (client.readyState === WS_OPEN) { try { client.send(msg); } catch {} }
    });
    res.json({ success: true });
  } catch (err) { res.status(400).json({ error: err.message }); }
});

// ── Persistence API (extracted to src/routes/persistence.js) ──
const syncStores = {};
function getSyncStore(name) { return syncStores[name]; }
// THE server-side settings reader (data/settings.json via persistence.js's
// cached accessor). getSyncStore('settings') is NOT it — that SyncStore is an
// empty migration target; reads through it silently return undefined.
function serverSetting(key) {
  try { return persistenceRouter.readSettings ? persistenceRouter.readSettings()[key] : undefined; } catch { return undefined; }
}
// Integration master switch (agents.vibespaceIntegration, default ON): OFF =
// pristine CLI — no hook registration, no VIBESPACE_API/agent-tools env in new
// spawns, no context/nudge delivery even to already-running sessions. THE one
// definition — threaded into ws-handler and agent-routes via their deps.
function integrationEnabled() {
  try { return serverSetting('agents.vibespaceIntegration') !== false; } catch { return true; }
}
// ONE convergence rule for boot AND the live toggle: hook registration follows
// the master switch. ensureAgentHooks({auto:true}) still honors the manual
// data/.agent-hooks-optout marker (Manage-Agents Remove) — the switch never
// overrides that narrower explicit choice; Install there clears it.
function syncHookRegistration() {
  try {
    if (integrationEnabled()) ensureAgentHooks({ auto: true });
    else stripAgentHookEntries();
  } catch (e) { console.warn('[integration] hook registration sync failed:', e.message); }
}

syncStores.drafts = new SyncStore('drafts', path.join(__dirname, 'data', 'drafts.json'), wss);
syncStores.settings = new SyncStore('settings', path.join(__dirname, 'data', 'settings-sync.json'), wss);
syncStores.uploads = new SyncStore('uploads', path.join(__dirname, 'data', 'uploads-sync.json'), wss);
syncStores.stage = new SyncStore('stage', path.join(__dirname, 'data', 'stage-sync.json'), wss); // dynamic desktop (docs/design-dynamic-desktop.md)

setupPersistence({ dataDir: path.join(__dirname, 'data'), wss, WS_OPEN, getSyncStore, activeSessions, auth,
  getHosts: () => hosts, getMounts: () => mounts, getTasks: () => tasks,
  getAccounts: () => accounts, getUsageHistory: () => usageHistory,
  // React server-side to the Integration master switch: register/strip the
  // CLI-config hook entries the moment the setting flips (the only settings
  // key with a server-side side effect — everything else reads lazily).
  onSettingsWrite: (next, prev) => {
    const was = (prev || {})['agents.vibespaceIntegration'] !== false;
    const now = (next || {})['agents.vibespaceIntegration'] !== false;
    if (was !== now) syncHookRegistration();
    // claude.disableModelFallback flips LIVE sessions too ("动态对对话进行调整"):
    // apply_flag_settings merges switchModelsOnFlag into the CLI's inline
    // flag-settings layer, effective from the next turn. Local and remote
    // chat sessions alike (the control_request rides the same stdin channel
    // as set_model). Sessions spawned after the flip get it at spawn instead.
    const fbWas = (prev || {})['claude.disableModelFallback'] === true;
    const fbNow = (next || {})['claude.disableModelFallback'] === true;
    if (fbWas !== fbNow) {
      for (const [sid, sess] of activeSessions) {
        if (sess.backend !== 'claude' || sess.mode !== 'chat' || !sess.pty) continue;
        try {
          const ad = adapterRegistry.get('claude');
          if (ad?.formatSetFallbackPolicy) sess.pty.write(ad.formatSetFallbackPolicy(fbNow) + '\n');
        } catch (e) { console.warn(`[fallback-policy] ${sid}: ${e.message}`); }
      }
    }
  } });
app.use(persistenceRouter);
// ── Agent-hook boot registration (deferred from the hook-machinery block so
// the Integration master switch is readable) — a toggle flipped just before a
// restart, or an imported config bundle carrying it, converges here.
syncHookRegistration();
// Health probe: catches MID-RUN poisoning (the 2.225.1 incident class) that
// boot-time registration can't — self-heals + notifies. 60s in, then 6h.
setTimeout(checkAgentHookHealth, 60000).unref();
setInterval(checkAgentHookHealth, 6 * 3600 * 1000).unref();

// ── Task Groups (岗位; task system — docs/design-task-system.md + refactor) ──
// data/task-groups.json is AUTHORITATIVE for everything the board renders (the
// store migrates the legacy data/tasks.json forward once). The one-time legacy
// Groups migration (sessionGroups/groupFolders) runs in the constructor.
const { TaskGroupManager } = require('./src/task-groups');
const tasks = new TaskGroupManager({
  dataDir: path.join(__dirname, 'data'),
  readUserState: () => persistenceRouter.readUserState(),
  getSetting: (k) => serverSetting(k),
  onChange: (list) => {
    const json = JSON.stringify({ type: 'tasks-updated', tasks: list });
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
// System info + memory-pressure watch (2.216.0, userL's 32Gi OOM kill —
// the pod-level kill takes every dtach session; warn BEFORE the kernel acts)
const sysinfo = require('./src/sysinfo');
// Remote machine snapshot for the System panel's machine switcher.
// ONE IMPLEMENTATION (2.314.0, CS separation — this was a missed twin-set):
// the daemon bundles src/sysinfo.js and the `sysinfo` op runs it ON the
// machine, so local and remote share one interpretation of "used memory"
// (working set). The interpretation had already drifted once between the two
// copies — the local panel read raw memory.current (page cache included) and
// pinned at a false 100% while this script correctly used MemTotal −
// MemAvailable. The script below is now only the FALLBACK RUNG for
// daemon-less ssh hosts; its raw-host semantics (MemTotal = limit, no
// cgroup awareness) are the fallback's known limitation, not the contract.
// History stays LOCAL-only — the sampler runs in this server.
const REMOTE_SYSINFO_SCRIPT = `
U=$(uname)
if [ "$U" = Darwin ]; then
  T=$(sysctl -n hw.memsize 2>/dev/null)
  P=$(sysctl -n vm.pagesize 2>/dev/null || echo 4096)
  W=$(vm_stat 2>/dev/null | awk -v p="$P" '/Pages (active|wired down|occupied by compressor)/ {gsub("\\\\.","",$NF); s+=$NF} END {print s*p}')
  echo "MEM \${W:-0} \${T:-0}"
  echo "LOAD $(sysctl -n vm.loadavg 2>/dev/null | tr -d '{}')"
  echo "CPUS $(sysctl -n hw.ncpu 2>/dev/null)"
  df -k "$HOME" 2>/dev/null | tail -1 | awk '{print "DISK", $3*1024, ($3+$4)*1024}'
  ps ax -o rss=,pid=,command= 2>/dev/null | sort -k1,1 -rn | head -8 | sed 's/^ */PROC /'
else
  awk '/MemTotal/{t=$2*1024} /MemAvailable/{a=$2*1024} END{print "MEM", t-a, t}' /proc/meminfo
  echo "LOAD $(cut -d' ' -f1-3 /proc/loadavg)"
  echo "CPUS $(nproc 2>/dev/null || echo 1)"
  df -k "$HOME" 2>/dev/null | tail -1 | awk '{print "DISK", $3*1024, ($3+$4)*1024}'
  ps ax -o rss=,pid=,args= --sort=-rss 2>/dev/null | head -8 | sed 's/^ */PROC /'
fi`;
async function remoteSysinfo(hostId) {
  const h = hosts.get(hostId);
  if (!h) throw new Error('unknown machine');
  // Ladder: device op (the shared module, run where the facts live) → ssh
  // script (daemon-less hosts) — the per-op fallback pattern every other
  // device op follows. Capability-gated: an old daemon is never asked.
  try {
    const dm = await hosts.deviceBounded(hostId, 6000);
    const r = await dm.sysinfo();
    if (r?.mem) return { host: hostId, ...r };
  } catch { /* fall through to the ssh script */ }
  const out = await hosts._hostShell(h, REMOTE_SYSINFO_SCRIPT, { timeoutMs: 8000 });
  const r = { host: hostId, procs: [] };
  for (const line of String(out).split('\n')) {
    const m = line.match(/^([A-Z]+) (.*)$/);
    if (!m) continue;
    const [, k, v] = m;
    if (k === 'MEM') { const [u, t] = v.trim().split(/\s+/).map(Number); if (t > 0) r.mem = { used: u, limit: t, pct: Math.round(u / t * 100) }; }
    else if (k === 'DISK') { const [u, t] = v.trim().split(/\s+/).map(Number); if (t > 0) r.disk = { used: u, total: t, pct: Math.round(u / t * 100) }; }
    else if (k === 'LOAD') { const l = v.trim().split(/\s+/).slice(0, 3).filter(Boolean); if (l.length) r.load = l; }
    else if (k === 'CPUS') { const n = parseInt(v, 10); if (n > 0) r.cpus = n; }
    else if (k === 'PROC') { const pm = v.trim().match(/^(\d+)\s+(\d+)\s+(.*)$/); if (pm && r.procs.length < 8) r.procs.push({ rss: Number(pm[1]) * 1024, pid: Number(pm[2]), cmd: pm[3].slice(0, 400) }); }
  }
  if (!r.mem && !r.load && !r.procs.length) throw new Error('probe returned nothing usable');
  return r;
}
// ── Incident capture ("panic button", 2.238.0): the client posts its ring
// buffers + state snapshot; the server adds ITS OWN scene (sessions digest,
// sysinfo history slice, in-memory console ring, hosts digest) and writes
// data/incidents/<id>/bundle.json. The user relays only the short id; the
// admin reads the bundle later — the scene survives the timezone gap.
const _srvConsoleRing = [];
for (const _lvl of ['log', 'warn', 'error']) {
  const _orig = console[_lvl].bind(console);
  console[_lvl] = (...args) => {
    try {
      _srvConsoleRing.push({ t: Date.now(), l: _lvl, m: args.map((a) => (a instanceof Error ? (a.stack || a.message) : typeof a === 'string' ? a : JSON.stringify(a))).join(' ').slice(0, 500) });
      if (_srvConsoleRing.length > 600) _srvConsoleRing.splice(0, _srvConsoleRing.length - 600);
    } catch {}
    _orig(...args);
  };
}
const INCIDENTS_DIR = path.join(__dirname, 'data', 'incidents');
function _incidentServerState() {
  const out = { t: Date.now(), version: (() => { try { return require('./package.json').version; } catch { return ''; } })(), uptimeS: Math.round(process.uptime()), rssMB: Math.round(process.memoryUsage().rss / 1048576) };
  try {
    out.sessions = [...activeSessions.entries()].map(([id, s]) => ({
      id, mode: s.mode, backend: s.backend, host: s.host || null,
      cid: s.claudeSessionId || s.backendSessionId || null, name: (s.name || '').slice(0, 40),
      streaming: !!s._isStreaming, historyLoaded: !!s._historyLoaded, clients: s.clients?.size ?? 0,
      remoteState: s._remoteState || null, agentd: !!s.agentdSession,
    }));
  } catch (e) { out.sessions = 'failed: ' + e.message; }
  try { out.sysinfoHistory = sysinfo.history(30 * 60 * 1000); } catch {}
  try { out.hosts = (hosts?.list?.() || []).map((h) => ({ id: h.id, name: h.name, transport: h.dialTokenHash ? 'dial' : 'ssh' })); } catch {}
  out.console = _srvConsoleRing.slice(-400);
  // The "conversation disappeared" class (2.238.1): what the RESUME BREAKER
  // currently blocks and what remote DISCOVERY last believed — both were
  // load-bearing in the userN incident and neither survives anywhere else.
  try { out.resumeBreakers = [...noConvoRef.map.entries()].map(([cid, at]) => ({ cid, agoS: Math.round((Date.now() - at) / 1000) })); } catch {}
  // LAYOUT state + rollback points (2.296.0): for a layout-destroying bug the
  // window→desktop mapping IS the evidence, and the history index tells a
  // responder whether an intact pre-damage state still exists (it makes the
  // difference between "restore in one click" and hand-editing layouts.json).
  try {
    const lay = persistenceRouter.readLayouts?.() || {};
    out.layout = {
      desktops: (lay.desktopMeta || []).map((m) => ({ id: m.id, name: m.name })),
      windowsPerDesktop: Object.fromEntries(Object.entries(lay.desktops || {}).map(([dk, v]) => [dk, ((v?.autoSave || {}).windows || []).length])),
      // window→desktop with its session id: the exact table needed to put a
      // flattened layout back, and small enough to always include
      windows: Object.entries(lay.desktops || {}).flatMap(([dk, v]) => (((v?.autoSave || {}).windows) || []).map((w) => ({
        desk: dk, id: w.id, type: w.type,
        sid: w.openSpec?.backendSessionId || w.openSpec?.serverId || null,
        title: String(w.title || '').slice(0, 40),
      }))).slice(0, 300),
    };
    out.layoutHistory = (persistenceRouter.listLayoutHistory?.() || []).slice(0, 40);
  } catch (e) { out.layout = 'failed: ' + e.message; }
  try {
    const dc = JSON.parse(fs.readFileSync(path.join(__dirname, 'data', 'remote-sessions-cache.json'), 'utf8'));
    out.discoveryCache = Object.fromEntries(Object.entries(dc.hosts || dc || {}).map(([hid, v]) => {
      const list = Array.isArray(v?.sessions) ? v.sessions : Array.isArray(v) ? v : [];
      return [hid, { count: list.length, ids: list.slice(0, 40).map((x) => String(x.sessionId || x.id || '').slice(0, 8)) }];
    }));
  } catch {}
  return out;
}
// Which conversations + hosts does this incident touch? Everything the
// FREEZE needs to target: live sessions, the client's visible session list,
// and any id currently blocked by the resume breaker (the disappeared class).
function _incidentTargets(clientSnapshot) {
  const cids = new Set(), hostIds = new Set();
  try {
    for (const [, s] of activeSessions) {
      if (s.claudeSessionId) cids.add(s.claudeSessionId);
      if (s.backendSessionId) cids.add(s.backendSessionId);
      if (s.host) hostIds.add(s.host);
    }
  } catch {}
  try {
    for (const s of (clientSnapshot?.sessions || []).slice(0, 60)) {
      if (s?.id) cids.add(s.id);
      if (s?.host) hostIds.add(s.host);
    }
  } catch {}
  try { for (const cid of noConvoRef.map.keys()) cids.add(cid); } catch {}
  return { cids: [...cids].filter(Boolean), hostIds: [...hostIds].filter(Boolean) };
}
app.post('/api/incident', (req, res) => {
  try {
    const id = 'inc-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 6);
    const dir = path.join(INCIDENTS_DIR, id);
    fs.mkdirSync(dir, { recursive: true });
    fs.writeFileSync(path.join(dir, 'bundle.json'), JSON.stringify({
      id, at: new Date().toISOString(), note: String(req.body?.note || '').slice(0, 2000),
      clientVersion: String(req.body?.version || ''), client: { rings: req.body?.rings, snapshot: req.body?.snapshot },
      server: _incidentServerState(),
    }, null, 1));
    // ── FREEZE THE SCENE (2.239.0) ──────────────────────────────────────
    // The user WILL now go troubleshoot — ssh in, resume, kill — and destroy
    // every volatile fact (process tree, locks, metas, transcript state).
    // Copy it all out first. Runs async so the id comes back instantly; a
    // `env.json.pending` marker tells a later reader the capture was cut off
    // (server killed mid-freeze) rather than empty by design.
    const targets = _incidentTargets(req.body?.snapshot);
    fs.writeFileSync(path.join(dir, 'env.json.pending'), JSON.stringify({ startedAt: new Date().toISOString(), targets }, null, 1));
    (async () => {
      try {
        const inc = require('./src/incident');
        const local = await inc.captureLocal(dir, { dataDir: path.join(__dirname, 'data'), cids: targets.cids });
        fs.writeFileSync(path.join(dir, 'env.json'), JSON.stringify({ targets, local }, null, 1));
        if (hosts && targets.hostIds.length) {
          const remote = await inc.captureRemote({ hosts, hostIds: targets.hostIds, cids: targets.cids });
          fs.writeFileSync(path.join(dir, 'remote.json'), JSON.stringify(remote, null, 1));
        }
        fs.rmSync(path.join(dir, 'env.json.pending'), { force: true });
        console.log(`[incident] ${id}: scene frozen (${targets.cids.length} conversations, ${targets.hostIds.length} hosts)`);
      } catch (e) {
        try { fs.writeFileSync(path.join(dir, 'env-error.txt'), String(e.stack || e.message)); } catch {}
        console.error(`[incident] ${id}: freeze failed:`, e.message);
      }
    })();
    // prune: newest 30 kept
    try {
      const all = fs.readdirSync(INCIDENTS_DIR).filter((d) => d.startsWith('inc-')).sort();
      for (const d of all.slice(0, Math.max(0, all.length - 30))) fs.rmSync(path.join(INCIDENTS_DIR, d), { recursive: true, force: true });
    } catch {}
    console.log(`[incident] captured ${id}${req.body?.note ? ' — ' + String(req.body.note).slice(0, 80) : ''}`);
    res.json({ id });
  } catch (e) { res.status(500).json({ error: e.message }); }
});
app.post('/api/incident/:id/append', (req, res) => {
  try {
    const id = String(req.params.id || '');
    if (!/^inc-[a-z0-9-]+$/.test(id)) return res.status(400).json({ error: 'bad id' });
    const dir = path.join(INCIDENTS_DIR, id);
    if (!fs.existsSync(dir)) return res.status(404).json({ error: 'unknown incident' });
    fs.writeFileSync(path.join(dir, 'followup.json'), JSON.stringify({
      at: new Date().toISOString(), client: { rings: req.body?.rings, snapshot: req.body?.snapshot }, server: _incidentServerState(),
    }, null, 1));
    res.json({ ok: true });
  } catch (e) { res.status(500).json({ error: e.message }); }
});
app.get('/api/incidents', (req, res) => {
  try {
    const out = [];
    for (const d of (fs.existsSync(INCIDENTS_DIR) ? fs.readdirSync(INCIDENTS_DIR) : []).sort().reverse().slice(0, 30)) {
      try { const b = JSON.parse(fs.readFileSync(path.join(INCIDENTS_DIR, d, 'bundle.json'), 'utf8')); out.push({ id: b.id, at: b.at, note: b.note }); } catch {}
    }
    res.json({ incidents: out });
  } catch (e) { res.status(500).json({ error: e.message }); }
});
app.get('/api/sysinfo', async (req, res) => {
  try {
    const hostId = String(req.query.host || '');
    if (hostId) return res.json(await remoteSysinfo(hostId));
    res.json(await sysinfo.read(path.join(__dirname, 'data')));
  } catch (e) { res.status(500).json({ error: e.message }); }
});
// Resource HISTORY for the System rail charts (2.223.0): self-sampled CPU/
// memory rings — 24h at the 45s watch cadence, 7d at 15min. range=1h|24h|7d.
app.get('/api/sysinfo/history', (req, res) => {
  const ranges = { '1h': 3600e3, '24h': 24 * 3600e3, '7d': 7 * 24 * 3600e3 };
  const ms = ranges[String(req.query.range || '24h')] || ranges['24h'];
  res.json({ points: sysinfo.history(ms), rangeMs: ms, cpus: require('os').cpus().length });
});
sysinfo.startWatch({
  dataDir: path.join(__dirname, 'data'),
  broadcast: (msg) => {
    const json = JSON.stringify(msg);
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});

