server.js

require('./src/server/runtime-boot.js').boot({ rootDir: __dirname }); // lane runtime-floor: FIRST — a newer data/runtime/current node replaces this process (same pid; the unit / run.sh / a pod's entrypoint unchanged), then the [runtime] verdict line + the boot pull's check
// libuv threadpool headroom (default 4): a few fs ops stuck on a dying fuse
// mount used to starve EVERY async fs/dns op server-wide (real outage — see
// mounts.js hung-mount defense). Must be set before the pool first spins up, i.e. before any require that performs async I/O.
process.env.UV_THREADPOOL_SIZE = process.env.UV_THREADPOOL_SIZE || '32';
const bootTrace = require('./src/server/boot-trace.js').start({ dataDir: require('path').join(__dirname, 'data') }); // THE BOOT HOLDS (B-1319): the boot's own loop clock from here — GET /api/boot-trace, data/boot-trace.json
const express = require('express');
const http = require('http');
const { WebSocketServer } = require('ws');
const pty = require('node-pty');
const path = require('path');
// STORE TIMING (design 011 lane 1): every named store's sync write / big read is timed from here on (src/timed-sync.js);
// VIBESPACE_STORE_TIMING=0 turns the clock off. On before any store is constructed, so the boot reads are counted.
const storeTiming = require('./src/timed-sync.js');
storeTiming.enable(process.env.VIBESPACE_STORE_TIMING !== '0');
const fs = require('fs');
const os = require('os');
const { execFileSync, spawn } = require('child_process');
const compression = require('compression');
const { MessageManager, driftLedgerRows } = require('./src/message-manager');
const { sameToken } = require('./src/pairing-token'); // B-8dda: a vsst_ compare in constant time
const { createMessageManager, feedLive, feedPeerCard } = require('./src/normalizers');
const { Telemetry } = require('./src/telemetry');
const { SyncStore } = require('./src/sync-store');
const { cwdToProjectDir, SessionMessages, findSessionJsonlPath, dedupWebuiSockets } = require('./src/session-store');
const { addressableId } = require('./src/claude-lock-capture'); // verify r5 (channel-withdraw): the roster's own-id rule — a pending fork is nobody's address
const { readChildPids } = require('./src/cli-identity');   // THE process reader — /proc first, ONE `ps` table where there is none, never a fork per item
const { CodexSessionMessages } = require('./src/codex-session-store');
const { normalizeCodexSource, CODEX_SESSIONS_DIR } = require('./src/adapters/codex');
const { createAdapterRegistry } = require('./src/adapters');
const { buildClaudeSubscriptionLoginCommand } = require('./src/claude-subscription-login');
const fileRoutes = require('./src/routes/files');
const { SafeFs } = require('./src/safe-fs');
const { router: persistenceRouter, setup: setupPersistence } = require('./src/routes/persistence');

// ── Env sanitation: the server may have been (re)started from INSIDE a Claude
// Code session (e.g. an agent running in a WebUI terminal restarts it). The
// inherited session env then leaks into every CLI this server spawns —
// CLAUDE_CODE_CHILD_SESSION=1 alone puts a spawned claude into child-session
// mode: NO lock file, NO project transcript. Conversations look fine live but
// are silently unpersisted — terminate + resume loses everything (verified on
// CLI 2.1.199 by A/B env test). Strip the whole inherited set at startup so all
// spawn paths (dtach spawn line, wrappers, probes) run top-level.
if (process.env.CLAUDECODE || process.env.CLAUDE_CODE_CHILD_SESSION) {
  const stripped = [];
  for (const k of Object.keys(process.env)) {
    if (k === 'CLAUDECODE' || k === 'CLAUDE_EFFORT' || k.startsWith('CLAUDE_CODE_') || k.startsWith('CLAUDE_WEBUI_')) {
      stripped.push(k);
      delete process.env[k];
    }
  }
  console.warn(`[env] Server was started from inside a Claude Code session — stripped inherited session env (${stripped.join(', ')}) so spawned CLIs run top-level. Without this, spawned sessions never write transcripts and their conversations are LOST on resume.`);
}

// Optional persistent ops log (env-gated no-op without VIBESPACE_OPSLOG_DIR) —
// installed EARLY so the console tee captures the whole boot narrative.
try { require('./src/opslog').setupOpslog(require('./package.json').version); } catch (e) { console.warn('[opslog] init failed:', e.message); }

// Auto-update: pull latest + rebuild on startup (skip with NO_AUTO_UPDATE=1).
// A THROWAWAY server — its code under the OS temp dir, i.e. every suite's
// scratch worktree — never pulls (the hookRegistrationSafe rule): `git pull`
// in a worktree FETCHES into the SHARED .git and costs a network round trip
// before listen (measured 2026-09-24: 0.5-0.9 s boot without it, 2.5-15 s with
// it — past the 10 s boot window many scratch suites wait: five went red).
const throwawayRoot = [os.tmpdir(), '/tmp'].some((t) => (path.resolve(__dirname) + path.sep).startsWith(path.resolve(t) + path.sep));
if (throwawayRoot && !process.env.NO_AUTO_UPDATE) console.log('[auto-update] skipped: throwaway/temp server root');
// the pull / install / build + the reset of the tracked files a build rewrites (the checkout stays clean): src/server/auto-update.js
if (!process.env.NO_AUTO_UPDATE && !throwawayRoot) require('./src/server/auto-update.js').autoUpdate({ repoDir: __dirname });