app.get('/api/tasks', (req, res) => res.json({ tasks: tasks.list() }));
app.post('/api/tasks', (req, res) => {
  try { res.json({ success: true, task: tasks.create(req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.patch('/api/tasks/:id', (req, res) => {
  try { res.json({ success: true, task: tasks.update(req.params.id, req.body || {}) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.delete('/api/tasks/:id', (req, res) => {
  try { tasks.remove(req.params.id); res.json({ success: true }); }
  catch (e) { res.status(404).json({ error: e.message }); }
});
// Granular tag ops (atomic server-side — concurrent clients can't clobber
// each other's read-modify-write of the sessions array)
app.post('/api/tasks/:id/bind', (req, res) => {
  try { res.json({ success: true, task: tasks.bind(req.params.id, req.body?.sessionKey) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.post('/api/tasks/:id/unbind', (req, res) => {
  try { res.json({ success: true, task: tasks.unbind(req.params.id, req.body?.sessionKey) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.post('/api/tasks/:id/progress', (req, res) => {
  try { res.json({ success: true, task: tasks.addProgress(req.params.id, req.body || {}) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
// P4 repo task files: export a task to a committable markdown file / import one.
app.post('/api/tasks/:id/export', (req, res) => {
  try { res.json({ success: true, path: tasks.exportToFile(req.params.id, req.body?.path) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.post('/api/tasks/import', (req, res) => {
  try { res.json({ success: true, task: tasks.importFromFile(req.body?.path) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Remote context-folder auto-sync ("mount"): a REMOTE session's belonged
// groups with a contextDir get a live-synced copy at
// <remoteHome>/.vibespace/ctx/<groupId> (bidirectional rsync, newer-wins, no
// deletes, .vibespace excluded), and the injected file index is path-translated
// to the remote copy (remoteCtxBase). Triggers: session spawn + a 60s timer
// while any live remote session belongs to the group. Remote writes sync back
// → the local signature changes → every member re-injects next turn. ──
const { syncGroupCtx, FILE_CAP: CTX_FILE_CAP, MAX_FILES: MAX_CTX_FILES } = require('./src/ctx-sync');
const machineProbes = require('./src/machine-probes');
const { parseRateLimitEvent, captureRateLimitEvent } = require('./src/rate-limit-capture.js');
const _ctxSyncBusy = new Set(); // `${hostId}:${groupId}` in-flight guard
const _ctxSkipNoticed = new Set(); // one honest notice per host:group:file per boot
async function syncRemoteGroupCtx(h, g) {
  const key = `${h.id}:${g.id}`;
  if (_ctxSyncBusy.has(key)) return;
  _ctxSyncBusy.add(key);
  try {
    const home = await hosts.homeDir(h);
    if (!home) return;
    const rdir = `${home}/.vibespace/ctx/${g.id}`;
    // ONE implementation for every transport (src/ctx-sync.js, 2.277.0):
    // hashed newer-wins sync over the device link; ssh degrades to its legacy
    // rsync pair when the link is down. The old split (ssh=rsync uncapped,
    // dial=hashed with a SILENT 2MB/400-file cap) meant a 3MB context file
    // reached every ssh host and never reached a dial device, invisibly.
    await syncGroupCtx({
      hosts, host: h, group: g, remoteDir: rdir,
      onSkip: (rel, why, size) => {
        const k = `${key}:${rel}:${why}`;
        if (_ctxSkipNoticed.has(k)) return;
        _ctxSkipNoticed.add(k);
        const msg = why === 'count'
          ? `Context folder for "${g.title || g.id}" has more than ${MAX_CTX_FILES} files — the rest won't sync to ${h.name}.`
          : `Context file ${rel} (${Math.round((size || 0) / 1024 / 1024)}MB) exceeds the ${Math.round(CTX_FILE_CAP / 1024 / 1024)}MB sync cap and won't reach ${h.name}.`;
        console.warn('[ctx-sync]', msg);
        try { serverNotice(`ctx-skip:${k}`, msg, { level: 2 }); } catch { }
      },
    });
  } catch (e) { console.warn('[ctx-sync]', h.name, g.id, e.message); }
  finally { _ctxSyncBusy.delete(key); }
}
// Groups a session belongs to that have a syncable context folder.
function ctxGroupsOf(session, id) {
  if (!session.host) return [];
  return tasks.groupsForSession({ sessionKey: sessionStatusKey(session, id), cwd: session.cwd, initialGroupId: session._initialGroupId })
    .filter((g) => g.contextDir && g.injectContext !== false);
}
function scheduleCtxSync(session, id) {
  try {
    if (!session.host || !hosts) return;
    let h; try { h = hosts.get(session.host); } catch { return; }
    for (const g of ctxGroupsOf(session, id)) syncRemoteGroupCtx(h, g);
  } catch { }
}
setInterval(() => {
  try {
    if (!integrationEnabled()) return; // master switch off ⇒ no ctx-folder pushes either
    const seen = new Set();
    for (const [id, s] of activeSessions) {
      if (!s.host) continue;
      let h; try { h = hosts.get(s.host); } catch { continue; }
      for (const g of ctxGroupsOf(s, id)) {
        const k = s.host + ':' + g.id;
        if (seen.has(k)) continue;
        seen.add(k);
        syncRemoteGroupCtx(h, g);
      }
    }
  } catch { }
}, 60000);
// Absolute remote path the injection should show for a group's context folder
// (null → local session, keep local paths). Uses the cached remote home; if
// the home isn't known yet (first contact) fall back to local paths this turn.
function remoteCtxBaseFor(session) {
  if (!session.host || !hosts) return null;
  const home = hosts._homes?.get(session.host);
  if (!home) { try { hosts.homeDir(hosts.get(session.host)); } catch { } return null; } // warm the cache async
  return (gid) => `${home}/.vibespace/ctx/${gid}`;
}

// ── Anthropic accounts (subscription ↔ API/console per-session switching) ──
// Keys AES-GCM encrypted in data/accounts.json; injected as ANTHROPIC_API_KEY
// into the session's spawn env (process-env channel — never argv/proc-visible).
// The CLI's own /login is mutually exclusive; this store is what lets both
// identities coexist. Design: docs/design in CLAUDE.md "Accounts".
const { AccountManager } = require('./src/accounts');
const accounts = new AccountManager({
  dataDir: path.join(__dirname, 'data'),
  onChange: (list) => {
    const json = JSON.stringify({ type: 'accounts-updated', ...list });
    for (const client of wss.clients) if (client.readyState === WS_OPEN) client.send(json);
    broadcastActiveSessions(); // account names on live session cards may change
  },
});
// ── Usage history: a PERMANENT per-request token ledger mined from Claude's
// JSONL transcripts (terminal + chat), for the Usage window. resolveAccount
// bakes WHICH account + its billing TYPE into each event so subscription and
// API-key usage are never conflated. ──
const { UsageHistory } = require('./src/usage-history');
// Forward URL/token: user setting wins; the VIBESPACE_TELEMETRY_FORWARD_* env
// vars are the DEPLOYMENT defaults (helm/compose set them fleet-wide so no
// per-user settings edit is needed on managed instances).
const telemetry = new Telemetry({
  dataDir: path.join(__dirname, 'data'),
  version: require('./package.json').version,
  getForwardUrl: () => {
    try { return serverSetting('telemetry.forwardUrl') || process.env.VIBESPACE_TELEMETRY_FORWARD_URL || ''; }
    catch { return process.env.VIBESPACE_TELEMETRY_FORWARD_URL || ''; }
  },
  getForwardToken: () => {
    try { return serverSetting('telemetry.forwardToken') || process.env.VIBESPACE_TELEMETRY_FORWARD_TOKEN || ''; }
    catch { return process.env.VIBESPACE_TELEMETRY_FORWARD_TOKEN || ''; }
  },
});
// Server-side fatals land in the same ledger (journald has them too, but the
// diagnostics report should show one unified picture).
process.on('uncaughtException', (e) => {
  try { telemetry.record({ kind: 'server-error', name: e.message || 'uncaughtException', stack: e.stack }); telemetry.flush(); } catch {}
  // Same flush belt as the clean shutdown (2.219.0 audit) — a crash used to
  // drop up to 2s of debounced writes (layouts, session-status, user-todos).
  try { for (const store of Object.values(syncStores)) { try { store.flush(); } catch {} } } catch {}
  try { flushLayouts(); } catch {}
  try { sessionStatus.flush(); } catch {}
  try { userTodos.flush(); } catch {}
  console.error(e); process.exit(1);
});
process.on('unhandledRejection', (e) => { try { telemetry.record({ kind: 'server-error', name: (e && e.message) || 'unhandledRejection', stack: e && e.stack }); } catch {} console.error('unhandledRejection:', e); });

// Server performance metrics — RSS/heap, event-loop lag, live session count.
// Every 5 min; names-and-numbers only, same ndjson ledger as everything else.
{
  let lagProbeAt = Date.now();
  let maxLagMs = 0;
  setInterval(() => { // 1s cadence lag probe (cheap): drift beyond the interval = loop blocked
    const now = Date.now();
    const lag = now - lagProbeAt - 1000;
    if (lag > maxLagMs) maxLagMs = lag;
    lagProbeAt = now;
  }, 1000);
  setInterval(() => {
    try {
      const mu = process.memoryUsage();
      telemetry.record({ kind: 'metric', name: 'srv-rss-mb', value: Math.round(mu.rss / 1048576) });
      telemetry.record({ kind: 'metric', name: 'srv-heap-mb', value: Math.round(mu.heapUsed / 1048576) });
      telemetry.record({ kind: 'metric', name: 'srv-evloop-max-lag-ms', value: Math.max(0, maxLagMs) });
      telemetry.record({ kind: 'metric', name: 'srv-live-sessions', value: activeSessions.size });
      telemetry.record({ kind: 'metric', name: 'srv-ws-clients', value: wss.clients.size });
      // Leak canaries — the exact classes the 2.81-2.91 audits kept finding:
      // subagent watchers that outlive their agent, normalizer message piles.
      let watchers = 0, normMsgs = 0;
      for (const [, sess] of activeSessions) {
        watchers += sess.subagentWatchers?.size || 0;
        normMsgs += sess._normalizer?.total || 0;
      }
      telemetry.record({ kind: 'metric', name: 'srv-subagent-watchers', value: watchers });
      telemetry.record({ kind: 'metric', name: 'srv-normalizer-msgs', value: normMsgs });
      try { telemetry.record({ kind: 'metric', name: 'srv-buffer-files', value: fs.readdirSync(BUFFERS_DIR).length }); } catch {}
      if (_httpWin.n) {
        telemetry.record({ kind: 'metric', name: 'srv-http-reqs-5min', value: _httpWin.n });
        telemetry.record({ kind: 'metric', name: 'srv-http-avg-ms', value: Math.round(_httpWin.sum / _httpWin.n) });
        telemetry.record({ kind: 'metric', name: 'srv-http-max-ms', value: Math.round(_httpWin.max) });
        for (const sl of _httpWin.slow) telemetry.record({ kind: 'event', name: `slow-request ${sl.route}`, value: sl.ms });
        _httpWin.n = 0; _httpWin.sum = 0; _httpWin.max = 0; _httpWin.slow.length = 0;
      }
      maxLagMs = 0;
    } catch {}
  }, 300000);
}

// Zero-coupling metric hook for deep modules (session-store slow-parse etc.)
global.__vsMetric = (name, value) => { try { telemetry.record({ kind: 'metric', name, value }); } catch {} };
// Server-side EVENT hook (2.207.0): the debugging-pain batch — session
// lifecycle anomalies, CLI error classes, probe failures — flows into the
// same Diagnostics report/fleet forwarding as client events. NAMES + short
// enum-ish details only, never content (telemetry charter).
global.__vsEvent = (name, detail) => { try { telemetry.record({ kind: 'event', name, detail }); } catch {} };

// ── Threadpool canary (2.108.6) ──
// The wedge class that took the instance down twice today (hung fuse IO) fills
// the libuv threadpool while the EVENT LOOP stays healthy — evloop-lag metrics
// see nothing. Canary: a stat() of our own package.json (always-fast local
// disk) must round-trip through the pool; when it exceeds the deadline three
// times in a row, the pool is wedged by SOMETHING — log loudly, record
// telemetry, and kick the mount health sweep (the known culprit class) without
// waiting for its 60s timer. Self-healing for known causes, loud for unknown.
{
  const CANARY_FILE = path.join(__dirname, 'package.json');
  let canaryStrikes = 0;
  let canaryBusy = false;
  setInterval(() => {
    if (canaryBusy) return; // previous canary still in flight = already wedged; strikes accrue on its resolution
    canaryBusy = true;
    const t0 = Date.now();
    const deadline = setTimeout(() => {
      canaryBusy = false;
      canaryStrikes++;
      console.error(`[canary] threadpool stat() exceeded 5s (strike ${canaryStrikes}) — pool likely wedged`);
      telemetry.record({ kind: 'metric', name: 'srv-fs-canary-ms', value: 5000 });
      if (canaryStrikes >= 3) {
        canaryStrikes = 0;
        telemetry.record({ kind: 'event', name: 'srv-threadpool-wedged' });
        try { mounts._healthSweep().catch(() => {}); } catch {}
      }
    }, 5000);
    fs.promises.stat(CANARY_FILE).then(() => {
      clearTimeout(deadline);
      if (!canaryBusy) return; // deadline already fired for this run
      canaryBusy = false;
      canaryStrikes = 0;
      const ms = Date.now() - t0;
      // record anomalies only — a healthy sub-ms canary every 10s is noise
      if (ms > 1000) telemetry.record({ kind: 'metric', name: 'srv-fs-canary-ms', value: ms });
    }).catch(() => { clearTimeout(deadline); canaryBusy = false; });
  }, 10000).unref();
}

const usageHistory = new UsageHistory({
  dataDir: path.join(__dirname, 'data'),
  resolveAccount: (id) => {
    const a = (accounts.list().accounts || []).find((x) => x.id === id);
    if (!a) return null;
    return { type: a.backend === 'codex' ? 'codex-subscription' : a.type, name: a.name, tail: a.tail };
  },
});
// Attribution log: dedup'd per (sid,acct) so a resume under a DIFFERENT account
// is captured with its timestamp (per-request-by-time attribution). Called from
// writeSessionMeta whenever a session has both a claudeSessionId and account.
const _lastAttrib = new Map();
function recordUsageAttribution(meta) {
  const sid = meta && (meta.claudeSessionId || meta.backendSessionId);
  if (!sid) return;
  let acct = meta.accountId || null;
  let pool = null;
  // A POOLED session bills whatever the pool currently points at — attribute
  // the ledger to the REAL target at record time (attribution is by-time, so
  // a later re-point + re-record moves subsequent requests to the new target).
  // Keep the pool id as a SEPARATE tag (#4): acct stays the real target so
  // per-account and the global sum are correct with NO double-count, while pool
  // lets the Usage window show the total that flowed through each pool.
  // An unresolvable pool target (broken symlink / logged-out member) falls to
  // GLOBAL, never to the pool id itself — else a `type:'pooled'` pseudo-account
  // would surface as a spender in the account dimension (review low-confidence
  // finding). The pool tag is still recorded (pool captured above).
  try {
    if (acct && accounts.get(acct)?.type === 'pooled') {
      pool = acct;
      // Plan C: a session with its OWN link bills that link's target — the
      // live session is looked up by conversation id (the attribution key we
      // were handed) so the per-session choice lands in the ledger.
      let sessKey = null;
      try { for (const [wid, s2] of activeSessions) if ((s2.claudeSessionId || s2.backendSessionId) === sid && s2._accountId === acct) { sessKey = wid; break; } } catch { }
      acct = accounts.poolCurrentFor(acct, sessKey) || null;
    }
  } catch {}
  const attribKey = (acct || '') + '|' + (pool || '');
  if (_lastAttrib.get(sid) === attribKey) return;
  _lastAttrib.set(sid, attribKey);
  // Cap only — never delete-on-kill: kill→resume of the same sid (terminate/
  // resume, billing switch) would re-append a duplicate attribution line.
  if (_lastAttrib.size > 4096) _lastAttrib.delete(_lastAttrib.keys().next().value);
  usageHistory.recordAttribution({ sid, acct, pool, ts: Date.now() });
}
// Rescan the ledger periodically (incremental — only new JSONL bytes). Also
// rescanned on demand when the Usage window opens.
setTimeout(() => { try { usageHistory.scan(); usageHistory.warm(); } catch {} }, 8000);
setInterval(() => { try {
  const t0 = Date.now();
  const r = usageHistory.scan();
  if (!r?.skipped) telemetry.record({ kind: 'metric', name: 'srv-usage-scan-ms', value: Date.now() - t0 });
} catch {} }, 180000);
// Telemetry ingest (client errors + feature events) + diagnostics summary.
// telemetry.enabled=false drops ingest silently (client still posts — cheap).
app.post('/api/telemetry', (req, res) => {
  try {
    let enabled = true;
    try { enabled = serverSetting('telemetry.enabled') !== false; } catch {}
    if (enabled) {
      const events = Array.isArray(req.body?.events) ? req.body.events.slice(0, 20) : [];
      for (const ev of events) telemetry.record(ev);
    }
    res.json({ success: true });
  } catch { res.json({ success: true }); }
});
app.get('/api/telemetry/summary', (req, res) => {
  try {
    telemetry.flush();
    res.json(telemetry.summary({ days: Math.min(parseInt(req.query.days) || 14, 90) }));
  } catch (e) { res.status(500).json({ error: e.message }); }
});
// ── Central collector (team deployments): other instances POST their batches
// here (telemetry.forwardUrl → https://<collector>/api/telemetry/ingest).
// Enabled ONLY when VIBESPACE_TELEMETRY_INGEST_TOKEN is set — the shared
// Bearer token is both the on-switch and the whole gate (cookie-auth exempt
// in auth.js: remote instances have no cookie). Same privacy model as local
// events: names/stacks/metrics only, never content. ──
const TELEMETRY_INGEST_TOKEN = (process.env.VIBESPACE_TELEMETRY_INGEST_TOKEN || '').trim();
app.post('/api/telemetry/ingest', (req, res) => {
  if (!TELEMETRY_INGEST_TOKEN) return res.status(404).json({ error: 'collector disabled' });
  const crypto = require('crypto');
  const got = Buffer.from(String(req.headers.authorization || ''));
  const want = Buffer.from(`Bearer ${TELEMETRY_INGEST_TOKEN}`);
  if (got.length !== want.length || !crypto.timingSafeEqual(got, want)) {
    return res.status(403).json({ error: 'bad token' });
  }
  try {
    const n = telemetry.ingestRemote(req.body?.instance, req.body?.events);
    res.json({ success: true, n });
  } catch { res.json({ success: true, n: 0 }); }
});
app.get('/api/telemetry/central-summary', (req, res) => {
  try {
    res.json({ collector: !!TELEMETRY_INGEST_TOKEN, ...telemetry.centralSummary({ days: Math.min(parseInt(req.query.days) || 14, 90) }) });
  } catch (e) { res.status(500).json({ error: e.message }); }
});

app.get('/api/usage-stats', (req, res) => {
  try {
    usageHistory.scan(); // pick up anything new before answering
    const from = req.query.from ? parseInt(req.query.from, 10) : null;
    const to = req.query.to ? parseInt(req.query.to, 10) : null;
    const backend = req.query.backend || null;
    // account = comma list of ledger bucket keys (account ids / '__global__')
    const accounts = req.query.account ? new Set(String(req.query.account).split(',').filter(Boolean)) : null;
    // pivot = comma list of 'dimA:dimB' 2-D crosses (dashboard split-series
    // panels, e.g. pivot=day:account) — validated + capped in aggregate/here
    const pivots = req.query.pivot
      ? String(req.query.pivot).split(',').map((s) => s.split(':')).filter((p) => p.length === 2).slice(0, 6)
      : null;
    // host = the DEVICE filter ('local' | a host id) — top-level over the view
    const hostFilter = req.query.host ? String(req.query.host) : null;
    res.json(usageHistory.aggregate({ from, to, backend, accounts, hostFilter, pivots }));
  } catch (e) { res.status(500).json({ error: e.message }); }
});
// Per-message account attribution for the msg-meta popup (2.266.1, user
// request): which account served this requestId, per the ledger's baked
// attribution (aname frozen at scan time; pool = billed THROUGH it).
app.get('/api/usage-stats/rid-info', (req, res) => {
  try {
    let ev = req.query.rid ? usageHistory.eventForRid(String(req.query.rid)) : null;
    // live stdout records carry NO requestId — message.id is the join field
    // both transports share (the 2.267.3 rule), so the popup can attribute
    // EVERY reply, not just history-rebuilt ones.
    if (!ev && req.query.mid) ev = usageHistory.eventForMid(String(req.query.mid));
    if (!ev) return res.json({ found: false });
    let poolName = null;
    try { poolName = ev.pool ? (accounts.get(ev.pool)?.name || null) : null; } catch { }
    let hostName = null;
    try { hostName = ev.host ? (hosts.get(ev.host)?.name || null) : null; } catch { }
    res.json({ found: true, acct: ev.acct || null, aname: ev.aname || null, atype: ev.atype || 'global', pool: ev.pool || null, poolName, host: ev.host || null, hostName });
  } catch (e) { res.status(500).json({ error: e.message }); }
});
app.get('/api/usage-stats/pricing', (req, res) => res.json({ pricing: usageHistory.pricingTable() }));
app.post('/api/usage-stats/pricing', (req, res) => {
  try { usageHistory.setPricing(req.body || {}); res.json({ success: true, pricing: usageHistory.pricingTable() }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/accounts', (req, res) => {
  const out = {
    ...accounts.list(),
    subscription: accounts.subscriptionStatus(),
    cliKey: accounts.cliPrimaryKey(),
  };
  // Host id → display name map (2.244.1, real screenshot: the roster's
  // "logged in on host-9a86e4fb" — raw ids leaked whenever the sidebar's
  // hosts data wasn't loaded yet; the server always knows the names)
  try { out.hostNames = Object.fromEntries((hosts.list?.() || []).map((h) => [h.id, h.name || h.id])); } catch { }
  // LOCAL verdicts (B-f531): same authority as the per-host ones
  try {
    out.verdicts = {};
    for (const a of (out.accounts || [])) {
      try { out.verdicts[a.id] = accounts.evaluateOnHost(accounts.get(a.id), null, {}); } catch { }
    }
  } catch { }
  res.json(out);
});
app.post('/api/accounts', (req, res) => {
  try { res.json({ success: true, account: accounts.add(req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/accounts/import-cli', (req, res) => {
  try { res.json({ success: true, account: accounts.importFromCli() }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Anthropic login state ON a remote host (subscription OAuth? console key?) —
// powers the Manage Agents accounts section when a host is selected.
app.get('/api/hosts/:id/accounts-status', async (req, res) => {
  try {
    const r = await hosts.accountsStatus(req.params.id);
    // Same-account auto-recognition on the HOST side (2.205.0): a host dir
    // whose identity email matches a DIFFERENT existing subscription means
    // duplicate records of one real account — rename the host dir to the
    // survivor and fold the records (the local finalize path does the same
    // for local logins). Learned dir emails also backfill records that
    // never declared one (enables the =host-login link).
    // On macOS the Keychain service name is hashed from the dir path. Renaming
    // a host dir cannot migrate that item from this non-interactive server
    // context, so keep duplicate records rather than silently selecting stale
    // credentials or orphaning the fresh service.
    if (accounts && r.hostSubEmails && r.platform && r.platform !== 'darwin') {
      for (const [dirId, email] of Object.entries(r.hostSubEmails)) {
        try {
          const em = String(email).trim().toLowerCase();
          const all = accounts.list().accounts || [];
          const rec = all.find((x) => x.id === dirId);
          if (!rec) continue;
          if (!rec.email) { try { accounts.setEmail(dirId, email); } catch { } }
          const dup = all.find((x) => x.id !== dirId && (x.backend || 'claude') === 'claude' && x.type === 'subscription'
            && String(x.email || (String(x.name || '').includes('@') ? x.name : '')).trim().toLowerCase() === em);
          if (dup) {
            // A Darwin VibeSpace marks these records local-only even when this
            // particular copy lives on a Linux host. Be conservative: check
            // before renaming so mergeSubscription cannot reject after the
            // host path has already changed.
            if (rec.localOnly || dup.localOnly) continue;
            // survivor = the OLDER record; rename the newer's host dir first
            const survivor = (dup.createdAt || 0) <= (rec.createdAt || 0) ? dup : rec;
            const gone = survivor === dup ? rec : dup;
            if ((r.hostSubs || []).includes(gone.id) && await hosts.renameHostSubDir(req.params.id, gone.id, survivor.id)) {
              const i = r.hostSubs.indexOf(gone.id);
              if (i >= 0) r.hostSubs.splice(i, 1, survivor.id);
            }
            try { accounts.mergeSubscription(gone.id, survivor.id, { preferFromCreds: false, liveAccountIds: liveAccountIdSet() }); }
            catch (me) { if (me.code !== 'merge-account-live') throw me; /* live session — leave both records, merge on a later probe */ }
          }
        } catch { /* best-effort per-dir; a failed merge keeps both records */ }
      }
    }
    // remember which accounts hold a login ON this host — every view (incl.
    // local, which probes no host) can then show "logged in on X" (2.204.0)
    try { accounts?.noteHostLogins?.(req.params.id, r.hostSubs || []); } catch { }
    // Per-account VERDICTS (B-f531, 2.244.0): the single evaluateOnHost
    // authority, computed against these LIVE facts — client surfaces render
    // these verbatim and never compute their own from page caches.
    try {
      const facts = { ...r, hostId: req.params.id, transport: hosts.get(req.params.id)?.transport === 'dial' ? 'dial' : 'ssh' };
      let allowShip = false;
      try { allowShip = !!serverSetting('accounts.shipSubscriptionToRemote'); } catch { }
      r.verdicts = {};
      for (const a of (accounts.list().accounts || [])) {
        try { r.verdicts[a.id] = accounts.evaluateOnHost(a, facts, { allowShip }); } catch { }
      }
    } catch { }
    res.json(r);
  }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Import the console-login key minted on a REMOTE host into the central store
// (the store is host-agnostic — keys are pushed per-session wherever needed).
app.post('/api/accounts/import-cli-host', async (req, res) => {
  try {
    const { key, org } = await hosts.cliPrimaryKey(req.body?.hostId);
    if (!key) return res.status(400).json({ error: 'no primaryApiKey on that host — log in to a Console account there first' });
    const hostName = (() => { try { return hosts.get(req.body?.hostId)?.name; } catch { return null; } })();
    res.json({ success: true, account: accounts.add({ name: (org || 'Console') + ' (API' + (hostName ? ', ' + hostName : '') + ')', key, source: 'cli-import', originHost: hostName }) });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/accounts/default', (req, res) => {
  // backend needed only when CLEARING (id null) — otherwise it's derived from
  // the account. Each backend (claude/codex) keeps its own default.
  try { accounts.setDefault(req.body?.id || null, req.body?.backend || 'claude'); res.json({ success: true }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/accounts/:id/key', (req, res) => {
  // reveal the decrypted key on request (cookie-authed; mounts-config trust
  // model) — the store is the MASTER copy and the Console can't re-show it
  try { res.json({ key: accounts.revealKey(req.params.id) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.patch('/api/accounts/:id', (req, res) => {
  try {
    let account = null;
    if (req.body?.name !== undefined) account = accounts.rename(req.params.id, req.body.name);
    if (req.body?.email !== undefined) account = accounts.setEmail(req.params.id, req.body.email);
    if (req.body?.note !== undefined) account = accounts.setNote(req.params.id, req.body.note);
    res.json({ success: true, account });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/accounts/:id', (req, res) => {
  try {
    const _wasPool = accounts.get(req.params.id)?.type === 'pooled';
    accounts.remove(req.params.id); // throws for unknown ids → only real (shape-safe) ids continue
    // DISARM the device reflex for a deleted pool — a stale snapshot could
    // otherwise recreate the deleted pool's symlink in a server-down window
    if (_wasPool) clearSealedOrders(req.params.id);
    // Best-effort: clear whatever this account left on each host — a 0600 key
    // file (API), a securestorage creds dir (Claude sub), or a CODEX_HOME copy
    // (Codex sub). Fire-and-forget; unreachable hosts are fine (the leftovers
    // are useless without the account, but tidy up when we can).
    const rid = req.params.id;
    if (/^(acct|sub|cxs)-[a-f0-9]+$/.test(rid) && hosts) {
      const { execFile } = require('child_process');
      const rm = `rm -f "$HOME/.vibespace/${rid}.key"; rm -rf "$HOME/.vibespace/subs/${rid}" "$HOME/.vibespace/codex-subs/${rid}"`;
      for (const h of hosts.list() || []) {
        try { execFile('ssh', [...hosts.sshArgs(h), '--', rm], { timeout: 15000 }, () => {}); } catch { }
      }
    }
    res.json({ success: true });
  }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Multi-subscription: hold several Claude Max/Pro logins at once, each in
// its own securestorage creds dir (CLAUDE_SECURESTORAGE_CONFIG_DIR). Create
// allocates the dir + returns the login command the client runs in a terminal;
// finalize reads back the identity once the OAuth login has written creds. ──
// ── Pooled pseudo-account (B-6217) ────────────────────────────────────────
// The pool's creds dir is a DIRECTORY SYMLINK at data/subs/<poolId>; switching
// = re-pointing it (accounts.setPoolTarget). See the accounts.js section header
// for why a directory symlink is the only shape that keeps ONE credential copy
// (and therefore one refresh-token holder) while still swapping per-spawn.
app.post('/api/accounts/pool', (req, res) => {
  try { res.json({ success: true, ...accounts.createPool({ name: req.body?.name, members: req.body?.members }) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.patch('/api/accounts/pool/:id', (req, res) => {
  try {
    const id = req.params.id;
    // Narrowing the member list away from the CURRENT target makes updatePool
    // re-point IMMEDIATELY (symlink swap) — a running claude re-reads the
    // credential file mid-session, so this must mirror /target's contract
    // (review B1): re-record attribution for live pooled sessions + return
    // `affected` so the dialog can cold-restart them. Silently it mis-billed
    // the OLD target for everything after the swap.
    const before = accounts.poolCurrent(id);
    accounts.updatePool(id, { members: req.body?.members, auto: req.body?.auto, hot: req.body?.hot });
    // auto turned OFF ⇒ disarm the device reflex too, or the daemon keeps
    // switching a pool the user just set to manual (review finding)
    if (req.body?.auto === false) clearSealedOrders(id);
    const after = accounts.poolCurrent(id);
    const affected = [];
    if (before !== after) {
      for (const [sid, sess] of activeSessions) {
        if (sess._accountId !== id) continue;
        try { recordUsageAttribution({ claudeSessionId: sess.claudeSessionId || sess.backendSessionId, accountId: id }); } catch {}
        affected.push({ serverId: sid, backend: sess.backend || 'claude', backendSessionId: sess.claudeSessionId || sess.backendSessionId || null, cwd: sess.cwd || null, name: sess.name || null, host: sess.host || null });
      }
    }
    res.json({ success: true, retargeted: before !== after ? { from: before, to: after, name: after ? (accounts.get(after)?.name || after) : null } : null, affected });
  }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Re-point. Returns the live sessions billed to this pool so the CLIENT can
// restart them (v1 = cold swap; the client owns kill+resume, same machinery as
// the billing switcher). `hot` pools skip the restart — the running CLI
// re-reads the credential file on its next request.
app.post('/api/accounts/pool/:id/target', (req, res) => {
  try {
    const id = req.params.id;
    const before = accounts.poolCurrent(id);
    const r = accounts.setPoolTarget(id, String(req.body?.accountId || ''));
    const affected = [];
    for (const [sid, s] of activeSessions) {
      if (s._accountId !== id) continue;
      affected.push({ serverId: sid, backend: s.backend || 'claude', backendSessionId: s.claudeSessionId || s.backendSessionId || null, cwd: s.cwd || null, name: s.name || null, host: s.host || null });
    }
    res.json({ success: true, ...r, previous: before, affected });
  } catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Long-lived token (oat01, B-211a) ──────────────────────────────────────
// Minting one (claude setup-token, 1-year, no refresh) is the per-account
// consent to run this subscription on remote machines — it ships as
// CLAUDE_CODE_OAUTH_TOKEN over the same 0600-file channel API keys use.
app.post('/api/accounts/:id/oat', (req, res) => {
  try { res.json({ success: true, ...accounts.setOat(req.params.id, req.body?.token) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/accounts/:id/oat', (req, res) => {
  try {
    accounts.clearOat(req.params.id);
    // The spawn channel left 0600 working copies (~/.vibespace/<id>.key) on
    // hosts — sweep them best-effort like account delete does (the still-valid
    // 1-year token must not outlive its removal where we can reach).
    const rid = req.params.id;
    if (/^sub-[a-f0-9]+$/.test(rid) && hosts) {
      const { execFile } = require('child_process');
      for (const h of hosts.list() || []) {
        try { execFile('ssh', [...hosts.sshArgs(h), '--', `rm -f "$HOME/.vibespace/${rid}.key"`], { timeout: 15000 }, () => {}); } catch { }
      }
    }
    res.json({ success: true });
  }
  catch (e) { res.status(400).json({ error: e.message }); }
});

app.post('/api/accounts/subscription', (req, res) => {
  try {
    const { id, dir } = accounts.createSubscription(req.body || {});
    // The client opens a shell terminal with this exact command. The helper
    // runs the official `claude auth login --claudeai` with BOTH config envs
    // scoped to the pre-seeded account dir, isolating credentials + identity
    // without touching the global login. On macOS it then copies the new
    // per-dir Keychain value to Claude's normal fallback file while it is still
    // in the interactive terminal's Keychain security session; launchd-started
    // VibeSpace processes cannot reliably read that item later.
    const loginCmd = buildClaudeSubscriptionLoginCommand({
      nodeCmd: NODE_CMD,
      helperPath: CLAUDE_SUBSCRIPTION_LOGIN_HELPER,
      claudeCmd: CLAUDE_CMD,
      configDir: dir,
    });
    res.json({ success: true, id, dir, loginCmd });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/accounts/subscription/:id/finalize', (req, res) => {
  try {
    const fin = accounts.finalizeSubscription(req.params.id);
    // Same-account auto-recognition (2.205.0, real ask "这个不能自动识别吗"):
    // a fresh login whose identity email matches an EXISTING subscription is
    // the SAME account — fold the new record into the existing one (fresh
    // creds win) instead of keeping a duplicate.
    // A macOS Keychain service is tied to this fresh config-dir path. Folding
    // its file fallback into an older id would leave Claude preferring the
    // older id's stale Keychain item, so Darwin logins deliberately keep their
    // fresh record instead of using the path-changing auto-merge.
    if (fin?.loggedIn && fin?.email && !fin.localOnly && accounts) {
      const em = String(fin.email).trim().toLowerCase();
      const dup = (accounts.list().accounts || []).find((x) =>
        x.id !== req.params.id && (x.backend || 'claude') === 'claude' && x.type === 'subscription'
        && String(x.email || (String(x.name || '').includes('@') ? x.name : '')).trim().toLowerCase() === em);
      if (dup) {
        try {
          const merged = accounts.mergeSubscription(req.params.id, dup.id, { preferFromCreds: true, liveAccountIds: liveAccountIdSet() });
          return res.json({ success: true, ...fin, merged: true, account: merged });
        } catch (me) {
          if (me.code !== 'merge-account-live') throw me;
          // logged in, but a running session blocks the auto-fold — keep both, tell the user
          return res.json({ success: true, ...fin, merged: false, mergeBlocked: 'a session using one of these accounts is running — stop it to auto-merge the duplicate' });
        }
      }
    }
    res.json({ success: true, ...fin });
  }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Add a Console account safely: the /login runs in an isolated dir so it can't
// wipe the global subscription; we capture the minted key from that dir.
app.post('/api/accounts/console-login', (req, res) => {
  try {
    const { id, dir } = accounts.beginConsoleLogin();
    // BOTH env vars → dir (pre-seeded, no onboarding): the console login's
    // .credentials.json wipe AND the minted primaryApiKey land in the isolated
    // dir; ~/.claude and ~/.claude.json are untouched. capture reads the dir.
    const q = JSON.stringify(dir);
    const loginCmd = `CLAUDE_CONFIG_DIR=${q} CLAUDE_SECURESTORAGE_CONFIG_DIR=${q} claude auth login --console`;
    res.json({ success: true, id, loginCmd });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/accounts/console-login/:id/capture', (req, res) => {
  try { res.json({ success: true, ...accounts.captureConsoleLogin(req.params.id, req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Codex multi-subscription: same idea via CODEX_HOME. Codex has no auth-only
// relocation env, so each account is an isolated CODEX_HOME whose sessions/ +
// config.toml SYMLINK the shared ~/.codex — auth.json is real per-account,
// threads land in the shared sessions dir (unified discovery). `codex login`
// prints an OAuth URL to a hosted callback (headless-friendly). ──
app.post('/api/accounts/codex-subscription', (req, res) => {
  try {
    const { id, dir } = accounts.createCodexSubscription(req.body || {});
    // --device-auth: prints a URL + one-time code (no localhost:1455 callback
    // server), so it works when the browser is on a DIFFERENT machine than this
    // server (team/remote deploys) — same headless philosophy as claude's
    // paste-code login. CODEX_HOME points at the isolated per-account dir.
    const loginCmd = `CODEX_HOME=${JSON.stringify(dir)} codex login --device-auth`;
    res.json({ success: true, id, dir, loginCmd });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/accounts/codex-subscription/:id/finalize', (req, res) => {
  try { res.json({ success: true, ...accounts.finalizeCodexSubscription(req.params.id) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Session status (agent-set via vibespace-status CLI, user-overridable) ──
// The user's override of an agent-set status is injected as a system-reminder
// into the NEXT chat message (see ws-handler chat-input) so the agent learns
// the user disagreed with its self-assessment.
const { SessionStatusManager } = require('./src/session-status');
const sessionStatus = new SessionStatusManager({
  dataDir: path.join(__dirname, 'data'),
  onChange: (statuses) => {
    const json = JSON.stringify({ type: 'session-status-updated', statuses });
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
function sessionStatusKey(session, id) {
  const bsid = session?.backendSessionId || session?.claudeSessionId;
  return bsid ? `${session.backend || 'claude'}:${bsid}` : `webui:${id}`;
}
// ── Global user-facing TODO list (vibespace-ask) — items an agent filed that
// need the USER (decision/input/review). Merged inbox in the taskbar; each
// item belongs to one session and jumps back to it.
const { UserTodoManager } = require('./src/user-todos');
const userTodos = new UserTodoManager({
  dataDir: path.join(__dirname, 'data'),
  onChange: (todos) => {
    const json = JSON.stringify({ type: 'user-todos-updated', todos });
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
app.get('/api/user-todos', (req, res) => res.json({ todos: userTodos.snapshot() }));
// User actions from the panel: done / dismissed / open (reopen)
app.post('/api/user-todos/:id', (req, res) => {
  try { res.json({ success: true, item: userTodos.setStatus(req.params.id, req.body?.status, 'user') }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Agent endpoint (vibespace-ask) — per-session vsst_ token, same auth model as
// /api/agent/session-status; writes scoped to the calling agent's own session.
// ── Agent-facing routes ── (extracted to src/agent-routes.js in the 2.92.0 split)
const { setupAgentRoutes } = require('./src/agent-routes');
setupAgentRoutes({ app, activeSessions, tasks, sessionStatus, SessionStatusManager, userTodos, sessionStatusKey, serverSetting, scheduleCtxSync, remoteCtxBaseFor, readUserState: () => persistenceRouter.readUserState() });
app.get('/api/agent-hooks', (req, res) => res.json({ ...agentHooksStatus(), integrationOff: !integrationEnabled() }));
app.post('/api/agent-hooks/install', (req, res) => {
  // The master switch outranks the button: boot/toggle would strip the entries
  // right back — refuse with guidance instead of silently contradicting.
  if (!integrationEnabled()) return res.status(400).json({ error: 'VibeSpace integration is disabled (Settings → Integration → master switch). Enable it first.' });
  createHookHelper(); // regenerate the script too (repair path)
  const results = ensureAgentHooks({ auto: false }); // explicit → clears any opt-out
  res.json({ success: true, results, status: agentHooksStatus() });
});
app.post('/api/agent-hooks/uninstall', (req, res) => {
  removeAgentHooks();
  res.json({ success: true, status: agentHooksStatus() });
});