const PORT = process.env.PORT || 3456;
const CLAUDE_CMD_RAW = process.env.CLAUDE_CMD || 'claude';
const CODEX_CMD_RAW = process.env.CODEX_CMD || 'codex';
// Resolve full paths at startup — node-pty's posix_spawnp may not find commands
// if Homebrew/nvm paths (/opt/homebrew/bin) aren't in Node's inherited PATH.
// The agent CLIs are re-resolved at SPAWN time when the boot answer went stale
// (B-a18e, the installer-window restart) ⇒ src/server/cli-cmd.js
const { resolveCmd } = require('./src/server/cli-cmd.js');
const DTACH_CMD = resolveCmd('dtach');
const NODE_CMD = process.execPath; // no ENV_CMD (lane antigravity-spawn-argv): a session's names ride its spawn's env, never an `env K=V` line (src/spawn/line.js)

// ── CLI environment (src/server/cli-env.js, decomposition #14) ──
// X display + adapter registry + CLI capability probes + model registry.
const { X_ENV, detectXDisplay, refreshXEnv, stabilizeXAuth, adapterRegistry,
  CLAUDE_CMD, CODEX_CMD, CODEX_LINUX_SANDBOX_CMD, CODEX_SANDBOX_SUPPORTED,
  CLAUDE_SUBSCRIPTION_LOGIN_HELPER, CLAUDE_SUPPORTS_NAME, PERMISSION_MODES,
  EFFORT_LEVELS, CLAUDE_MODEL_ALIASES, CLAUDE_KNOWN_MODELS, AVAILABLE_MODELS,
  noteModelSeen, refreshAvailableModels, harnessAvailability, noteHarnessModels, cliCmds,
} = require('./src/server/cli-env.js').create({
  rootDir: __dirname, CLAUDE_CMD_RAW, CODEX_CMD_RAW, resolveCmd,
  getOAuthToken: (...a) => getOAuthToken(...a),
  usagePollingEnabled: (...a) => usagePollingEnabled(...a),
  refreshHarnessModels: (...a) => refreshHarnessModels(...a), broadcast: (m) => bcastAll(m), getTelemetry: () => { try { return telemetry; } catch { return null; } }, getPlugins: () => { try { return plugins; } catch { return null; } }, // S9: opencode serve caps verdict → 'harness-caps-updated'; runaway telemetry + the 'opencode-serve' PLUGIN is the autostart switch (lazy — both defined below)
  getHeldPtyIds: () => { try { return [...activeSessions.values()].map((s) => s?._opencodePtyId).filter(Boolean); } catch { return []; } }, // S9 r4: the ONE reader of session._opencodePtyId — the serve-pty reaper's keep set (lazy like getPlugins: activeSessions is declared below)
});
// ── Harness model lists: every descriptor's models({dataDir}) — codex: its CLI's
// own model cache (src/harnesses/codex-models.js); claude's list is cli-env's
// refreshAvailableModels, ACP agents report theirs (noteHarnessModels).
function refreshHarnessModels() {
  for (const h of require('./src/harnesses').list()) {
    if (typeof h.models !== 'function') continue;
    try { const list = h.models({ dataDir: path.join(__dirname, 'data') }); if (list) AVAILABLE_MODELS[h.id] = list; } catch { }
  }
}
refreshHarnessModels();
setTimeout(refreshAvailableModels, 3000);
setInterval(refreshAvailableModels, 3600000); // refresh hourly

const HOST = process.env.HOST || '0.0.0.0';

const app = express();
const server = http.createServer(app); const hub = require('./src/server/tls.js').create({ app, httpServer: server, dataDir: path.join(__dirname, 'data'), port: PORT, serverSetting: (k) => serverSetting(k), getUserTodos: () => userTodos, log: console, tailscaleBin: throwawayRoot && !process.env.VIBESPACE_TAILSCALE_BIN ? null : undefined }); // lane https-tailscale: ONE port, two servers — hub.front peeks each connection's first byte (TLS → https, else http), every listener reaches both through hub.attachToServers (test-architecture §89); a throwaway root never asks the real tailscale ⇒ src/server/tls.js

// ── Optional password auth (VIBESPACE_PASSWORD env / data/auth.json) +
//    optional Clerk SSO (VIBESPACE_CLERK_PUBLISHABLE_KEY — src/clerk-auth.js) ──
const { Auth } = require('./src/auth');
const { ClerkAuth } = require('./src/clerk-auth');
const clerkAuth = new ClerkAuth();
const auth = new Auth(path.join(__dirname, 'data'), { clerk: clerkAuth });
{
  const { generated } = auth.ensurePassword({ generateIfMissing: process.env.VIBESPACE_GENERATE_PASSWORD === '1' });
  if (generated) {
    console.log('\n  ╔════════════════════════════════════════════════╗');
    console.log(`  ║  Generated workspace password: ${generated.padEnd(15)} ║`);
    console.log('  ║  (persisted in data/auth.json — set             ║');
    console.log('  ║   VIBESPACE_PASSWORD to choose your own)        ║');
    console.log('  ╚════════════════════════════════════════════════╝\n');
  }
  if (auth.passwordEnabled) console.log('  Password auth: ENABLED');
  if (clerkAuth.enabled) console.log(`  Clerk SSO: ENABLED (${clerkAuth.frontendApi})`);
  // getter — auth can be enabled/disabled at runtime via /api/auth/set-password
  Object.defineProperty(app.locals, 'authEnabled', { get: () => auth.enabled });
  Object.defineProperty(app.locals, 'ssoEnabled', { get: () => auth.ssoEnabled });
}