// ── Hosts (the MACHINE registry — ssh hosts AND dial-out devices, B-f3e8) ──
const { HostManager } = require('./src/hosts');
const hosts = new HostManager({ dataDir: path.join(__dirname, 'data') });
const bcastAll = (msg) => { const j = JSON.stringify(msg); wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(j); } catch {} } }); };
// B-f3e8 one-time migration: dial-tokens.json (deviceId → sha256) folds into
// the dial host records (dialTokenHash) — see hosts.migrateDialTokenFile.
try { hosts.migrateDialTokenFile(path.join(AGENTD_DIR, 'dial-tokens.json')); }
catch (e) { console.warn('[hosts] dial-token migration failed:', e.message); }
hosts.dialOnline = (deviceId) => agentdDials.has(deviceId);
// ── R4 push-triggered remote ledger (docs/design-three-tier.md): a connected
// daemon fs.watches its transcript dirs (.claude/sessions+projects and
// .codex/sessions) and pushes one debounced dirty per change burst; we
// harvest promptly instead of waiting for a turn-end result or the idle
// 15-min cadence. harvestUsage's own 60s/host floor bounds frequency, and
// the op harvest (2.286.0) is incremental + cheap — so ANY remote activity
// (mid-turn tool storms, codex, external terminals) reaches the ledger and
// the billing popup within ~a minute. One dirty signal, two consumers: this
// kick + discovery cache invalidation (armed in hosts._armDirtyPush). ──
// usage-events PUSH consumer (R4 finale, 2.299.0): batches arrive
// seconds-fresh over the device link; ingest through the SAME pipeline the
// pull harvest uses (attribution + rid namespacing + host-bucket honesty),
// then invalidate the estimator so the next pool decision sees the spend.
// Returning normally (not false) tells hosts to ACK — which is what commits
// the device-side cursor (two-phase). A throw leaves the batch unacked → the
// daemon re-emits → rid dedup absorbs the replay.
// ── Session-brain step 2: the DARK comparator ───────────────────────────────
// The daemon streams its own normalizer's ops for its pipe sessions; the
// server compares mids against ITS parse of the same relayed stdout and does
// NOTHING else with them. Content-derived mids (R0) make equality meaningful.
// Metrics tell us when parity has earned step 3: sb-parity-hit / sb-parity-
// miss per batch, plus a throttled divergence log naming the first differing
// mid. Rings are bounded and per-sid; a session's ring dies with it.
const _sbRings = new Map(); // key `<hostId>:<sid>` → { device:[], server:[], lastWarnAt }
const SB_RING_MAX = 400;
function _sbRing(key) {
  let r = _sbRings.get(key);
  if (!r) { r = { device: [], server: [], lastWarnAt: 0 }; _sbRings.set(key, r); if (_sbRings.size > 512) _sbRings.delete(_sbRings.keys().next().value); }
  return r;
}
// mids are PREFIXED with the emitting normalizer's session id (`<id>:m:…`) —
// device uses ITS sid (keeperSid), the server uses the webui id, so parity
// compares the SUFFIX after the first ':' (the content-derived half).
const _sbMidCore = (id) => { const s2 = String(id); const i = s2.indexOf(':'); return i >= 0 ? s2.slice(i + 1) : s2; };
function sbNoteServerOp(hostId, sid, op) {
  try {
    if (!hostId || !op || op.op !== 'create' || !op.msg?.id) return;
    const r = _sbRing(hostId + ':' + sid);
    r.server.push(_sbMidCore(op.msg.id));
    if (r.server.length > SB_RING_MAX) r.server.splice(0, r.server.length - SB_RING_MAX);
    sbCompare(hostId, sid, r);
  } catch { }
}
function sbCompare(hostId, sid, r) {
  // parity = every device-seen create mid eventually appears in the server
  // ring (and vice versa within the window). Order-insensitive set compare
  // over the overlap — the two taps run at different cadences by design.
  const dev = new Set(r.device), srv = new Set(r.server);
  let hit = 0, miss = 0, firstMiss = null;
  for (const m of dev) { if (srv.has(m)) hit++; else if (r.server.length >= 5) { miss++; if (!firstMiss) firstMiss = m; } }
  if (hit) global.__vsMetric?.('sb-parity-hit', hit);
  if (miss) {
    global.__vsMetric?.('sb-parity-miss', miss);
    const now = Date.now();
    if (now - r.lastWarnAt > 300000) {
      r.lastWarnAt = now;
      console.warn(`[session-brain] parity divergence ${hostId}:${sid} — ${miss} device mid(s) unseen by the server parse (first: ${String(firstMiss).slice(0, 60)}) — step 3 stays gated until this is zero`);
      global.__vsEvent?.('sb-parity-diverged', { detail: `${hostId}:${sid} miss=${miss}` });
    }
  }
}
// ── Session-brain STEP 3 (2.317.0): consumers go DEVICE-FIRST ──────────────
// The six side-effect families (served model, usage odometer, rate-limit
// events, limit banners, fallback belts, task/todo state) now run from the
// DEVICE's raw-record stream when the daemon owns the session's stdout, with
// the server's own parse as the automatic backstop. Single-owner per RECORD,
// not per session: a bounded first-writer-wins gate keyed by record identity
// means the transition needs no offset surgery — whichever feed sees a record
// first performs its side effects, the other finds the key taken and skips.
// A dead device stream degrades to exactly the pre-step-3 world with zero
// coordination. The NORMALIZER/msg-broadcast path deliberately stays
// server-owned until R6 (the client protocol is untouched by this step).
const SB_SEEN_MAX = 600;
function sbSeenFirst(session, rec) {
  const key = rec.uuid || ((rec.requestId || rec.message?.id || '') + ':' + (rec.type || '') + ':' + (rec.subtype || ''));
  if (!key || key === '::') return true; // unidentifiable records: let both run (idempotent families only)
  const seen = session._sbSeen || (session._sbSeen = new Set());
  if (seen.has(key)) return false;
  seen.add(key);
  if (seen.size > SB_SEEN_MAX) { const it = seen.values(); for (let i = 0; i < 100; i++) seen.delete(it.next().value); }
  return true;
}
// The side-effect families, ONE implementation fed by either stream. Kept
// deliberately to the granular consumer functions — inline duplication of the
// parse block is the drift the CS rules ban.
function claudeSideEffects(session, sid, msg) {
  try {
    if (msg.type === 'assistant' && msg.message?.model && msg.message.model !== '<synthetic>' && !msg.parent_tool_use_id && !msg.isSidechain) {
      session._servedModel = msg.message.model; session._servedModelAt = Date.now();
    }
    if (msg.type === 'assistant' && msg.message?.usage && (msg.requestId || msg.message?.id) && !(session.host && !session._accountId)) {
      try {
        const u = msg.message.usage; const cc = u.cache_creation || {};
        const acctKey = resolveUsageKey(session);
        const mkCost = (i, o, cw5, cw1, cr) => usageHistory._cost({ acct: acctKey === '__global__' ? null : acctKey, model: msg.message.model, i, o, cw5, cw1, cr });
        usageEstimator.noteLive({ rid: msg.requestId || msg.message.id, accountId: acctKey, model: msg.message.model,
          usd: mkCost(u.input_tokens || 0, u.output_tokens || 0, cc.ephemeral_5m_input_tokens || 0, cc.ephemeral_1h_input_tokens || 0, u.cache_read_input_tokens || 0),
          cwUsd: mkCost(0, 0, cc.ephemeral_5m_input_tokens || 0, cc.ephemeral_1h_input_tokens || 0, 0),
          crUsd: mkCost(0, 0, 0, 0, u.cache_read_input_tokens || 0) });
        kickPoolEval();
      } catch { }
    }
    if (msg.type === 'rate_limit_event') recordRateLimitEvent(session, msg);
    if (msg.type === 'assistant' && Array.isArray(msg.message?.content)) {
      for (const b of msg.message.content) {
        if (b?.type === 'text' && typeof b.text === 'string' && /You've (?:reached|hit) your .{0,40} limit/.test(b.text)) {
          global.__vsEvent?.('cli-usage-limit');
          markLimitBanner(session, b.text);
        } else if (b?.type === 'fallback') {
          global.__vsEvent?.('cli-model-fallback', `${b.from?.model || '?'}->${b.to?.model || '?'}`);
          if (!msg.parent_tool_use_id && !msg.isSidechain) maybeStopOnFallback(session, sid, b.from?.model, b.to?.model);
        }
      }
    }
    if (msg.type === 'system' && msg.subtype === 'model_refusal_fallback') {
      maybeStopOnFallback(session, sid, msg.originalModel || msg.original_model, msg.fallbackModel || msg.fallback_model);
    }
    // todo/task families mirror the parse's exact consumption (lines above):
    // TodoWrite carries the whole list; TaskUpdate patches by id; TaskCreate's
    // id only exists in the tool RESULT, which the parse stashes — the device
    // feed leaves creates to the parse (the seen-gate does not cover them, so
    // nothing is lost; the parse path still sees every record).
    if (msg.type === 'assistant' && Array.isArray(msg.message?.content)) {
      for (const b of msg.message.content) {
        if (b?.type !== 'tool_use') continue;
        try {
          if (b.name === 'TodoWrite' && Array.isArray(b.input?.todos)) updateSessionTodos(session, b.input.todos);
          else if (b.name === 'TaskUpdate' && b.input?.taskId) applyTaskToolUpdate(session, b.input);
        } catch { }
      }
    }
  } catch (e) { console.warn('[session-brain] device side-effects failed:', e.message); }
}
hosts.onSessionEvents = (hostId, m) => {
  try {
    if (!m?.sid) return;
    // STEP 3: raw records → the shared side-effect consumers, device-first.
    // Session lookup by the DAEMON's sid (keeperSid); miss = not ours (an
    // externally-adopted pipe session) — parity ring still records below.
    if (Array.isArray(m.raw) && m.raw.length) {
      let sess = null;
      for (const [, s3] of activeSessions) { if (s3.host === hostId && s3.keeperSid === m.sid && s3.backend !== 'codex') { sess = s3; break; } }
      if (sess) {
        for (const line of m.raw) {
          let rec = null; try { rec = JSON.parse(line); } catch { continue; }
          if (sbSeenFirst(sess, rec)) claudeSideEffects(sess, sess._webuiId || null, rec);
        }
      }
    }
    if (!Array.isArray(m.batch)) return;
    const r = _sbRing(hostId + ':' + m.sid);
    for (const ej of m.batch) {
      let op = null; try { op = JSON.parse(ej); } catch { continue; }
      if (op?.op === 'create' && op.msg?.id) {
        r.device.push(_sbMidCore(op.msg.id));
        if (r.device.length > SB_RING_MAX) r.device.splice(0, r.device.length - SB_RING_MAX);
      }
    }
    sbCompare(hostId, m.sid, r);
  } catch { }
};
hosts.onUsageEvents = (hostId, text) => {
  if (!text) return true;
  const h = hosts.get(hostId);
  const r = usageHistory.ingestRemoteEvents(hostId, h?.name || hostId, text);
  if (r.added > 0) {
    try { for (const [ik] of usageIdentityGroups()) usageEstimator.invalidate(ik); } catch { }
    try { kickPoolEval(); } catch { }
  }
  return true;
};
{
  const dirtyTimers = new Map();
  // Remote discovery went stale (create / terminate / external kill / device
  // push) — every connected client's cached host list must re-fetch. Trailing-
  // debounced per host so a burst of invalidations is one broadcast.
  // …and the ORCHESTRATOR computes it ONCE and pushes the RESULT (2.310.0).
  // The first cut broadcast a bare "dirty" and let every client re-fetch with
  // ?fresh=1 — which puts the trigger for a heavy scan on the orchestration
  // side and multiplies it by the number of connected clients. The three-tier
  // rule is the opposite: the machine that OWNS the facts computes them (the
  // capability-gated `discovery-claims` op runs the whole claim algorithm on
  // the device, next to the bytes), the orchestrator forwards, the client is a
  // view. One dirty signal ⇒ one computation ⇒ one broadcast, whatever the
  // client count. Skipped entirely when nobody is connected.
  // AUTO-GRADUATE ssh → ws (2.311.0). The graduation mechanism has existed
  // since 2.248.0 but was button-only, so in practice every machine stayed on
  // ssh forever — per-op child spawns, banner hangs on lossy paths, and a
  // ControlMaster whose ESTABLISHED flow survives network changes that every
  // NEW connection fails (the 2.228.1 lie). Once we have proven we can reach
  // the machine, moving to our own ws link is strictly better.
  // DELIBERATELY CONSERVATIVE: only with an operator-declared base URL — never
  // auto-publish this instance to the public relay, which is a side effect the
  // operator has to choose. The machine is still asked whether it can reach
  // that URL BEFORE anything is installed, and any failure leaves it on ssh.
  const gradTried = new Map();
  hosts.onSshConnected = (hostId) => {
    try {
      if (!hostId || serverSetting('agentd.autoGraduate') === false) return;
      const h = hosts.get(hostId);
      if (!h || h.transport === 'dial' || h.deviceId || h.autoGraduate === false) return; // already graduated / opted out
      if (!(agentdDeps.publicUrl?.() || '')) return;                    // nothing to dial back to
      const last = gradTried.get(hostId) || 0;
      if (Date.now() - last < 6 * 60 * 60 * 1000) return;               // one attempt per machine per 6h
      gradTried.set(hostId, Date.now());
      setTimeout(async () => {
        try {
          const out = await graduateHostToDial(hosts.get(hostId), {});
          serverNotice('grad-' + hostId, `"${h.name}" now talks to VibeSpace over its own ws link${out.dialedIn ? '' : ' (dialing in shortly)'} — ssh stays as the rescue channel.`);
        } catch (e) {
          // Never silent: the operator asked for ws and did not get it.
          console.warn('[graduate] auto attempt failed for', hostId, e.message);
          serverNotice('grad-fail-' + hostId, `Could not move "${h.name}" to a ws link — staying on ssh. ${String(e.message).slice(0, 180)}`, { level: 'warn' });
        }
      }, 3000); // let the connect that triggered us finish its own work first
    } catch { }
  };