// noServer + ONE manual upgrade dispatcher (registered at the bottom of this
// file): ws's own {server, path} listener calls handleUpgrade UNCONDITIONALLY
// and abortHandshake(400)s every non-matching path — it was killing /proxy/
// WebSockets silently and the /api/vnc bridge on arrival. Auth happens in the
// dispatcher (cookie token, same as HTTP).
const wss = new WebSocketServer({ noServer: true });

app.use(compression());
// HTTP latency observation (names-and-numbers only): rolling 5-min window
// flushed by the metrics sampler; slow requests (>1.5s) recorded as events
// with the SANITIZED route (first 3 path segments — /api/file/serve/* etc.
// carry user paths that must never enter the ledger).
const _httpWin = { n: 0, sum: 0, max: 0, slow: [] };
app.use((req, res, next) => {
  const t0 = process.hrtime.bigint();
  res.on('finish', () => {
    const ms = Number(process.hrtime.bigint() - t0) / 1e6;
    _httpWin.n++; _httpWin.sum += ms; if (ms > _httpWin.max) _httpWin.max = ms;
    if (ms > 1500 && _httpWin.slow.length < 20) {
      _httpWin.slow.push({ route: req.path.split('/').slice(0, 4).join('/') || '/', ms: Math.round(ms) });
    }
  });
  next();
});
app.use(auth.middleware()); // FIRST — the cookie gate + the same-origin rule stand before every route, the auth routes too (test-auth census)
auth.registerRoutes(app);
const cspReports = require('./src/server/csp-reports.js').create({ dataDir: path.join(__dirname, 'data'), file: process.env.VIBESPACE_CSP_REPORTS_FILE, getUserTodos: () => userTodos, log: console }); cspReports.register(app); // lane app-page-csp (q-043 D6): the app page's REPORT-ONLY policy (src/app-csp.js) + POST /api/csp-report — before the json parser (it reads its own ≤ 32 KB)
require('./src/server/frame-host.js').register(app); // lane design-frame-host (B-8679) + frame-host-preview (B-5b2c): GET /frame-host?kind=design|mail|preview|eml|docx — the ONE host document a frame the page makes navigates to, its kind's policy as a real header (a srcdoc frame would run under the app page's); the preview's folder /frame-host/f/<token>/ (a door — src/auth.js)
// Serve index.html with cache-busting query params on every local js/css asset
// (?v=<mtime>). Browsers serve unversioned <script>/<link> from memory cache on
// a soft reload without revalidating, so users were stuck on a stale bundle
// after an update until a hard refresh. Versioning the URL forces a fresh fetch
// whenever the file changes — no hard refresh ever needed.
app.get(['/', '/index.html'], (req, res, next) => {
  try {
    const pub = path.join(__dirname, 'public');
    let html = fs.readFileSync(path.join(pub, 'index.html'), 'utf-8');
    html = html.replace(/(href|src)="\/([^"?]+\.(?:js|css))"/g, (m, attr, file) => {
      try { return `${attr}="/${file}?v=${Math.floor(fs.statSync(path.join(pub, file)).mtimeMs)}"`; }
      catch { return m; }
    });
    res.set('Cache-Control', 'no-cache'); res.set(...cspReports.header()); // the app page: Content-Security-Policy-Report-Only (never the enforcing header — a later lane's switch)
    res.type('html').send(html);
  } catch { next(); }
});
app.use(require('./src/server/static-public.js').create(path.join(__dirname, 'public'))); // lane vault-chip-zone-errors: public/ through express.static — every file but a source map (served to nobody; test-csp-report ⑨)
// WebDAV bridge — BEFORE the json body parser (PUT bodies stream to disk).
// Auth = scoped Bearer mount tokens; see src/webdav.js for the security model.
const { MountTokens, registerWebdav } = require('./src/webdav');
const mountTokens = new MountTokens({ dataDir: path.join(__dirname, 'data') });
registerWebdav(app, { tokens: mountTokens });
// Proxied requests must reach unblocker with their body UNREAD — express.json
// consuming a proxied JSON POST forwarded a body-less request that hung the
// target on Content-Length (inc-mt2bpw2f: page rendered, every button dead).
// Skip here rather than mount unblocker earlier: auth must keep covering /proxy/. lane webhook-l1-server: /hook/<slug> + the pairing read their OWN raw bytes after their refusals.
const jsonBody = express.json({ limit: '50mb' }), OWN_BODY_RE = /^\/(?:proxy\/|hook\/|api\/channels\/webhook\/[^/]+\/pair$|api\/feedback\/forward$)/; // lane feedback-forward: the hub's forward door reads ≤ 64 KB AFTER its token
app.use((req, res, next) => (OWN_BODY_RE.test(req.path) ? next() : jsonBody(req, res, next)));

app.get('/xterm.css', (req, res) => {
  res.sendFile(path.join(__dirname, 'node_modules/@xterm/xterm/css/xterm.css'));
});

// ── Active session tracking (dtach-backed for persistence across server restarts) ──
// dtach is a minimal PTY detach/attach tool — no rendering layer, no mouse interception.
// Claude processes get raw PTY I/O identical to a native terminal.
const activeSessions = new Map();
// B-3f8a: account ids that have a RUNNING session — the merge/creds-rewrite
// guard consults this so a subscription merge never rewrites/removes a creds
// dir under a live session (the CLI re-reads creds per request, mid-turn).
const liveAccountIdSet = () => {
  const s = new Set();
  for (const sess of activeSessions.values()) if (sess?._accountId) s.add(sess._accountId);
  return s;
};
const sessionCounterRef = { value: 0 };
const SOCKETS_DIR = path.join(__dirname, 'data', 'sockets');
{ const f = require('./src/sock-path.js').socketPathFits(path.join(SOCKETS_DIR, 'cw-' + 'x'.repeat(36)), process.platform); if (!f.fits) console.warn(`[boot] socket paths under data/sockets would exceed ${f.max} bytes (${f.bytes}) — dtach cannot bind them; move the checkout to a shorter path`); } // the socket-path census (src/sock-path.js, lane-pairing ④): the operator's depth, said once
const META_DIR = path.join(__dirname, 'data', 'session-meta');
const BUFFERS_DIR = path.join(__dirname, 'data', 'session-buffers');

// ── HOME-RENAME MIGRATION (B-b4a2, one-shot at boot) ────────────────────────
// The 3.5.0 fleet image personalizes the container user, so $HOME moves (e.g.
// /home/vibe → /home/userL) while the PVC keeps everything recorded under
// the OLD path: ~/.claude/projects dirs encode the old cwd (claude's resume
// lookup goes by CURRENT-cwd encoding → every resume died "No conversation
// found"), and mounts/layouts/session metas hold dead /home/vibe/... paths.
// This repeats for EVERY user on EVERY such roll (userL needed manual
// surgery) — migrate automatically: rename projdirs to the new encoding and
// prefix-rewrite recorded paths. One-shot per (oldUser→newUser) marker.
function migrateHomeRename() {
  try {
    const home = os.homedir();
    const user = path.basename(home);
    // the transcript-dir layout is each harness's (store.homeRename — claude:
    // src/harnesses/claude-home.js); this core owns the marker + the store rewrite
    const hooks = require('./src/harnesses').list().map((h) => h.store && h.store.homeRename).filter((hr) => hr && typeof hr.staleUsers === 'function');
    const oldUsers = new Set(hooks.flatMap((hr) => hr.staleUsers(home, user)));
    for (const old of oldUsers) {
      const marker = path.join(__dirname, 'data', `.home-migrated-${old}-to-${user}`);
      if (fs.existsSync(marker)) continue;
      console.log(`[migrate] home rename detected: /home/${old} → ${home} — migrating projdirs + recorded paths`);
      let moved = 0;
      for (const hr of hooks) moved += hr.moveUser(home, old, user) || 0;
      // Prefix-rewrite every recorded string path in the small JSON stores.
      const rewrite = (v) => (typeof v === 'string' && v.includes(`/home/${old}/`))
        ? v.split(`/home/${old}/`).join(`/home/${user}/`)
        : (typeof v === 'string' && v === `/home/${old}`) ? `/home/${user}` : v;
      const walk = (x) => {
        if (Array.isArray(x)) return x.map(walk);
        if (x && typeof x === 'object') { for (const k of Object.keys(x)) x[k] = walk(x[k]); return x; }
        return rewrite(x);
      };
      const stores = [path.join(__dirname, 'data', 'mounts.json'), path.join(__dirname, 'data', 'layouts.json'),
        path.join(__dirname, 'data', 'task-groups.json'), path.join(__dirname, 'data', 'machine-mounts.json')];
      try { for (const f of fs.readdirSync(META_DIR)) stores.push(path.join(META_DIR, f)); } catch { }
      let rewrote = 0;
      for (const f of stores) {
        try {
          if (!fs.existsSync(f)) continue;
          const raw = fs.readFileSync(f, 'utf-8');
          if (!raw.includes(`/home/${old}`)) continue;
          const fixed = JSON.stringify(walk(JSON.parse(raw)));
          fs.writeFileSync(f + '.pre-home-migrate', raw); // one-shot backup beside it
          const tmp = f + '.tmp'; fs.writeFileSync(tmp, fixed); fs.renameSync(tmp, f);
          rewrote++;
        } catch (e) { console.warn(`[migrate] ${path.basename(f)}: ${e.message}`); }
      }
      fs.writeFileSync(marker, JSON.stringify({ at: Date.now(), moved, rewrote }));
      console.log(`[migrate] home rename done: ${moved} projdirs, ${rewrote} stores rewritten (backups *.pre-home-migrate)`);
    }
  } catch (e) { console.warn('[migrate] home-rename check failed:', e.message); }
}
migrateHomeRename();
const USAGE_CACHE_FILE = path.join(__dirname, 'data', 'usage-cache.json');
// Per-account PASSIVE usage capture (written by data/bin/vibespace-usage, the
// statusLine hook). Key '__global__' = the machine's own login; 'sub-…' = a
// named subscription. This is the ONLY usage source now — VibeSpace makes NO
// background /api/oauth/usage calls with subscription tokens (that off-CLI
// automated pattern is what gets Max/Pro accounts banned; see §ban-safety).
const USAGE_CACHE_DIR = path.join(__dirname, 'data', 'usage-cache');
const USAGE_SCANNER_PATH = path.join(__dirname, 'data', 'bin', 'vibespace-usage-scan');
const PTY_WRAPPER = path.join(__dirname, 'data', 'bin', 'pty-wrapper.js');