  const discDirtyTimers = new Map();
  hosts.onDiscoveryDirty = (hostId) => {
    if (!hostId || discDirtyTimers.has(hostId)) return;
    discDirtyTimers.set(hostId, setTimeout(async () => {
      discDirtyTimers.delete(hostId);
      try {
        if (!wss.clients.size) return; // nobody to tell — do not spend the scan
        const d = await hosts.discoverSessions(hostId, { ttlMs: 0 });
        bcastAll({ type: 'remote-sessions', hostId, sessions: d?.sessions || [], at: Date.now() });
      } catch (e) {
        // An unreachable machine must not silently freeze the list at a state
        // we know is wrong — say so, and let the client keep its labelled
        // last-known copy (the same degrade the pull path already does).
        try { bcastAll({ type: 'remote-sessions', hostId, error: String(e?.message || e), at: Date.now() }); } catch { }
      }
    }, 400));
  };
  hosts.onDeviceDirty = (hostId) => {
    if (dirtyTimers.has(hostId)) return; // trailing-debounce per host
    dirtyTimers.set(hostId, setTimeout(() => {
      dirtyTimers.delete(hostId);
      try {
        hosts.harvestUsage(hostId, { minIntervalMs: 60 * 1000, scannerPath: USAGE_SCANNER_PATH })
          .then((txt) => { if (txt) usageHistory.ingestRemoteEvents(hostId, hosts.get(hostId)?.name, txt); })
          .catch(() => { });
      } catch { }
    }, 3000));
  };
}
const { MachineMounts } = require('./src/machine-mounts');
const machineMounts = new MachineMounts({
  dataDir: path.join(__dirname, 'data'), hosts, mountTokens,
  publicUrl: () => { try { return serverSetting('agentd.publicUrl') || process.env.VIBESPACE_PUBLIC_URL || null; } catch { return process.env.VIBESPACE_PUBLIC_URL || null; } },
  localPort: () => PORT, // the agentd tunnel's target: our own /dav
  rcloneBin: () => mounts.rcloneBin(),
  broadcast: bcastAll,
  log: (m) => console.log('[machine-mounts]', m),
});
setTimeout(() => { machineMounts.restore().catch(() => {}); }, 5000); // heal pull mounts + re-own push tunnel ports
app.get('/api/machine-mounts', (req, res) => res.json({ mounts: machineMounts.list() }));
app.post('/api/machine-mounts/:hostId', async (req, res) => {
  try {
    const b = req.body || {};
    if (b.dir === 'pull') {
      res.json(await machineMounts.mountPull(req.params.hostId, { remotePath: b.remotePath, mountpoint: b.mountpoint }));
    } else {
      // PRIMARY transport = the agentd tunnel (inside mountPush — no public
      // address needed). The request-derived URL is only the last-resort
      // fallback for hosts without the device agent.
      let pub = b.publicUrl ? String(b.publicUrl) : null;
      if (!pub) { const proto = req.headers['x-forwarded-proto'] || 'http'; const host = req.headers['x-forwarded-host'] || req.headers.host; if (host) pub = `${proto}://${host}`; }
      res.json(await machineMounts.mountPush(req.params.hostId, { folder: b.folder, mode: b.mode, mountpoint: b.mountpoint, publicUrlFallback: pub }));
    }
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/machine-mounts/:id', async (req, res) => {
  try { res.json(await machineMounts.unmount(String(req.params.id))); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/machine-mounts/:id/remount', async (req, res) => {
  try { res.json(await machineMounts.remount(String(req.params.id))); } catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Port forwarding (B-0b60, tunnel path): expose a machine's loopback
// service at http://127.0.0.1:<localPort> on this instance, over the agentd
// data plane (no frps / public exposure). ──
const { PortForwardManager } = require('./src/port-forward');
const portForwards = new PortForwardManager({
  dataDir: path.join(__dirname, 'data'), hosts, broadcast: bcastAll,
  serverSetting,
  log: (m) => console.log('[port-forward]', m),
});
setTimeout(() => { portForwards.restore().catch(() => {}); }, 5500);
app.get('/api/port-forwards', (req, res) => res.json({ forwards: portForwards.list() }));
app.get('/api/hosts/:id/ports', async (req, res) => {
  // the UI path probes protocols (http/https/tcp chip); the watch sweep doesn't
  try { res.json({ ports: await portForwards.detect(req.params.id, { probe: true }) }); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/hosts/:id/port-forward', async (req, res) => {
  try {
    const b = req.body || {};
    res.json(await portForwards.forward(req.params.id, b.port, { label: b.label || '', targetHost: b.targetHost || '' }));
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/port-forward/:id', async (req, res) => {
  try { await portForwards.unforward(String(req.params.id)); res.json({ ok: true }); } catch (e) { res.status(400).json({ error: e.message }); }
});
// public exposure (frp relay) — publish/unpublish a forward
app.post('/api/port-forward/:id/publish', async (req, res) => {
  try { res.json(await portForwards.publish(String(req.params.id))); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/port-forward/:id/publish', async (req, res) => {
  try { await portForwards.unpublish(String(req.params.id)); res.json({ ok: true }); } catch (e) { res.status(400).json({ error: e.message }); }
});
// protocol override: {proto: 'http'|'https'|'tcp'|null} (null = back to auto);
// a published forward is transparently re-published in the new mode
app.post('/api/port-forward/:id/proto', async (req, res) => {
  try { res.json(await portForwards.setProtoOverride(String(req.params.id), (req.body || {}).proto ?? null)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Kill a LOCAL orphaned listener (B-16d9): killOrphan re-verifies the
// deleted-cwd condition at kill time, so this can't target a healthy process.
app.post('/api/ports/kill-orphan', (req, res) => {
  try { res.json(portForwards.killOrphan((req.body || {}).pid)); } catch (e) { res.status(400).json({ error: e.message }); }
});
// On-demand EXIT (task #164): let an agent borrow a machine's network for a
// single command. Per-machine opt-in (hosts.allowExit, default off).
const { ExitProxyManager } = require('./src/exit-proxy');
const exitProxy = new ExitProxyManager({ hosts, broadcast: bcastAll, log: (m) => console.log('[exit]', m) });
app.get('/api/exits', (req, res) => res.json({ exits: exitProxy.list() }));
app.post('/api/hosts/:id/allow-exit', (req, res) => {
  try {
    const on = !!(req.body || {}).on;
    hosts.setAllowExit(req.params.id, on);
    if (!on) exitProxy.onMachineUnpaired(req.params.id); // tearing down the egress when disabled
    bcastAll({ type: 'hosts-updated' }); bcastAll({ type: 'exits-updated', exits: exitProxy.list() });
    res.json({ success: true, allowExit: on });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
// ── AGENT-facing exit routes (vsst_ token; exempt from cookie auth in
// auth.middleware). The agent's `vibespace-exit` CLI hits these. ──
function exitAgentSession(req) {
  const token = (req.headers.authorization || '').replace(/^Bearer\s+/i, '') || req.body?.token;
  if (!token || !token.startsWith('vsst_')) return null;
  for (const [, s] of activeSessions) if (s.agentToken === token) return s;
  return null;
}
app.get('/api/agent/exit', (req, res) => {
  if (!exitAgentSession(req)) return res.status(401).json({ error: 'missing or unknown session token' });
  res.json({ exits: exitProxy.list() });
});
app.post('/api/agent/exit/use', async (req, res) => {
  if (!exitAgentSession(req)) return res.status(401).json({ error: 'missing or unknown session token' });
  try { res.json(await exitProxy.use((req.body || {}).machine)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// RUN a command natively ON the exit machine (the universal fallback for
// ICMP/UDP/proxy-unaware tools + that machine's own DNS). Bounded.
app.post('/api/agent/exit/run', async (req, res) => {
  if (!exitAgentSession(req)) return res.status(401).json({ error: 'missing or unknown session token' });
  const { machine, cmd } = req.body || {};
  if (!cmd || typeof cmd !== 'string') return res.status(400).json({ error: 'cmd (a shell command string) is required' });
  try {
    const h = exitProxy.resolve(machine); // enforces allowExit + resolves the ref
    // Bounded connect (B-fa6f review catch): every sibling exit path uses
    // deviceBounded — an agent's `vibespace-exit run` must error in seconds
    // on a flapping link, not sit on the ~2.7-min connect ladder.
    const dm = await hosts.deviceBounded(h.id, 8000);
    const r = await dm.runCmd('sh', ['-lc', cmd], { timeoutMs: 120000 });
    res.json({ machine: h.name || h.id, code: r.code ?? 0, stdout: String(r.stdout || ''), stderr: String(r.stderr || '') });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
setTimeout(() => { try { hosts.sweepJsonlCache(); } catch {} }, 60000); // orphaned/stale remote-transcript cache
const sshKey = require('./src/ssh-key'); // passphrase-protected private-key import
const { RemoteFs } = require('./src/remote-fs');
const remoteFs = new RemoteFs(hosts);
app.get('/api/hosts', (req, res) => {
  const k = hosts.keyInfo();
  res.json({ hosts: hosts.list(), key: { exists: k.exists, path: k.path, publicKey: k.publicKey } });
});
app.post('/api/hosts', async (req, res) => {
  // A pasted key may be passphrase-protected: unlock it HERE (ssh-keygen -p,
  // src/ssh-key.js) and hand hosts.add() plaintext — add() must stay sync.
  // The passphrase is used for that one exec and is never stored, logged, or
  // put in argv; it exists only in this request body and the child's env.
  const b = { ...(req.body || {}) };
  try {
    let key = null;
    if (b.privateKey && String(b.privateKey).trim()) {
      key = await sshKey.prepareImportedKey(b.privateKey, b.keyPassphrase);
      b.privateKey = key.body;
    }
    delete b.keyPassphrase; // consumed here and nowhere else
    const id = hosts.add(b);
    bcastAll({ type: 'hosts-updated' });
    res.json({ success: true, id, key: key && { type: key.type, fingerprint: key.fingerprint, wasEncrypted: key.wasEncrypted } });
  } catch (e) {
    // `code` drives the client's localized message (server prose is for logs
    // and non-browser callers)
    res.status(400).json({ error: e.message, code: e.code });
  }
});
app.post('/api/hosts/key', async (req, res) => {
  try { res.json({ success: true, key: await hosts.generateKey() }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/hosts/:id/test', async (req, res) => {
  try { res.json({ success: true, ...(await hosts.test(req.params.id)) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/hosts/:id/sessions', async (req, res) => {
  try { res.json({ sessions: await hosts.discoverSessions(req.params.id, req.query.fresh ? { ttlMs: 0 } : {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/hosts/:id', async (req, res) => {
  try {
    const h = hosts.get(req.params.id);
    // dial machine: removing the record IS the unpair (token hash lives on
    // it) — tear down mounts / token file / live stream first (B-f3e8).
    // ssh machines keep the OLD preserve-as-orphan semantics (review finding:
    // remove+re-add is the only way to edit a host's address/key, and the
    // confirm dialog promises nothing on the remote is touched — the orphan
    // rows remain manageable/unmountable).
    if (h.transport === 'dial') await unpairDialDevice(h.deviceId);
    // port-forwards are pure local plumbing (unlike mounts, which keep their
    // preserve-as-orphan semantics for ssh) — with the host record gone their
    // records become invisible, undeletable orphans (review finding)
    else { try { portForwards.onMachineUnpaired(h.id); } catch { } }
    try { exitProxy.onMachineUnpaired(h.id); } catch { }
    hosts.remove(req.params.id);
    bcastAll({ type: 'hosts-updated' });
    res.json({ success: true });
  }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Bootstrap: progress streams to ALL clients over WS (host-bootstrap events);
// the HTTP response returns when the run completes.
app.post('/api/hosts/:id/bootstrap', async (req, res) => {
  const bcast = (msg) => {
    const json = JSON.stringify(msg);
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  };
  try {
    // NOTE: spread ev FIRST — its own `type` ('step'/'log'/'done') must not
    // clobber the outer message type the client filters on. `kind` carries
    // the event type instead.
    const steps = await hosts.bootstrap(req.params.id, (ev) => bcast({ ...ev, kind: ev.type, type: 'host-bootstrap', hostId: req.params.id }));
    res.json({ success: Object.values(steps).every(s => s === 'ok'), steps });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/hosts/bootstrap-steps', (req, res) => res.json({ steps: hosts.bootstrapSteps() }));
// Remote directory autocomplete (New Session dialog when a host is chosen) —
// mirrors /api/dir-complete but runs ls over ssh on the target.
app.get('/api/hosts/:id/dir-complete', async (req, res) => {
  try { res.json({ suggestions: await hosts.dirComplete(req.params.id, req.query.path || '') }); }
  catch { res.json({ suggestions: [] }); }
});
// Recent working dirs seen on the host (from its Claude project dirs) — the
// "path list" the New Session dialog offers as chips for a remote host.
// Backend (CLI) status on a host — Manage Agents dialog when a host is chosen.
app.get('/api/hosts/:id/backend-status', async (req, res) => {
  try { res.json(await hosts.backendStatus(req.params.id)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// VibeSpace integration on a host (2.129.0, backlog B-34bb): the ~/.vibespace
// footprint remote sessions leave there — per-tool presence compared against
// the LOCAL copies by sha256 (`current`), remote hook registration, node
// availability, keeper session files — plus explicit install/refresh + remove.
// (A future remote session spawn re-installs by design; the UI says so.)
app.get('/api/hosts/:id/agent-tools', async (req, res) => {
  try {
    const st = await hosts.agentToolsStatus(req.params.id);
    const toolDir = AGENT_BIN_DIR;
    const crypto = require('crypto');
    for (const [n, t] of Object.entries(st.tools)) {
      let local = null;
      try { local = crypto.createHash('sha256').update(fs.readFileSync(path.join(toolDir, n))).digest('hex'); } catch { }
      t.current = !!(t.present && local && t.sha256 === local);
      delete t.sha256;
    }
    res.json(st);
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/hosts/:id/agent-tools/install', async (req, res) => {
  // Same master-switch guard as the local /api/agent-hooks/install — the
  // remote twin must not silently contradict a pristine-CLI state either.
  if (!integrationEnabled()) return res.status(400).json({ error: 'VibeSpace integration is disabled (Settings → Integration → master switch). Enable it first.' });
  try { res.json({ success: true, ...(await hosts.installAgentTools(req.params.id, AGENT_BIN_DIR)) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/hosts/:id/agent-tools/uninstall', async (req, res) => {
  try { res.json({ success: true, ...(await hosts.uninstallAgentTools(req.params.id)) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/hosts/:id/recent-cwds', async (req, res) => {
  try {
    const sessions = await hosts.discoverSessions(req.params.id);
    const seen = [];
    for (const s of sessions) { if (s.cwd && !seen.includes(s.cwd)) seen.push(s.cwd); if (seen.length >= 8) break; }
    res.json({ cwds: seen });
  } catch { res.json({ cwds: [] }); }
});

// ── Mounts (rclone S3 mounts + share minting — collaboration P1) ──
// ── Plugins (2.140.0, B-2d44): host-level capabilities with persistent state ──
const { PluginManager } = require('./src/plugins');
const plugins = new PluginManager({
  dataDir: path.join(__dirname, 'data'),
  broadcast: (msg) => {
    const json = JSON.stringify(msg);
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
// port-forward can publish a forward publicly via the frp plugin (B-0b60)
portForwards.plugins = plugins;
setTimeout(() => { try { plugins.bootReplay(); } catch (e) { console.warn('[plugins] boot replay:', e.message); } }, 5000);
// CS data-plane deps for hosts.device(id) (2.146.0) — wired SYNCHRONOUSLY.
// (Was a setTimeout(1000); a device dialing in during that window ran mount
// heal / hosts.device() before deps existed → "agentd deps not wired" and a
// failed heal — real owner log. The referenced functions are hoisted
// declarations and `hosts` already exists here, so no defer is needed.)
try {
  hosts.agentdDeps = {
    ensureAgentdOnHost, agentdHostToken, deviceForDial,
    bundlePath: path.join(__dirname, 'data', 'bin', 'vibespace-agentd.js'),
    version: require('./package.json').version,
  };
  hosts.dataPlaneOn = () => true; // GRADUATED (agentd.dataPlane flag removed) — ssh per-op remains the per-path failure fallback
} catch (e) { console.warn('[device] data-plane deps wiring failed:', e.message); }
// Transport B pairing: mint a device id + dial token + the one-liner the user
// runs on the NAT'd device (no ssh needed). Cookie-authed (user action).
// The pairing IS the machine registration — the dial host record carries the
// token hash (B-f3e8); re-pairing an existing name rotates its token in place.
// B-6640: graduate an SSH machine to dial-out — install the device daemon as
// a persistent service on the host (over ssh, ONE time) so it dials back over
// ws; from then on every data-plane op prefers the dial link (our own
// handshake/heartbeat/reconnect — none of ssh's banner-hang/ControlMaster/
// per-op-child taxes). transport STAYS ssh = the bootstrap + rescue channel.
// NAT rules (user directive): base = explicit serverUrl > agentd.publicUrl >
// relay (viaRelay); the host-side REACHABILITY PRECHECK runs before anything
// is installed — unreachable ⇒ abort, stay pure-ssh. {remove:true} rolls the
// whole thing back (service + root on the host, dial fields on the record).
/** SSH → WS graduation, install half (2.311.0 extracted so it can run
 *  AUTOMATICALLY, not only from a button — the mechanism shipped in 2.248.0
 *  but every machine stayed on ssh because someone had to click it).
 *  Installs the daemon as a persistent service on the machine and has it DIAL
 *  BACK over ws. Throws with a user-readable reason; ssh always remains as the
 *  bootstrap + rescue channel. */
async function graduateHostToDial(h, { serverUrl, viaRelay } = {}) {
  const sshRun = (script, timeout = 30000) => new Promise((resolve) => {
    const { execFile } = require('child_process');
    execFile('ssh', [...hosts.sshArgs(h, { multiplex: true }), '--', script],
      { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, so, se) => resolve({ ok: !err, out: String(so || ''), err: String(se || err?.message || '') }));
  });
    // ── install ──
    let base = String(serverUrl || '').replace(/\/$/, '') || agentdDeps.publicUrl?.() || null;
    if (!base && viaRelay) {
      const st = plugins.status('frp');
      const r = await plugins.frpPublish('vibespace-instance', Number(PORT), { preferSub: st?.selfDialSub || '' });
      if (r?.url) { base = r.url.replace(/\/$/, ''); try { plugins.setSelfDialSub?.(r.subdomain || ''); } catch { } }
    }
    if (!base) throw new Error('no reachable base URL: set agentd.publicUrl, pass serverUrl, or use viaRelay (frp plugin)');
    // reachability PRECHECK from the HOST (any HTTP status = reachable; 000 = not)
    const chk = await sshRun(`curl -s -o /dev/null -w '%{http_code}' --max-time 10 ${JSON.stringify(base + '/api/home')} 2>/dev/null || echo 000`, 20000);
    const code = (chk.out.trim().match(/\d{3}$/) || ['000'])[0];
    if (code === '000') throw new Error(`the machine cannot reach ${base} — graduation aborted (staying on ssh). If this instance is behind NAT, use viaRelay.`);
    // mint onto the EXISTING ssh record (deviceId first so setDialToken finds it)
    // dialRoot must mirror the INSTALLER's derivation byte-for-byte (it does
    // sed hostname-only + tr -cd 'A-Za-z0-9.-') or the removal path tears
    // down the wrong directory.
    const dialHost = (new URL(base).hostname || 'dial').replace(/[^A-Za-z0-9.-]/g, '');
    const root = `$HOME/.vibespace/device@${dialHost || 'dial'}`;
    hosts.graduateDial(h.id, { dialRoot: root });
    const pair = agentdMintDialPair(hosts.get(h.id).deviceId);
    const dialUrl = `${base.replace(/^http/, 'ws')}/api/device-dial?device=${pair.deviceId}`;
    // ship + run the installer over ssh stdin (never argv — 2.126.0 rule is
    // about secrets; tokens ride the arg list INSIDE the remote bash, same
    // exposure class as the pairing dialog's copy-paste command)
    const installer = fs.readFileSync(path.join(__dirname, 'scripts', 'vibespace-agentd-install.sh'), 'utf-8');
    const args = `--bundle-url ${JSON.stringify(base + '/vibespace-device.js')} --dial ${JSON.stringify(dialUrl)} --dial-token ${pair.dialToken} --host-token ${pair.hostToken}`;
    const inst = await new Promise((resolve) => {
      const { execFile } = require('child_process');
      const child = execFile('ssh', [...hosts.sshArgs(h, { multiplex: true }), '--', `bash -s -- ${args}`],
        { timeout: 300000, maxBuffer: 8 * 1024 * 1024 }, (err, so, se) => resolve({ ok: !err, out: String(so || '').slice(-3000), err: String(se || err?.message || '').slice(-1500) }));
      child.stdin.on('error', () => { });
      child.stdin.end(installer);
    });
    if (!inst.ok) { hosts.ungraduateDial(h.id); bcastAll({ type: 'hosts-updated' }); throw new Error('installer failed on the host — rolled back: ' + (inst.err || inst.out).slice(-600)); }
    // wait for the dial-in (installer verifies the daemon started; the dial
    // itself can lag a few seconds)
    let dialed = false;
    for (let i = 0; i < 15; i++) { if (hosts.dialOnline?.(pair.deviceId)) { dialed = true; break; } await new Promise(r => setTimeout(r, 2000)); }
    bcastAll({ type: 'hosts-updated' });
  return { success: true, dialedIn: dialed, base, deviceId: pair.deviceId, note: dialed ? 'dial link live — data-plane ops now prefer it (ssh stays as rescue)' : 'installed — daemon not dialed in yet; check again shortly or see the machine row' };
}