// ── CS refactor M1 (opt-in, default OFF): route LOCAL terminal sessions
// through the standing vibespace-agentd daemon. deviceMgr stays null unless
// the local device daemon is ALWAYS on since the 2.175.0 graduation —
// instantiates it, never spawns a daemon, and attachToDtach is byte-identical
// to today. daemonPtyShim presents the node-pty interface over a device
// session handle so setupSessionPty is unchanged.
let deviceMgr = null;
// ── M2 host-level agentd provisioning (always on since the 2.175.0 flag graduation) ──
// Per-host vsht_ token: the vault's entry `host:<id>` once it is set up (LOCKED ⇒ refused `vault_locked` by name; before
// the setup the 0600 file as before) — src/server/host-tokens.js (lane vault-e2e-password-fix-r2); no attach config holds it.
const AGENTD_DIR = path.join(__dirname, 'data', 'agentd');
function ensureDir(dir) { if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true }); }
const hostTokens = require('./src/server/host-tokens.js').create({ dataDir: path.join(__dirname, 'data'), agentdDir: AGENTD_DIR, nameOf: (k) => { const h = String(k).startsWith('dial-') ? hosts.findByDeviceId(String(k).slice(5)) : hosts.get(k); return (h && h.name) || null; } });   // nameOf: a LOCKED refusal names the machine (lane vault-locked-refusal-notice)
function agentdHostToken(hostId) { return hostTokens.tokenFor(hostId); }
// Install/refresh the daemon on a host, throttled per boot+version: a marker
// records the last version shipped; matching = skip (one ssh round trip saved
// per spawn; a bundle change reinstalls because the version bumps with it).
// ── Dial pairing primitives (src/server/dial-pairing.js, decomposition #13) ──
const { CHAT_WRAPPER, agentdDialDevices, agentdDials,
  agentdMintDialPair, daemonPtyShim, deviceForDial, ensureAgentdOnHost,
  unpairDialDevice, gateDialUpgrade, admitDial, noteDialEvent, lockOutDialHolder,
} = require('./src/server/dial-pairing.js').create({
  rootDir: __dirname, AGENTD_DIR, bcastAll: (...a) => bcastAll(...a),
  agentdHostToken: (...a) => agentdHostToken(...a), dropHostToken: (id) => hostTokens.drop(id),
  getHosts: () => { try { return hosts; } catch { return null; } },
  getMounts: () => { try { return mounts; } catch { return null; } },
  getMachineMounts: () => { try { return machineMounts; } catch { return null; } },
  getPortForwards: () => { try { return portForwards; } catch { return null; } },
  getExitProxy: () => { try { return exitProxy; } catch { return null; } }, getDialHealth: () => { try { return dialHealthWatch; } catch { return null; } },
});
// ── Cached webuiPids (PIDs managed by webui dtach sessions) ──
// childPid from the pty-wrapper meta file + that wrapper's children from /proc
// (readChildPids) — NEVER a fork per session: this runs IN-BAND on every kill
// and 3 s after every create, and the `pgrep -P` it replaces cost 9.16 s of
// blocked loop at 61 sessions / 1.5 GB RSS. Fork essay: src/cli-identity.js.
const webuiPids = new Set();

function refreshWebuiPids() {
  webuiPids.clear();
  for (const [id, s] of activeSessions) {
    try {
      const metaPath = path.join(BUFFERS_DIR, id + '.json');
      const meta = JSON.parse(fs.readFileSync(metaPath, 'utf-8'));
      if (meta.childPid) {
        webuiPids.add(meta.childPid);
        s._childPid = meta.childPid; s._childIdentity = meta.childStart ? require('./src/proc-identity').identityFromToken(meta.childPid, meta.childStart, meta.childBoot) : null; // its birth (B-5ee1); null = a legacy wrapper's meta
        for (const p of readChildPids(meta.childPid)) webuiPids.add(p);  // claude forks from the node-pty spawn
      }
      if (meta.pid) { webuiPids.add(meta.pid); }
    } catch {}
  }
}

// ── Broadcast helper (avoids duplicating per-session WebSocket iteration) ──
const WS_OPEN = 1;
// Top-level stream-json record types this server KNOWS (2.227.8 breadcrumb).
// Add a type here when you add its handling — until then it announces itself.
const CLAUDE_STREAM_TYPES = new Set([
  'assistant', 'user', 'system', 'result', 'attachment', 'control_request',
  'control_response', 'control_cancel_request', 'tool_progress', 'stream_event', 'summary', // control_cancel_request: the normalizer settles the card it withdraws (a helper stopped mid-ask, lane S1) — listed so the breadcrumb stops crying 'unhandled' (the naive-study log line)
  'rate_limit_event', // handled since 2.289.0 — the set lagged the handler, so the breadcrumb cried 'unhandled' for a handled type (misled the inc-msozeyw2 read)
  'command_lifecycle', 'queued_input', 'queue_changed', 'queue_op_result', 'queue_dropped', 'input_handover', 'queue_settle', // command_lifecycle: handled since 2.369.112 — the turn-start carrier of a harness-delivered peer message (inc-mu6bfv1t-4drq); the four queue records are the WRAPPER's (2.369.354, data/bin/chat-wrapper.js holds a mid-turn frame) — the normalizer reads them, the put-back door reads queue_dropped at its gate; input_handover (2.369.361) = what became of a frame handed to the running turn
  'set_in_progress_tool_use_ids', 'compact_progress', 'tombstone', '_stdin_ack', '_stdin_nack', '_remote_state', '_remote_exit', // B3 §2.5/§2.10/§2.11: the run set + compaction stage have readers in claude-stream-json.js, tombstone in the normalizer — listed here or the breadcrumb cries 'unhandled' for handled records (the 2.289.0 mistake). Round 4: the first two have never been observed on our stdout (host callbacks swallow them; the live compaction lane is system/status) and tombstone is unverified — the rows stay because the READER exists, which is what this set is about
]);
const _seenStreamTypes = new Set();

// THE session broadcast choke point ⇒ src/server/session-broadcast.js (perf lane
// chunk D): stamps `seq` on the session's own `msg` frames from its op ring and
// cuts a capable client whose send queue stopped draining (ONE `lagged` frame).
const { broadcastToSession } = require('./src/server/session-broadcast.js').createSessionBroadcast();

// ── Usage + pool engine (src/server/usage-pool-engine.js, decomposition #5) ──
const {
  _vsuPending, usageAnchors, usageEstimator,
  armWorkflowUsageWatcher, darkSources, darkTaintedAccounts, kickPoolEval,
  markLimitBanner, maybePoolAutoSwitch, maybePoolAutoSwitchForPool, notePoolAuthFailure, noteTurnStopped, memberRemoved, decideDefaultTarget, fallbackDefaultTarget, removalTargetFor, setConversationPin, gatherPlan, answerCrossProviderAsk,
  maybeRepinLockedModel, maybeStopOnFallback, modelsMatch, onMemberReadingFresh, onMemberLoginSuccess, autoCliReady, memberServeLapsed, lastMemberReadAt, projectionRereadFor, projectionBillingIndex, // …+ the new-member wake (2026-09-08) + its LOGIN half, handed to the account routes (2026-09-29: read there since 2026-09-08, never passed — dead until now)
  apiDerivedWindow, establishedWindows, repairIdentityAnchors, oatAnswer, oatIdentityAttach, oatRebind, // B-855a: the two identity witnesses handed to setupUsage — the panel probe may only write the account it proves — + c2's STANDING identity repair (boot + POST /api/usage/repair-identity)
  poolChooserForModel, poolReadCache, probeUsageForAccountKey, readRawUsageCache, spendGuard, // the ONE raw usage-cache read (overage lives there — design §1.4) + THE SPEND CEILING (§4.4c): ONE authorizer in front of every turn nobody typed, per credential slot, persisted ⇒ src/server/spend-guard.js
  noteSessionProduced, noteTurnEnd: noteTurnEndEngine, noteWallSignal, noteStreamRecord, recordIsLate, beforeAutoResumeFire, fireIdentityFor, memberLoginState, probeUsageViaSession, recordCodexQuotaSignal, recordRateLimitEvent, resolveUsageKey, noteServedModel, noteModelFallback, servedDefinesModel, rerouteAnnouncedBy, settleTurnLane, // …+ the SERVED-MODEL pair + its FALLBACK PREDICATE (r3-r2: the parse's target-less lock latch asks it, so a classifier substitute never becomes the lock target that defines placement) + the REROUTE THIS RECORD ANNOUNCES (r4: placed BEFORE the served capture at both feeds — the incident's first announcement rides the very record the substitute answered) + the per-turn LANE settle (2026-09-13 r3): both stdout feeds destructure them from the `engine:` literals below, and neither was exported here — the whole round-1 fix was a TypeError in production
  sessionModelFor, sweepUsageAnchors, usageCacheKeyFor, resetCreditOffer, resetCreditPreview, consumeResetCreditFor, claimColdRestarts, refreshCodexForPerson, settleResetCreditByRead, catchUpResetCreditFromBuffer, // the stored reset credits the auto-resume arm card offers (design-reset-credits §5) + the manual use's preview/POST (p2) + verify r1: the session path's read before a press over an unsettled attempt
  usageIdentityAccountIds, usageIdentityGroups, usageIdentityGroupsCached,
  writeUsageCacheForKey, clearSealedOrders, pushSealedOrders,
  estOverlayCache, predictCalib,
} = require('./src/server/usage-pool-engine.js').create({
  app, rootDir: __dirname, USAGE_CACHE_DIR, activeSessions, wss, WS_OPEN,
  broadcastToSession, getAutoResume: () => { try { return autoResume; } catch { return null; } }, getQuotaProbe: () => { try { return usage.refreshViaCliPanel; } catch { return null; } }, // both lazy: created further down (TDZ otherwise); otelIngest = B-b3cd org verification
  serverNotice: (...a) => serverNotice(...a),
  serverSetting: (...a) => serverSetting(...a),
  harnessSetting: (...a) => harnessSetting(...a), harnessDeclares: (...a) => harnessDeclares(...a), // typed per-harness reads (limitResetCredit / disableModelFallback) — lazy: harnessConfig is built further down