app.post('/api/hosts/:id/graduate-dial', async (req, res) => {
  try {
    const h = hosts.get(req.params.id);
    if (h.transport === 'dial') return res.status(400).json({ error: 'already a dial device' });
    const sshRun = (script, timeout = 30000, input = null) => new Promise((resolve) => {
      const { execFile } = require('child_process');
      execFile('ssh', [...hosts.sshArgs(h, { multiplex: true }), '--', script],
        { timeout, maxBuffer: 4 * 1024 * 1024 }, (err, so, se) => resolve({ ok: !err, out: String(so || ''), err: String(se || err?.message || '') }));
      });
    if (req.body?.remove) {
      // best-effort remote teardown, ALWAYS clear the record (dead host must
      // not hold the graduation hostage — the machine-mounts unmount lesson)
      const root = h.dialRoot || '';
      if (root && /^\$HOME\/[\w@.\/-]+$/.test(root)) {
        const key = require('path').basename(root).replace(/[^A-Za-z0-9.-]/g, '-').replace(/-+$/, '');
        await sshRun(`systemctl --user disable --now "vibespace-device-${key}.service" 2>/dev/null; ` +
          `launchctl bootout "gui/$(id -u)/cc.vibespace.device.${key}" 2>/dev/null; ` +
          `pkill -f "${root}/" 2>/dev/null; sleep 1; rm -rf "${root}"; echo VS_REMOVED`, 30000);
      }
      const devId = h.deviceId;
      hosts.ungraduateDial(h.id);
      try { if (devId && agentdDials.has(devId)) { agentdDials.get(devId)?.destroy?.(); agentdDials.delete(devId); } } catch { }
      bcastAll({ type: 'hosts-updated' });
      return res.json({ success: true, removed: true });
    }
    const out = await graduateHostToDial(h, { serverUrl: req.body?.serverUrl, viaRelay: req.body?.viaRelay });
    res.json(out);
  } catch (e) { res.status(400).json({ error: e.message }); }
});

app.post(['/api/device/dial-pair', '/api/agentd/dial-pair'], async (req, res) => {
  try {
    const deviceId = String(req.body?.deviceId || ('dev-' + require('crypto').randomBytes(4).toString('hex'))).replace(/[^\w-]/g, '').slice(0, 32);
    // minting for an EXISTING deviceId is a RE-PAIR: setDialToken rotates the
    // hash on the existing record (mounts/forwards/history kept, host token
    // file untouched) — no unpair needed (userW lesson: unpair-first deleted
    // the record and orphaned the still-running device daemon)
    const existed = !!hosts.findByDeviceId(deviceId);
    const pair = agentdMintDialPair(deviceId);
    bcastAll({ type: 'hosts-updated' });
    // Double-NAT pairing (B-5c1e): when THIS instance is itself behind NAT
    // (a local/home VibeSpace), the browser's origin is unreachable from the
    // device's network. viaRelay publishes the instance's OWN http port
    // through the frp relay and hands the device a public subdomain to dial —
    // the relay bridges both NATs. Persisted (stable sub) so reconnects hold.
    let base = String(req.body?.serverUrl || '').replace(/\/$/, '') || null;
    let relayUrl = null;
    if (req.body?.viaRelay) {
      try {
        const st = plugins.status('frp');
        const preferSub = st?.selfDialSub || '';
        const r = await plugins.frpPublish('vibespace-instance', Number(PORT), { preferSub });
        if (r?.url) { relayUrl = r.url.replace(/\/$/, ''); base = relayUrl; try { plugins.setSelfDialSub?.(r.subdomain || ''); } catch { } }
      } catch (e) { return res.status(400).json({ error: 'could not publish this instance to the relay: ' + e.message + ' — is the frp plugin installed + started (⚙ → Plugins → Public URLs)?' }); }
    }
    const dialUrl = base ? `${base.replace(/^http/, 'ws')}/api/device-dial?device=${deviceId}` : null;
    // RE-PAIR of a device that is dialed-in RIGHT NOW: push the rotated dial
    // config over the live link — the daemon re-reads dial.json per attempt
    // (2.170.0), so nothing needs to run on the device. Best-effort; the
    // command below is the universal fallback.
    let updatedInPlace = false;
    if (existed && dialUrl && agentdDials.get(deviceId)) {
      try {
        const dm = await deviceForDial(deviceId);
        const root = String((await dm.runCmd('sh', ['-c', 'printf %s "${VIBESPACE_DEVICE_ROOT:-$VIBESPACE_AGENTD_ROOT}"'], { timeoutMs: 8000 })).stdout || '').trim();
        if (root && path.isAbsolute(root)) {
          await dm.fsWrite(root + '/state/dial.json', Buffer.from(JSON.stringify({ url: dialUrl, token: pair.dialToken })));
          await dm.runCmd('chmod', ['600', root + '/state/dial.json'], { timeoutMs: 5000 }).catch(() => {});
          updatedInPlace = true;
        }
      } catch { /* offline mid-flight / old bundle — the command covers it */ }
    }
    res.json({
      ...pair,
      repair: existed,
      updatedInPlace,
      relayUrl, // the public subdomain the device dials (double-NAT mode)
      command: base
        ? `node vibespace-device.js --dial ${dialUrl} --dial-token ${pair.dialToken}`
        : null,
      note: 'install the device daemon bundle on the device, write the hostToken to <root>/state/token (0600), then run with --dial',
    });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
// (the /api/agentd/devices roster/test/unpair routes retired in B-f3e8 —
// machines are listed by /api/hosts, tested by /api/hosts/:id/test, unpaired
// by DELETE /api/hosts/:id)
const { DialSessionBridge } = require('./src/dial-session-bridge');
const dialBridge = new DialSessionBridge({
  deviceForDial,
  hostTokenFor: (deviceId) => agentdHostToken('dial-' + deviceId),
  log: (m) => console.log('[dial-bridge]', m),
});
// Standalone device install: serve the agentd bundle + installer (public — the
// bundle is not secret; auth is the per-device dial/host token at connect).
// Canonical names since the vibespace-device rename (2.154.x): /agentd.js and
// /agentd-install.* stay as PERMANENT aliases — commands in old docs/pairings
// must keep working.
app.get(['/vibespace-device.js', '/agentd.js'], (req, res) => {
  try { res.type('application/javascript').send(fs.readFileSync(path.join(__dirname, 'data', 'bin', 'vibespace-agentd.js'))); }
  catch { res.status(404).end(); }
});
app.get(['/vibespace-device-install.ps1', '/agentd-install.ps1'], (req, res) => {
  try { res.type('text/plain').send(fs.readFileSync(path.join(__dirname, 'scripts', 'vibespace-agentd-install.ps1'), 'utf-8')); }
  catch { res.status(404).end(); }
});
app.get(['/vibespace-device-install.sh', '/agentd-install.sh'], (req, res) => {
  try { res.type('text/x-shellscript').send(fs.readFileSync(path.join(__dirname, 'scripts', 'vibespace-agentd-install.sh'), 'utf-8')); }
  catch { res.status(404).end(); }
});
// Node runtime MIRROR for the device installer (2.246.0): a machine that can
// reach THIS instance (or its relay) but not nodejs.org — corporate egress
// filters, CN networks — still pairs. The installer only falls back here when
// the direct download fails. NEVER a general proxy: fixed upstream host +
// strict version/filename allowlist, cached on disk. Both the tarball and the
// SHASUMS come through here, so for that device the trust anchor becomes this
// instance — which it already trusts to serve the daemon bundle it runs.
app.get('/vibespace-node/:version/:file', async (req, res) => {
  const v = String(req.params.version || ''), f = String(req.params.file || '');
  if (!/^v\d+\.\d+\.\d+$/.test(v)) return res.status(400).end();
  if (!/^(SHASUMS256\.txt|node-v\d+\.\d+\.\d+-(linux|darwin)-(x64|arm64|armv7l|ppc64le|s390x)(-musl)?\.tar\.gz|node-v\d+\.\d+\.\d+-win-(x64|arm64)\.zip)$/.test(f))
    return res.status(400).end();
  const dir = path.join(__dirname, 'data', 'node-cache', v), dest = path.join(dir, f);
  try {
    if (!fs.existsSync(dest)) {
      fs.mkdirSync(dir, { recursive: true });
      const r = await fetch(`https://nodejs.org/dist/${v}/${f}`);
      if (!r.ok) return res.status(502).json({ error: 'upstream ' + r.status });
      const tmp = `${dest}.tmp`;
      await require('stream/promises').pipeline(require('stream').Readable.fromWeb(r.body), fs.createWriteStream(tmp));
      fs.renameSync(tmp, dest);
    }
    res.type(f.endsWith('.txt') ? 'text/plain' : 'application/octet-stream');
    fs.createReadStream(dest).pipe(res);
  } catch (e) { res.status(502).json({ error: e.message }); }
});

app.get('/api/plugins', (req, res) => {
  try { res.json({ plugins: plugins.list() }); } catch (e) { res.status(500).json({ error: e.message }); }
});
app.get('/api/plugins/:id/status', (req, res) => {
  try { res.json(plugins.status(req.params.id)); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/install', async (req, res) => {
  try { res.json(await plugins.install(req.params.id)); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/start', (req, res) => {
  try { res.json(plugins.start(req.params.id)); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/stop', (req, res) => {
  try { res.json(plugins.stop(req.params.id)); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/login', async (req, res) => {
  try { res.json(await plugins.loginStart(req.params.id)); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/enabled', (req, res) => {
  try { plugins.setEnabled(req.params.id, !!req.body?.enabled); res.json({ ok: true }); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/mode', (req, res) => {
  try { res.json(plugins.setMode(req.params.id, String(req.body?.mode || 'auto'))); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/plugins/:id/config', (req, res) => {
  try { res.json(plugins.setConfig(req.params.id, req.body || {})); } catch (e) { res.status(400).json({ error: e.message }); }
});

const { MountManager } = require('./src/mounts');
const mounts = new MountManager({
  dataDir: path.join(__dirname, 'data'),
  getSetting: serverSetting,
  broadcast: (msg) => {
    const json = JSON.stringify(msg);
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
// Rename guard: bridge-share chroots are filesystem paths under the mount.
// MUST be OUTSIDE the broadcast callback — it was mis-nested inside, so every
// broadcast re-ran it, and a broadcast DURING construction (env-import add →
// _notify → broadcast) referenced `mounts` while it was still in its TDZ,
// throwing "Cannot access 'mounts' before initialization" out of add() before
// it returned the id — which is why an env-provisioned My storage (S3 or
// CephFS) came up `desired: unmounted` on its very first boot.
mounts.pathGuard = (p) => mountTokens.list().some((t) => String(t.root || '').startsWith(p));
setTimeout(() => mounts.restore().catch(e => console.error('[mounts] restore:', e.message)), 2000);
// Hung-mount watchdog: one unreachable backend must never wedge the server
// (libuv threadpool saturation — see mounts.js _healthSweep).
mounts.startHealthWatchdog();
app.locals.mounts = mounts; // files.js circuit breaker asks it about blocked mount roots
// Self-mount guard: a bridge token WE minted = the share points back at this
// instance; fuse→HTTP→self deadlocks the threadpool (real incident).
mounts.selfTokenCheck = (raw) => mountTokens.has(raw);

app.get('/api/mounts', async (req, res) => {
  const cfg = mounts.getMyStorageConfig(); // redacted (no secret)
  res.json({
    mounts: mounts.list(),
    shares: mounts.listShares(),
    env: cfg ? { endpoint: cfg.endpoint, bucket: cfg.bucket, prefix: cfg.prefix, accessKey: cfg.accessKey, configured: cfg.configured, importedFromEnv: cfg.importedFromEnv } : null,
    mountBase: mounts.mountBase,
    mcAvailable: await mounts.mcAvailable(),
    rcloneAvailable: mounts.rcloneAvailable(),
  });
});
app.post('/api/mounts', (req, res) => {
  try { res.json({ success: true, id: mounts.add(req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/mounts/import', (req, res) => {
  try {
    const link = req.body?.link;
    // vibespace-mount:v1 = another instance's WebDAV bridge (scoped bearer token)
    const dav = MountTokens.parseLink ? MountTokens.parseLink(link) : null;
    if (dav) {
      const id = mounts.add({
        type: 'vibespace', origin: 'imported',
        name: req.body?.name || dav.name || 'vibespace-mount',
        mode: dav.mode === 'rw' ? 'rw' : 'ro',
        url: dav.url, bearerToken: dav.token,
        customPath: req.body?.customPath || null,
      });
      return res.json({ success: true, id });
    }
    // vibespace-cephmount:v1 = a direct CephFS subtree share (path-scoped cephx
    // key minted cluster-side) → a normal kernel cephfs mount, no proxy.
    const cm = MountManager.parseCephMountLink(link);
    if (cm) {
      const id = mounts.add({
        type: 'cephfs', origin: 'imported',
        name: req.body?.name || cm.name || 'ceph-share',
        mode: cm.mode === 'rw' ? 'rw' : 'ro',
        cephMonHosts: cm.mons, cephFsName: cm.fsName || 'cephfs',
        cephPath: cm.path, cephUser: cm.user, cephSecret: cm.secret,
        customPath: req.body?.customPath || null,
      });
      return res.json({ success: true, id });
    }
    const p = MountManager.parseShareLink(link);
    const id = mounts.add({
      ...p, origin: 'imported',
      name: req.body?.name || p.name || 'imported-share',
      mode: p.mode === 'rw' ? 'rw' : 'ro',
      customPath: req.body?.customPath || null,
    });
    res.json({ success: true, id });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
// Direct CephFS subtree share — mint a path-scoped key (ceph-mint service).
app.post('/api/mounts/:id/ceph-share', async (req, res) => {
  try { res.json(await mounts.mintCephShare(req.params.id, req.body || {})); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// Mount tokens (WebDAV bridge): mint returns the link ONCE; stored hashed
app.get('/api/mount-tokens', (req, res) => res.json({ tokens: mountTokens.list() }));
app.post('/api/mount-tokens', (req, res) => {
  try {
    const { name, root, mode } = req.body || {};
    const { raw, rec } = mountTokens.mint({ name, root, mode });
    const url = `${req.protocol}://${req.get('host')}`;
    res.json({ success: true, token: raw, davUrl: `${url}/dav`, link: mountTokens.buildLink({ url, raw, rec }), id: rec.id, rec: { id: rec.id, name: rec.name, root: rec.root, mode: rec.mode } });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/mount-tokens/:id', (req, res) => {
  try { mountTokens.revoke(req.params.id); res.json({ success: true }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// Import an rclone.conf: parse to a preview list, then import selected remotes
app.post('/api/mounts/rclone-conf/parse', (req, res) => {
  try {
    const remotes = MountManager.parseRcloneConf(req.body?.text || '');
    // never echo secret values back — just names/types/param-keys + wraps flag
    res.json({ remotes: remotes.map(r => ({ name: r.name, type: r.type, paramKeys: Object.keys(r.params), wraps: r.wraps })) });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/mounts/rclone-conf/import', async (req, res) => {
  try {
    const all = MountManager.parseRcloneConf(req.body?.text || '');
    const want = new Set(req.body?.names || []);
    const mode = req.body?.mode === 'ro' ? 'ro' : 'rw';
    const doMount = req.body?.mount !== false;
    const added = [];
    for (const r of all) {
      if (want.size && !want.has(r.name)) continue;
      if (r.wraps) continue; // can't resolve nested remotes
      try {
        const id = mounts.addFromRcloneRemote(r, { mode });
        added.push({ name: r.name, id });
        if (doMount) { try { await mounts.mount(id); } catch {} }
      } catch (e) { /* skip dupes/invalid, continue */ }
    }
    res.json({ success: true, added });
  } catch (e) { res.status(400).json({ error: e.message }); }
});