  getAccounts: () => { try { return accounts; } catch { return null; } },
  getHosts: () => { try { return hosts; } catch { return null; } },
  getUsageHistory: () => { try { return usageHistory; } catch { return null; } },
  recordUsageAttribution: (...a) => recordUsageAttribution(...a),
  adapterRegistry, readUserState: () => { try { return persistenceRouter.readUserState(); } catch { return {}; } }, getUserTodos: () => { try { return userTodos; } catch { return null; } }, // lazy: the inbox a refused spend is reported in is created further down (TDZ otherwise)
  getSessionMetaStore: () => { try { return { readSessionMeta, writeSessionMeta }; } catch { return null; } }, // lazy too (session-stdout is built below): the ONE use is persisting the classifier-reroute stamp so a RESTORED conversation still knows the CLI answers with a model we did not ask for (r3)
});
// noteTurnEnd ALSO wakes the delivery ladder's retry park (lane notify-retry, 2026-10-01): a parked notification is posted the
// moment the conversation's turn ends (claude `result` / codex `task_complete` / ACP) — the stdout consumers keep the ONE name
const noteTurnEnd = (s, m) => { noteTurnEndEngine(s, m); try { deliver.noteTurnEnd(s); } catch (e) { console.warn('[deliver] turn-end hook failed:', e && e.message); } };
// ── Effective-size computation (min cols/rows across clients + PTY resize + broadcast) ──
// Only clients that have sent a REAL `resize` (terminal fit) drive the PTY
// size. Two classes of entries must NOT shrink it:
//  - viewer:true  → subagent View Log windows attach to the PARENT session's
//    clients map purely to receive broadcasts; they have no terminal.
//  - placeholder (no `real` flag) → the 120×30 default set at attach time,
//    before the client's first fit(). A reconnecting/ghost client sitting at
//    this placeholder used to win the min and shrink everyone's terminal.
function resizeSessionToMin(session, sessionId) {
  if (!session.clients.size || !session.pty) return;
  let minCols = Infinity, minRows = Infinity, realCount = 0;
  for (const sz of session.clients.values()) {
    if (sz.viewer || !sz.real) continue;
    realCount++;
    if (sz.cols < minCols) minCols = sz.cols;
    if (sz.rows < minRows) minRows = sz.rows;
  }
  // No real terminal client yet (e.g. chat sessions never fit) — fall back to
  // non-viewer placeholders so chat PTYs still get a sane width, but never let
  // a viewer entry participate.
  if (!realCount) {
    for (const sz of session.clients.values()) {
      if (sz.viewer) continue;
      if (sz.cols < minCols) minCols = sz.cols;
      if (sz.rows < minRows) minRows = sz.rows;
    }
  }
  // Size override ("take over"): one client forces the PTY to ITS size instead
  // of the min — e.g. working from a big screen while a small window at home
  // stays attached. Smaller clients block their view behind a "Resume here"
  // overlay. Ownership follows the owner's live resizes and evaporates when the
  // owner disconnects (its clients-map entry disappears → back to min policy).
  let cols = minCols, rows = minRows, override = false;
  const ownerSz = session._sizeOwnerWs ? session.clients.get(session._sizeOwnerWs) : null;
  if (ownerSz && ownerSz.real && !ownerSz.viewer) {
    cols = ownerSz.cols; rows = ownerSz.rows; override = true;
  } else if (session._sizeOwnerWs) {
    session._sizeOwnerWs = null; // owner gone — min policy again
  }
  if (cols < Infinity && rows < Infinity) {
    try { session.pty.resize(cols, rows); } catch {}
    // clients: real terminal count — lets the UI say "limited by a smaller
    // client" (tmux-style boundary) only when someone else is actually attached
    broadcastToSession(session, sessionId, { type: 'effective-size', sessionId, cols, rows, clients: realCount, override });
  }
}