// rclone availability + one-click install (data/bin, pinned verified version)
app.get('/api/mounts/rclone', (req, res) => res.json({ available: mounts.rcloneAvailable(), bin: mounts.rcloneBin() }));
app.post('/api/mounts/rclone/install', async (req, res) => {
  try { res.json({ success: true, ...(await mounts.installRclone()) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// Guided Google Drive OAuth (see mounts.js startDriveAuth for the model).
// With mountId: re-authorize an EXISTING Drive mount/credential using its own
// OAuth client creds (invalid_grant recovery).
app.post('/api/mounts/gdrive-auth/start', async (req, res) => {
  try {
    const { mountId, ...opts } = req.body || {};
    res.json(mountId ? await mounts.startDriveAuthForMount(mountId) : await mounts.startDriveAuth(opts));
  } catch (e) { res.status(400).json({ error: e.message }); }
});
// Write a minted token back into an existing Drive record + bounce its mounts
app.post('/api/mounts/:id/drive-token', async (req, res) => {
  try { await mounts.applyDriveToken(req.params.id, req.body?.token); res.json({ success: true, mounts: mounts.list() }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/mounts/gdrive-auth/status', (req, res) => res.json(mounts.driveAuthStatus()));
app.post('/api/mounts/gdrive-auth/callback', async (req, res) => {
  try { res.json(await mounts.forwardDriveCallback(req.body?.url)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/mounts/gdrive-auth/cancel', (req, res) => { mounts.cancelDriveAuth(); res.json({ success: true }); });
// Shared Drive picker (2.131.0): list the Shared Drives a drive credential can
// see — by existing record id, or transiently by pasted token (add dialog).
app.post('/api/mounts/shared-drives', async (req, res) => {
  try { res.json({ drives: await mounts.listSharedDrives(req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Gmail guided OAuth (2.134.0) — mirrors the gdrive-auth UX: start returns the
// consent URL; same-machine completes hands-free via the local listener;
// remote users paste the 127.0.0.1 redirect back to /callback.
app.post('/api/mounts/gmail-auth/start', async (req, res) => {
  try { res.json(await mounts.gmail.startAuth(req.body || {})); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.get('/api/mounts/gmail-auth/status', (req, res) => res.json(mounts.gmail.authStatus()));
app.post('/api/mounts/gmail-auth/callback', async (req, res) => {
  try { res.json(await mounts.gmail.forwardCallback(req.body?.url)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/mounts/gmail-auth/cancel', (req, res) => { mounts.gmail.cancelAuth(); res.json({ success: true }); });
// Labels picker (2.135.0): the account's real labels for the sync filter.
app.post('/api/mounts/gmail-labels', async (req, res) => {
  try { res.json({ labels: await mounts.listGmailLabels(req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Instance-preset Google clients for the UI picker: keys+labels ONLY, never secrets.
app.get('/api/mounts/drive-defaults', (req, res) => {
  const presets = require('./src/mounts').MountManager.drivePresets().map((c) => ({ key: c.key, label: c.label }));
  res.json({ presets, hasDefaultClient: presets.length > 0 });
});

app.post('/api/mounts/:id/share', async (req, res) => {
  try {
    const { folder, mode, name, expiryDays } = req.body || {};
    const out = await mounts.mintShareFromMount(req.params.id, { folder, mode, name, expiryDays });
    res.json({ success: true, ...out });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/mounts/shares/:id', async (req, res) => {
  try { await mounts.revokeShare(req.params.id); res.json({ success: true }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/mounts/:id/mount', async (req, res) => {
  try {
    const ok = await mounts.mount(req.params.id);
    res.json({ success: ok, mounts: mounts.list() });
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/mounts/:id/unmount', async (req, res) => {
  try { res.json({ success: await mounts.unmount(req.params.id) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Decrypted connection config for the edit dialog (prefill REAL values —
// user directive; cookie-authed, single-user instance model)
app.get('/api/mounts/:id/config', (req, res) => {
  try { res.json(mounts.config(req.params.id)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.patch('/api/mounts/:id', async (req, res) => {
  try { await mounts.update(req.params.id, req.body || {}); res.json({ success: true, mounts: mounts.list() }); }
  catch (e) { res.status(400).json({ error: e.message, mounts: mounts.list() }); }
});
// Credentials (2.108.0): mount points under a credential + manual convert
app.post('/api/mounts/:id/children', (req, res) => {
  try { const id = mounts.addChild(req.params.id, req.body || {}); res.json({ success: true, id, mounts: mounts.list() }); }
  catch (e) { res.status(400).json({ error: e.message, mounts: mounts.list() }); }
});
app.post('/api/mounts/:id/convert', async (req, res) => {
  try { await mounts.convert(req.params.id, req.body?.to === 'credential' ? 'credential' : 'mount'); res.json({ success: true, mounts: mounts.list() }); }
  catch (e) { res.status(400).json({ error: e.message, mounts: mounts.list() }); }
});
app.delete('/api/mounts/:id', async (req, res) => {
  try { await mounts.remove(req.params.id); res.json({ success: true }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
const { readLayouts, writeLayouts, flushLayouts } = persistenceRouter;

// Session discovery functions imported from ./src/session-store.js
// Helper to create SessionMessages with correct context
function createSessionMessages(session, sessionId) {
  return session?.backend === 'codex'
    ? new CodexSessionMessages(session, sessionId, { buffersDir: BUFFERS_DIR })
    : new SessionMessages(session, sessionId, { buffersDir: BUFFERS_DIR, permissionModes: PERMISSION_MODES });
}

// ── Session API (extracted to src/routes/sessions.js) ──
const { router: sessionsRouter, setup: setupSessions } = require('./src/routes/sessions');
setupSessions({ activeSessions, webuiPids, refreshWebuiPids, createSessionMessages, BUFFERS_DIR, PERMISSION_MODES, execFileSync, hosts, accounts, sessionAuth, serverSetting });
// Backend readiness for onboarding: is each CLI installed + logged in?
// Login detection is best-effort file existence — never spawns the CLIs.
app.get('/api/backend-status', async (req, res) => {
  // R1 (three-tier): the machine facts come from the SHARED probe module —
  // the same implementation the device daemon serves as `probe-cli` for
  // remote machines. This route is device #0's in-process call (CS amendment
  // #2: shared implementation, no socket transit). Orchestrator-only
  // composition (env-key overlay, named-account counts) layers on after.
  let out;
  try { out = await machineProbes.cliFacts({ claudeCmd: CLAUDE_CMD, codexCmd: CODEX_CMD }); } catch { out = { claude: {}, codex: {} }; }
  if (!out.claude.loggedIn && process.env.ANTHROPIC_API_KEY) { out.claude.loggedIn = true; out.claude.loginMethod = 'env-key'; }
  // Named-account nuance (2.267.1): under full pooling the MACHINE login
  // legitimately idles to token-less — count usable named identities so the
  // client can say what's actually true instead of "not logged in".
  try {
    const l = accounts.list();
    out.claude.namedLoggedIn = (l.accounts || []).filter((a) =>
      (a.backend || 'claude') === 'claude' && (a.loggedIn || (!a.pooled && a.type !== 'subscription' && a.tail))).length;
  } catch {}
  res.json(out);
});

app.use(sessionsRouter);

// ── Usage / Rate Limit ──
// Usage / rate limits read NON-INVASIVELY from the OAuth token store. Cached,
// refreshed every ~5 min. See _fetchOAuthUsage below for the why.
// ── Usage / Rate Limit ── (extracted to src/usage-routes.js in the 2.92.0 split)
const { setupUsage } = require('./src/usage-routes');
const usage = setupUsage({ app, accounts, hosts, usageHistory, activeSessions, serverSetting, ensureDir, USAGE_CACHE_FILE, USAGE_CACHE_DIR, CODEX_SESSIONS_DIR, META_DIR, AVAILABLE_MODELS, BUFFERS_DIR, probeUsageForAccountKey });
// Normalizer-level settings reads (chat.hideEmptyHooks) go through the REAL store
MessageManager.getSetting = (k) => { try { return serverSetting(k); } catch { return undefined; } };
const { getOAuthToken, usagePollingEnabled, summarizeCodexRateLimit, summarizeCodexRateLimits } = usage;
app.get('/api/available-models', (req, res) => {
  refreshCodexModels(); // mtime-guarded local read — stays current despite old-CLI cache rewrites
  res.json(AVAILABLE_MODELS);
});
app.get('/api/session-options', (req, res) => {
  res.json({ effortLevels: EFFORT_LEVELS, permissionModes: PERMISSION_MODES });
});

// ── WebSocket Terminal Handler (extracted to src/ws-handler.js) ──
const { registerWsHandler, noConvoRef, pickCodexThreadCandidate } = require('./src/ws-handler');
registerWsHandler(wss, {
  poolChooser: poolChooserForModel,
  sbNoteServerOp,
  agentdRemote: { ensureAgentdOnHost, agentdHostToken, agentdDir: AGENTD_DIR, attachBundle: path.join(__dirname, 'data', 'bin', 'vibespace-agentd-attach.js') },
  dialBridge,
  activeSessions, WS_OPEN, broadcastActiveSessions, broadcastToSession, resizeSessionToMin,
  setupSessionPty, refreshWebuiPids, deleteSessionMeta, writeSessionMeta, readSessionMeta,
  readLayouts, writeLayouts, getSyncStore, serverSetting, integrationEnabled,
  sessionCounterRef, createSessionMessages,
  SOCKETS_DIR, BUFFERS_DIR, PTY_WRAPPER, CHAT_WRAPPER,
  NODE_CMD, DTACH_CMD, ENV_CMD, CLAUDE_CMD, EDITOR_CMD, AGENT_BIN_DIR, PORT, X_ENV,
  adapterRegistry, pty, path, fs, os, execFileSync, ensureDir, hosts,
  accounts, scheduleCtxSync, activeSessionsPayload, serverNotice,
  USAGE_STATUSLINE_CMD, userStatuslineCmd,
});

// Billing identity for the card badge. Precedence: env-key spawn (definite) →
// the CLI's OWN init statement (apiKeySource: 'none'=subscription OAuth,
// '/login managed key'=console login=API billing, 'ANTHROPIC_API_KEY'=env) →
// spawn-time global-login guess (marked guessed) → unknown. This is what tells
// the user WHICH sessions still burn API money after they re-login to the
// subscription: env-key/console sessions keep their auth for their lifetime.
function sessionAuth(s) {
  const be = s.backend || 'claude';
  // A remote session's billing identity lives ON ITS MACHINE — qualify every
  // auth object with the host name so a "CLI login" badge names WHICH
  // machine's login it is (2.188.0: a remote host-login session rendered
  // byte-identical to a local one, and the tooltip pointed at the wrong box).
  const hostName = s.host ? (() => { try { return hosts.get(s.host)?.name || s.host; } catch { return s.host; } })() : null;
  const withHost = (o) => (o && hostName ? { ...o, hostName } : o);
  if (be === 'codex') {
    // Codex billing identity: named ChatGPT account (isolated CODEX_HOME) or
    // the machine's own ~/.codex login. Feeds the title-bar billing badge.
    if (s._accountId) {
      const a = accounts.get(s._accountId);
      return withHost({ source: 'codex-subscription', name: a?.name || 'ChatGPT' });
    }
    return withHost({ source: 'codex-cli' });
  }
  if (be !== 'claude') return null; // shell terminals — nothing billed
  if (s._accountId) {
    const a = accounts.get(s._accountId);
    // A POOLED pseudo-account (B-6217): show it AS a pool + the real account it
    // currently bills, so the badge/chip never mislabels it as an API key
    // (real report: pooled sessions rendered as 'API key').
    if (a && a.type === 'pooled') {
      let cur = null; try { const c = accounts.poolCurrentFor(a.id, s._webuiId || null); cur = c ? (accounts.get(c)?.name || null) : null; } catch {} // plan C: THIS session's link target, not the pool default
      return withHost({ source: 'pooled', name: a.name, poolTarget: cur });
    }
    // A named SUBSCRIPTION account bills the subscription (not API) — show its
    // name, no amber key warning.
    if (a && (a.type || 'api') === 'subscription') return withHost({ source: 'subscription', name: a.name });
    return withHost({ source: 'api-key', name: a?.name || 'API key', tail: a?.tail || null });
  }
  const src = s._apiKeySource;
  if (src === 'none') return withHost({ source: 'subscription' });
  if (src === '/login managed key') return withHost({ source: 'api-console' });
  if (src === 'ANTHROPIC_API_KEY') return withHost({ source: 'api-key', name: 'env key' });
  if (typeof src === 'string' && src) return withHost({ source: 'api-other', detail: src });
  const at = s._authAtSpawn;
  if (at === 'subscription') return withHost({ source: 'subscription', guessed: true });
  if (at === 'console') return withHost({ source: 'api-console', guessed: true });
  if (at === 'env-key') return withHost({ source: 'api-key', guessed: true });
  // remote session with no explicit account: billed by the HOST's own CLI
  // login — a real subscription-or-key on that machine, never "unknown"
  // (2.188.0: remote TERMINAL sessions showed "KEY?" forever — apiKeySource
  // is chat-stream-only and the /proc backfill probes the LOCAL ssh wrapper).
  if (at === 'remote-global') return withHost({ source: 'subscription', guessed: true });
  return withHost({ source: 'unknown' });
}

// THE single active-sessions payload builder — used by every broadcast AND the
// per-connection initial snapshot (ws-handler). A second hardcoded field list
// anywhere means new fields silently vanish for freshly-(re)connected clients
// until the next organic broadcast (bit us twice: host badges, then auth/todo).
function activeSessionsPayload() {
  const getSessionKey = (session = {}) => {
    const backend = session.backend || 'claude';
    const backendSessionId = session.backendSessionId || session.sessionId || session.claudeSessionId || null;
    return backendSessionId ? `${backend}:${backendSessionId}` : '';
  };
  const activeList = [];
  for (const [id, s] of activeSessions) {
    // Exclude tmux view sessions — they shouldn't appear as separate "live" entries
    if (s.isTmuxView) continue;
    activeList.push({
      id,
      name: s.name,
      cwd: s.cwd,
      host: s.host || null,
      hostName: s.hostName || null,
      // transport truth for the card (2.219.1): a remote session whose local
      // wrapper is alive but whose HOST is unreachable used to show a plain
      // LIVE card — user read it as "conversable" while every input queued
      remoteState: (s._remoteState && s._remoteState.state !== 'connected') ? s._remoteState.state : null,
      createdAt: s.createdAt,
      backend: s.backend || 'claude',
      backendSessionId: s.backendSessionId || s.claudeSessionId || null,
      sessionKey: getSessionKey(s),
      claudeSessionId: s.claudeSessionId || null,
      sourceKind: s.sourceKind || null,
      agentKind: s.agentKind || 'primary',
      agentRole: s.agentRole || '',
      agentNickname: s.agentNickname || '',
      parentThreadId: s.parentThreadId || null,
      // Billing identity badge: which account this session's env was spawned
      // with (null = the CLI's global login / subscription).
      accountId: s._accountId || null,
      accountName: s._accountId ? (accounts.get(s._accountId)?.name || 'API key') : null,
      accountTail: s._accountId ? (accounts.get(s._accountId)?.tail || null) : null,
      todo: s._todos || null, // {done, total, current} — the agent's own TodoWrite/plan
      auth: sessionAuth(s), // billing identity (subscription / api-console / api-key / unknown)
      mode: s.mode || 'terminal',
    });
  }
  return activeList;
}

function broadcastActiveSessions() {
  const msg = JSON.stringify({ type: 'active-sessions', sessions: activeSessionsPayload() });
  wss.clients.forEach(client => {
    if (client.readyState === WS_OPEN) {
      try { client.send(msg); } catch {}
    }
  });
}

// ── In-container desktop (noVNC through our own cookie auth — src/vnc.js) ──
const { VncManager } = require('./src/vnc');
const vnc = new VncManager({ dataDir: path.join(__dirname, 'data') });
app.get('/api/vnc/status', async (req, res) => {
  try { res.json(await vnc.status()); } catch (e) { res.status(500).json({ error: e.message }); }
});
app.post('/api/vnc/start', async (req, res) => {
  try { res.json(await vnc.ensureRunning()); } catch (e) { res.status(500).json({ error: e.message }); }
});
// RFB over WebSocket (websockify semantics: binary frames ↔ raw TCP). The
// bridge is the ONLY route to the localhost-bound VNC server, and it sits
// behind the same cookie auth as everything else — single login by design.
const vncWss = new WebSocketServer({ noServer: true });
const agentdDialWss = new WebSocketServer({ noServer: true }); // Transport B dial-in (2.144.0)
function bridgeVncSocket(ws) {
  const net = require('net');
  const sock = net.connect(vnc.port, '127.0.0.1');
  sock.on('data', (d) => {
    if (ws.readyState !== 1) return;
    ws.send(d);
    // Backpressure: a fast framebuffer + slow client would balloon the WS
    // buffer — pause the TCP side until the browser drains.
    if (ws.bufferedAmount > 8 * 1024 * 1024) {
      sock.pause();
      const t = setInterval(() => {
        if (ws.readyState !== 1) { clearInterval(t); return; }
        if (ws.bufferedAmount < 1024 * 1024) { clearInterval(t); sock.resume(); }
      }, 50);
    }
  });
  ws.on('message', (m) => { try { sock.write(m); } catch {} });
  ws.on('close', () => sock.destroy());
  ws.on('error', () => sock.destroy());
  sock.on('close', () => { try { ws.close(); } catch {} });
  sock.on('error', () => { try { ws.close(); } catch {} });
}

// ── Start Server ──
// THE single WebSocket upgrade dispatcher: /ws (main app), /proxy/ (unblocker
// site WebSockets), /api/vnc (desktop bridge). Everything else is destroyed.
server.on('upgrade', (req, socket, head) => {
  const pathname = (req.url || '').split('?')[0];
  const deny = () => { socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n'); socket.destroy(); };
  if (pathname === '/ws') {
    if (!auth.requestAuthed(req)) return deny();
    wss.handleUpgrade(req, socket, head, (ws) => wss.emit('connection', ws, req));
  } else if (pathname.startsWith('/proxy/')) {
    if (!auth.requestAuthed(req)) return deny();
    unblocker.onUpgrade(req, socket, head);
  } else if (pathname === '/api/vnc') {
    if (!auth.requestAuthed(req)) return deny();
    vncWss.handleUpgrade(req, socket, head, (ws) => bridgeVncSocket(ws));
  } else if (pathname === '/api/device-dial' || pathname === '/api/agentd-dial') {
    // /api/device-dial is the name new pairing commands render;
    // /api/agentd-dial stays FOREVER — in-field daemons hold it in dial.json
    // Transport B: a remote device's daemon dialing IN. Gated by the per-device
    // dial token (never cookie auth — daemons have no cookies); real protocol
    // auth (vsht_ hello) happens inside the mux on this stream.
    const q = new URL(req.url, 'http://x').searchParams;
    const deviceId = String(q.get('device') || '').slice(0, 64);
    const tok = String(req.headers['x-vibespace-dial-token'] || '');
    const want = hosts.dialTokenHash(deviceId); // pairing credential lives on the host record (B-f3e8)
    const got = tok ? require('crypto').createHash('sha256').update(tok).digest('hex') : null;
    if (!deviceId || !want || got !== want) {
      // observability: a silently deny()'d redial is indistinguishable from
      // "no attempts" in the logs (bit us diagnosing the dead-Mac incident)
      console.log(`[device] dial REJECTED for '${deviceId || '?'}' — ${!deviceId ? 'no device id' : !want ? 'no pairing on record' : 'token mismatch'}`);
      return deny();
    }
    agentdDialWss.handleUpgrade(req, socket, head, (ws) => {
      // adapt the ws to the duplex shape Mux consumes
      const listeners = { data: [], close: [], error: [] };
      ws.on('message', (d) => listeners.data.forEach((f) => f(Buffer.isBuffer(d) ? d : Buffer.from(d))));
      ws.on('close', () => listeners.close.forEach((f) => f()));
      ws.on('error', () => listeners.error.forEach((f) => f()));
      const stream = {
        write: (d) => { try { ws.send(d); return true; } catch { return false; } },
        on: (ev, fn) => { listeners[ev]?.push(fn); },
        destroy: () => { try { ws.close(); } catch { } },
      };
      agentdDials.set(deviceId, stream);
      // the device re-dialed with a FRESH stream — drop any cached
      // DeviceManager bound to the previous (dead) stream so the next op
      // rebuilds over this one (stale-stream blank-session fix)
      try { const old = agentdDialDevices.get(deviceId); if (old && old._dialStream !== stream) { old.stop?.(); agentdDialDevices.delete(deviceId); } } catch { }
      try { hosts.invalidateDevice?.('host-dial-' + String(deviceId).replace(/[^\w-]/g, '')); } catch { }
      try { hosts.onDialIn?.(deviceId); } catch { } // graduated ssh host: prefer this fresh dial link (B-6640)
      console.log(`[device] device '${deviceId}' dialed in`);
      // heal recorded pull mounts + re-own push tunnel ports + flip the UI dot
      try { machineMounts.onMachineLinked(hosts.findByDeviceId(deviceId)?.id); } catch { }
      try { portForwards.onMachineLinked(hosts.findByDeviceId(deviceId)?.id); } catch { }
      // Re-own each live dial session's VIBESPACE_API back-tunnel (audit #49):
      // the per-session reverse listener existed only in the DEAD link's
      // DeviceManager — mounts/port-forwards heal from persisted records on
      // dial-in, sessions had none, so vibespace-status/task/ask + remote
      // Ctrl+G went connection-refused forever after any re-dial or server
      // restart while the session kept chatting fine (nothing surfaced it).
      // The daemon's reverseListen `existing` branch re-owns a still-bound
      // port; a reaped one (>10min offline) rebinds at the same number.
      (async () => {
        const netR = require('net');
        for (const [, s] of activeSessions) {
          if (s._dialDeviceId !== deviceId || !s._dialReversePort) continue;
          try {
            const dm = await deviceForDial(deviceId);
            await dm.reverseForward({ port: s._dialReversePort, connectLocal: () => netR.connect(PORT, '127.0.0.1') });
          } catch (e) { console.warn(`[device] session back-tunnel re-own failed (${s._dialReversePort}):`, e.message); }
        }
      })().catch(() => { });
      try { bcastAll({ type: 'hosts-updated' }); } catch { }
      ws.on('close', () => {
        if (agentdDials.get(deviceId) === stream) agentdDials.delete(deviceId);
        try { bcastAll({ type: 'hosts-updated' }); } catch { }
      });
    });
  } else {
    socket.destroy();
  }
});

// ── Version / update visibility (⚙ menu shows current + latest at the Update entry) ──
// Latest = the canonical repo's master package.json — fetched LAZILY on
// request only (never a background timer), cached 6h, best-effort: offline
// instances just show the local version.
const versionInfo = { fetchedAt: 0, latest: null, commit: null };
// ── UI-driven self-update (2.111.21): the update runs as a DETACHED op with
// its output in data/update.log; the client shows a progress dialog, keeps
// polling across the restart (KillMode=process / the container supervisor
// leave the detached script alive), and reloads when /api/version changes.
// Replaced the "suddenly opens a terminal that just sits there" flow.
let _selfUpdate = null; // { pid, startedAt }
const _updateLogPath = path.join(__dirname, 'data', 'update.log');
app.post('/api/self-update', (req, res) => {
  try {
    if (!fs.existsSync(path.join(__dirname, 'scripts', 'update.sh'))) return res.status(400).json({ error: 'update script not found' });
    if (_selfUpdate) { try { process.kill(_selfUpdate.pid, 0); return res.json({ success: true, already: true }); } catch { _selfUpdate = null; } }
    // The pid map dies with the server (the update's own restart!) while the
    // DETACHED script keeps running — unlinking its live log here sent the
    // first run's remaining output to an unlinked inode and spawned a second
    // concurrent update.sh. A recent log without the exit sentinel = a run
    // still in flight; hand the dialog the existing log instead. (update.sh
    // also flocks data/.update.lock as the hard guard.)
    try {
      const st = fs.statSync(_updateLogPath);
      if (Date.now() - st.mtimeMs < 10 * 60 * 1000) {
        const fd = fs.openSync(_updateLogPath, 'r');
        const len = Math.min(st.size, 4000);
        const buf = Buffer.alloc(len);
        fs.readSync(fd, buf, 0, len, st.size - len);
        fs.closeSync(fd);
        if (!buf.toString('utf8').includes('__UPDATE_EXIT:')) return res.json({ success: true, already: true });
      }
    } catch {}
    try { fs.unlinkSync(_updateLogPath); } catch {}
    const fd = fs.openSync(_updateLogPath, 'a');
    const child = spawn('bash', ['-c', 'bash scripts/update.sh; echo "__UPDATE_EXIT:$?"'], {
      cwd: __dirname, detached: true, stdio: ['ignore', fd, fd],
      env: { ...process.env, VIBESPACE_SUPERVISED: process.env.VIBESPACE_SUPERVISED || '1' },
    });
    fs.closeSync(fd);
    child.unref();
    _selfUpdate = { pid: child.pid, startedAt: Date.now() };
    res.json({ success: true });
  } catch (e) { res.status(500).json({ error: e.message }); }
});
app.get('/api/self-update/status', (req, res) => {
  let log = '';
  try {
    const st = fs.statSync(_updateLogPath);
    const fd = fs.openSync(_updateLogPath, 'r');
    const len = Math.min(st.size, 6000);
    const buf = Buffer.alloc(len);
    fs.readSync(fd, buf, 0, len, st.size - len);
    fs.closeSync(fd);
    log = buf.toString('utf8');
  } catch {}
  let running = false;
  if (_selfUpdate) { try { process.kill(_selfUpdate.pid, 0); running = true; } catch {} }
  res.json({ running, log });
});

// ── Maintenance mode (2.189.0): operator-onsite transparency ──
// When someone (an admin / a support agent) is actively connected to this
// instance troubleshooting it, a persistent banner tells the user so. State
// survives server restarts (troubleshooting often restarts the server) and
// AUTO-EXPIRES (default 2h, max 24h) so a forgotten toggle can't linger.
const MAINT_FILE = path.join(__dirname, 'data', 'maintenance.json');
let _maintenance = null;
try { _maintenance = JSON.parse(fs.readFileSync(MAINT_FILE, 'utf-8')); } catch {}
function maintState() {
  if (_maintenance?.active && _maintenance.until && Date.now() > _maintenance.until) _maintenance = { active: false };
  return _maintenance?.active ? _maintenance : { active: false };
}
app.get('/api/maintenance', (req, res) => res.json(maintState()));
app.post('/api/maintenance', (req, res) => {
  const b = req.body || {};
  if (b.update != null && _maintenance?.active) {
    // live progress line ("checking the transcript cache…") — the banner shows
    // the latest one and keeps a timeline; each update EXTENDS the expiry
    // (active troubleshooting must not expire mid-work; hard cap 24h from start)
    const upd = { ts: Date.now(), text: String(b.update).slice(0, 300) };
    _maintenance.updates = [...(_maintenance.updates || []), upd].slice(-50);
    _maintenance.until = Math.min((_maintenance.since || Date.now()) + 24 * 3600e3,
      Math.max(_maintenance.until || 0, Date.now() + 3600e3));
  } else if (b.on) {
    const hours = Math.min(24, Math.max(0.25, Number(b.hours) || 2));
    _maintenance = {
      active: true,
      message: String(b.message || '').slice(0, 300),
      by: String(b.by || '').slice(0, 80),
      since: Date.now(),
      until: Date.now() + hours * 3600e3,
      updates: [],
    };
  } else {
    _maintenance = { active: false };
  }
  try { fs.writeFileSync(MAINT_FILE, JSON.stringify(_maintenance)); } catch {}
  const json = JSON.stringify({ type: 'maintenance-updated', maintenance: maintState() });
  wss.clients.forEach((c) => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  res.json({ success: true, maintenance: maintState() });
});

app.get('/api/version', async (req, res) => {
  if (versionInfo.commit === null) {
    try { versionInfo.commit = execFileSync('git', ['-C', __dirname, 'rev-parse', '--short', 'HEAD'], { encoding: 'utf-8', timeout: 3000 }).trim(); }
    catch { versionInfo.commit = ''; }
  }
  // 15min TTL (was 6h — during active release evenings the gear menu showed
  // "no update" for hours; real report). ?fresh=1 (the update dialog / menu
  // open) bypasses the cache with a 60s floor so clicks can't hammer GitHub.
  const _verTtl = req.query.fresh ? 60 * 1000 : 15 * 60 * 1000;
  if (Date.now() - versionInfo.fetchedAt > _verTtl) {
    versionInfo.fetchedAt = Date.now(); // stamped even on failure — no hammering while offline
    try {
      const ctl = new AbortController();
      const t = setTimeout(() => ctl.abort(), 5000);
      const r = await fetch('https://raw.githubusercontent.com/ProblemFactory/vibespace/master/package.json', { signal: ctl.signal });
      clearTimeout(t);
      if (r.ok) versionInfo.latest = (await r.json()).version || null;
    } catch {}
  }
  res.json({ version: require('./package.json').version, commit: versionInfo.commit || null, latest: versionInfo.latest });
});

// Changelog diff for the update-confirm dialog (user directive: clicking
// Update shows every change between the running and latest versions first).
// Canonical repo's CHANGELOG.md, lazily fetched + cached like /api/version.
function versionNewerThan(a, b) {
  const pa = String(a).split('.').map(Number), pb = String(b).split('.').map(Number);
  for (let i = 0; i < 3; i++) {
    if ((pa[i] || 0) > (pb[i] || 0)) return true;
    if ((pa[i] || 0) < (pb[i] || 0)) return false;
  }
  return false;
}
app.get('/api/changelog-diff', async (req, res) => {
  const cur = require('./package.json').version;
  if (Date.now() - (versionInfo.clFetchedAt || 0) > (req.query.fresh ? 60 * 1000 : 15 * 60 * 1000)) {
    versionInfo.clFetchedAt = Date.now(); // stamped even on failure — offline-safe
    try {
      const ctl = new AbortController();
      const t = setTimeout(() => ctl.abort(), 8000);
      const r = await fetch('https://raw.githubusercontent.com/ProblemFactory/vibespace/master/CHANGELOG.md', { signal: ctl.signal });
      clearTimeout(t);
      if (r.ok) versionInfo.changelog = await r.text();
    } catch {}
  }
  const all = [];
  for (const block of String(versionInfo.changelog || '').split(/\n## /).slice(1)) {
    const nl = block.indexOf('\n');
    const head = (nl < 0 ? block : block.slice(0, nl)).trim();
    const ver = (head.match(/^(\d+\.\d+\.\d+)/) || [])[1];
    if (!ver) continue;
    all.push({ version: ver, head, body: nl < 0 ? '' : block.slice(nl + 1).trim() });
  }
  const entries = all.filter((e) => versionNewerThan(e.version, cur));
  // Already on the latest? Show the CURRENT version's own changelog entry
  // (matched, else the newest) instead of an empty dialog (user request).
  const atLatest = entries.length === 0;
  if (atLatest && all.length) entries.push(all.find((e) => e.version === cur) || all[0]);
  res.json({ current: cur, latest: versionInfo.latest || null, entries, atLatest });
});


// ── Prometheus /metrics exporter (opt-in, generic): a SEPARATE listener on
// VIBESPACE_METRICS_PORT, meant for in-cluster scrapes via pod annotations —
// it is never routed through the app ingress/auth, so keep the port un-exposed
// in any public deployment. Hand-rolled text exposition, no dependencies.
const METRICS_PORT = Number(process.env.VIBESPACE_METRICS_PORT || 0);
if (METRICS_PORT > 0) {
  const metricsStarted = Date.now();
  const pkgVersion = (() => { try { return require('./package.json').version; } catch { return ''; } })();
  http.createServer((mreq, mres) => {
    if (!String(mreq.url).startsWith('/metrics')) { mres.writeHead(404); return mres.end(); }
    let watchers = 0, normMsgs = 0;
    try { for (const [, sess] of activeSessions) { watchers += sess.subagentWatchers?.size || 0; normMsgs += sess._normalizer?.total || 0; } } catch {}
    const mu = process.memoryUsage();
    const L = [];
    const g = (name, val, help) => { L.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, `${name} ${val}`); };
    g('vibespace_process_resident_memory_bytes', mu.rss, 'Server process RSS');
    g('vibespace_nodejs_heap_used_bytes', mu.heapUsed, 'V8 heap used');
    g('vibespace_nodejs_heap_total_bytes', mu.heapTotal, 'V8 heap total');
    g('vibespace_live_sessions', activeSessions.size, 'Active (webui-managed) sessions');
    g('vibespace_ws_clients', (typeof wss !== 'undefined' && wss.clients) ? wss.clients.size : 0, 'Connected WebSocket clients');
    g('vibespace_subagent_watchers', watchers, 'Live subagent fs watchers (leak canary)');
    g('vibespace_normalizer_messages', normMsgs, 'Normalized messages held in memory (leak canary)');
    g('vibespace_uptime_seconds', Math.round((Date.now() - metricsStarted) / 1000), 'Server uptime');
    L.push('# HELP vibespace_info Build info', '# TYPE vibespace_info gauge', `vibespace_info{version="${pkgVersion}"} 1`);
    mres.writeHead(200, { 'Content-Type': 'text/plain; version=0.0.4' });
    mres.end(L.join('\n') + '\n');
  }).listen(METRICS_PORT, () => console.log(`  metrics exporter on :${METRICS_PORT}`));
}


server.listen(PORT, HOST, () => {
  const ver = require('./package.json').version;
  console.log(`\n  VibeSpace v${ver} running at http://localhost:${PORT}`);
  // PID file for the supervised-restart path (scripts/update.sh in a container:
  // no systemd — the entrypoint respawn loop restarts us when update.sh kills
  // this pid; dtach sessions live in the same PID namespace and survive).
  try { fs.writeFileSync(path.join(__dirname, 'data', 'server.pid'), String(process.pid)); } catch {}
  console.log(`  dtach: ${DTACH_CMD}, node: ${NODE_CMD}, env: ${ENV_CMD}, claude: ${CLAUDE_CMD}, codex: ${CODEX_CMD}`);
  if (process.platform === 'linux') console.log(`  X display: ${X_ENV.DISPLAY || '(none)'}${X_ENV.XAUTHORITY ? ' (xauth: ' + X_ENV.XAUTHORITY + ')' : ''} — clipboard image paste ${X_ENV.probed ? 'ready' : 'UNAVAILABLE (no working X display found)'}`);

  // Local sessions run through the device daemon (machine #0) — GRADUATED,
  // no flag: bring it up BEFORE restore so re-adopted sessions attach through
  // it too. attachToDtach still falls back to a local pty on ANY failure.
  {
    try {
      const { DeviceManager } = require('./src/agentd/client.js');
      deviceMgr = new DeviceManager({
        dataDir: path.join(__dirname, 'data'),
        bundlePath: path.join(__dirname, 'data', 'bin', 'vibespace-agentd.js'),
        version: require('./package.json').version,
        nodeModules: path.join(__dirname, 'node_modules'),
        log: console.log,
      });
      // device #0 becomes reachable through hosts.device(null) — that is what
      // lets a consumer be written ONCE and run on ANY machine including this
      // one (CS separation, 2.276.0). Wired BEFORE connect so a consumer that
      // races startup gets the handle and awaits its connect like any other.
      try { hosts.setLocalDevice(deviceMgr); } catch { }
      deviceMgr.connect().then(() => console.log('  device-daemon: device session routing ENABLED')).catch((e) => {
        console.warn('  device-daemon: could not reach the daemon — local pty fallback:', e.message);
        deviceMgr = null; // fall back cleanly
        try { hosts.setLocalDevice(null); } catch { } // consumers fall back to their legacy local path
      });
    } catch (e) { console.warn('  device-daemon: init failed — local pty fallback:', e.message); deviceMgr = null; }
  }

  // Restore existing dtach sessions from before restart
  migrateLegacyHomeProjects();
  restoreSessions();
  // Plan C boot reconciliation: a per-session pool link whose session did not
  // survive the restart is a billing pointer nobody can see or move — unlink.
  try { const n = accounts.sweepSessionPoolLinks(new Set(activeSessions.keys())); if (n) console.log(`[pool] swept ${n} orphaned per-session link(s)`); } catch { }
  // B-1525 second half: consume the .orphan metas the dead-socket cleanup
  // preserved — remote keeper sessions whose claude is STILL ALIVE on its
  // host come back LIVE by themselves (no manual surgery). Runs even on a
  // zero-socket boot (the pod-recreation case restoreSessions early-returns
  // on); delayed off the boot critical path; probes are read-only ssh.
  setTimeout(() => { readoptOrphanKeeperSessions().catch((e) => console.warn('[readopt] failed:', e.message)); }, 8000);

  // Orphan sweep — AGE-BASED (2.89.1). The activeSessions-keyed sweep was a
  // real data-loss race: a live dtach session the restore didn't re-adopt
  // within 30s (or re-adopted under a different id after meta corruption) had
  // its buffer UNLINKED while the wrapper kept writing the deleted inode —
  // live streaming looked fine, but every restart rebuilt history without the
  // buffer ("重启之后消息就都没了", real incident). Dead buffers stop being
  // WRITTEN, so age is race-free by construction: only files untouched for
  // 7 days are ever deleted, and never for a currently-active session.
  setTimeout(() => {
    let swept = 0;
    const cutoff = Date.now() - 7 * 86400000;
    try {
      for (const fn of fs.readdirSync(BUFFERS_DIR)) {
        const m = fn.match(/^(.+)\.(buf|json)$/);
        if (!m || activeSessions.has(m[1])) continue;
        try {
          const st = fs.statSync(path.join(BUFFERS_DIR, fn));
          if (st.mtimeMs > cutoff) continue; // recently written → possibly a live-but-unadopted session
          fs.unlinkSync(path.join(BUFFERS_DIR, fn)); swept++;
        } catch {}
      }
    } catch {}
    // data/agentd/session-*.json attach configs (0600, vsht_ host token +
    // full spawn command) — the kill-path unlink needs the live session, so
    // pod recreation leaked one per dial/agentd session forever (audit
    // #16/#53). Same age rule: written once at create, so 7d + not-active is
    // race-free (active sessions are protected by the id check alone).
    try {
      for (const fn of fs.readdirSync(AGENTD_DIR)) {
        const m = fn.match(/^session-(.+)\.json$/);
        if (!m || activeSessions.has(m[1])) continue;
        try {
          const st = fs.statSync(path.join(AGENTD_DIR, fn));
          if (st.mtimeMs > cutoff) continue;
          fs.unlinkSync(path.join(AGENTD_DIR, fn)); swept++;
        } catch {}
      }
    } catch {}
    if (swept) console.log(`  Swept ${swept} orphaned session-buffer/attach-cfg files (>7d untouched)`);
  }, 30000);

  console.log(`  Ready.\n`);
});

// On server shutdown: only kill the attach PTYs, NOT the dtach sessions
// Claude processes in dtach survive the server restart
function shutdown() {
  for (const [, s] of activeSessions) { try { if (s.pty) s.pty.kill(); } catch {} }
  // SyncStores + layouts persist on a debounce — flush so changes made within
  // the last couple seconds aren't lost across a restart
  for (const store of Object.values(syncStores)) { try { store.flush(); } catch {} }
  try { flushLayouts(); } catch {}
  try { sessionStatus.flush(); } catch {} // debounced session-status writes
  try { userTodos.flush(); } catch {} // debounced user-todo writes
  try { telemetry.flush(); } catch {} // buffered telemetry records (2.219.0)
  try { sysinfo.persistHistory(); } catch {} // resource-history ring (2.223.0)
  process.exit(0);
}
process.on('SIGINT', () => {
  console.log('\n  Shutting down (dtach sessions will keep running)...');
  shutdown();
});
process.on('SIGTERM', shutdown);