// ── Native goal status sync (src/server/goal-sync.js) ──
const { checkClaudeGoalStatus } = require('./src/server/goal-sync.js').create({
  hosts: { get fetchSessionJsonl() { return hosts.fetchSessionJsonl.bind(hosts); } }, // lazy — hosts is created later in boot order
  broadcastToSession,
  findSessionJsonlPath: (...a) => findSessionJsonlPath(...a),
});
// ── Session stdout engine (src/server/session-stdout.js, decomposition #6) ──
// setupSessionPty + attachToDtach + the session-meta store.
const { setupSessionPty, attachToDtach, readSessionMeta, writeSessionMeta,
  deleteSessionMeta, sessionMetaOwnerConflict, _metaTombstones,
  applyTaskToolUpdate, emitTaskListTodos, updateSessionTodos, reattachLocalPty, ptyQuietSince, writeSessionInput,
} = require('./src/server/session-stdout.js').create({
  rootDir: __dirname, BUFFERS_DIR, META_DIR, DTACH_CMD, USAGE_SCANNER_PATH,
  CLAUDE_STREAM_TYPES, _seenStreamTypes, activeSessions,
  engine: { _vsuPending, armWorkflowUsageWatcher, kickPoolEval, markLimitBanner, // EVERY name the registered consumers destructure from `engine` must be here — test-fable-cap-pool-storm §10 derives that set from their own `const {…} = engine;` and fails THIS literal (r3: two were missing and every claude chat record became raw output)
    maybePoolAutoSwitch, maybeRepinLockedModel, maybeStopOnFallback, notePoolAuthFailure,
    modelsMatch, noteSessionProduced, noteTurnEnd, noteTurnStopped, noteWallSignal, recordCodexQuotaSignal, catchUpResetCreditFromBuffer, recordRateLimitEvent, resolveUsageKey, usageEstimator, noteStreamRecord, recordIsLate, noteServedModel, noteModelFallback, servedDefinesModel, rerouteAnnouncedBy, settleTurnLane },   // noteTurnEnd = the hooked wrapper above (the park); catchUpResetCreditFromBuffer = lane reset-path's buffer-file catch-up (codex-events — wired at the 2.369.202 integration)
  checkClaudeGoalStatus,
  broadcastToSession,
  broadcastActiveSessions: (...a) => broadcastActiveSessions(...a),
  noteModelSeen: (...a) => noteModelSeen(...a),
  noteHarnessModels: (...a) => noteHarnessModels(...a), // ACP harnesses learn their model list from the agent (S8)
  recordUsageAttribution: (...a) => recordUsageAttribution(...a),
  daemonPtyShim: (...a) => daemonPtyShim(...a), agentEnv: (...a) => require('./src/ws-handler').agentEnv(...a), onLocalReattach: (...a) => bridgeWatch.afterReattach(...a), // the ONE local re-attach spawns with the sanitized env; every re-attach tells the dead-bridge watch (lane-dead-bridge)
  sbSeenFirst: (...a) => sbSeenFirst(...a),
  getDeviceMgr: () => deviceMgr,
  getHosts: () => { try { return hosts; } catch { return null; } },
  getUsageHistory: () => { try { return usageHistory; } catch { return null; } },
  getTelemetry: () => { try { return telemetry; } catch { return null; } },
  getNoConvoRef: () => { try { return noConvoRef; } catch { return null; } }, getDeliver: () => { try { return deliver; } catch { return null; } }, getPages: () => { try { return publishedPages; } catch { return null; } }, getPermissionRules: () => { try { return permissionRules; } catch { return null; } }, // lazy getters; getPages = SendUserFile hands the user a private link (published-pages is created further down)
  getExitProxy: () => { try { return exitProxy; } catch { return null; } }, // verify-r2 A3-r2 / ask-a: the exit path ends a dead conversation's pairs + asks
  getBrain: () => { try { return sessionBrain; } catch { return null; } }, getSyncStore: (name) => { try { return getSyncStore(name); } catch { return null; } }, // design-unknown-records: the four record→side-effect consumers the parse shares with the device feed (session-brain is created further down); lane stop-refills-composer: Stop's put-back writes the drafts store (built further down — read at record time)
});
// ── Boot restore (src/server/boot-restore.js, decomposition #7) ──
// migrations + restoreSessions + R6 pipe re-open + keeper re-adoption.
const { migrateLegacyHomeProjects, restoreSessions, restoreAgentdPipeSessions,
  readoptOrphanKeeperSessions, probeSockets, probeFacts, stoppedSessions, // stoppedSessions: the kept metas read back (lane dead-socket-keeps-chat-meta)
} = require('./src/server/boot-restore.js').create({
  rootDir: __dirname, PORT, BUFFERS_DIR, META_DIR, SOCKETS_DIR, DTACH_CMD,
  NODE_CMD, CHAT_WRAPPER, activeSessions, sessionCounterRef,
  attachToDtach, setupSessionPty, readSessionMeta, writeSessionMeta,
  deleteSessionMeta, broadcastToSession,
  broadcastActiveSessions: (...a) => broadcastActiveSessions(...a),
  refreshWebuiPids: (...a) => refreshWebuiPids(...a),
  sbNoteServerOp: (...a) => sbNoteServerOp(...a),
  getHosts: () => { try { return hosts; } catch { return null; } },
  getDialBridge: () => { try { return dialBridge; } catch { return null; } }, getExitProxy: () => { try { return exitProxy; } catch { return null; } }, note: (line) => bootTrace.note(line), // B-92a4: the re-probe un-adopts through the exit proxy's onSessionEnd; its lines ride the boot trace (⚙ Diagnostics)
  agentEnv: (...a) => require('./src/ws-handler').agentEnv(...a), // lane spawn-env-debts: the remote chat re-adopt's transport env (as ws-create's r6Env)
}); bootTrace.span('restore-probes', probeSockets(), probeFacts); // B-1319: the restore's fuser / fd-scan questions start now, as children — the server listens once they answered (below); B-92a4: or at the cap, the span naming what did not answer
// ── Agent-tool generators + hook registration (src/server/agent-tool-generators.js) ──
const hooksLate = require('./src/server/hooks-late.js').create({ activeSessions, getSessionStatus: () => sessionStatus, getUserTodos: () => userTodos, sessionStatusKey: (...a) => sessionStatusKey(...a), harnesses: require('./src/harnesses'), log: (...a) => console.log(...a), warn: (...a) => console.warn(...a) }); // lane hooks-create: a hook file CREATED by the registration ('dir-exists') is told to the conversations that predate it (one free note each + ONE For-you line); held until ready() after the boot restore; owns POST /api/cli-config/apply
// lane browser-resource-care (B-afeb): memory pressure reaches the owner — ONE For-you item per episode naming who started each
// process group (fed by sysinfo.startWatch's onSample below); a conversation's own Chrome (debugging port, no keeper mark) is told
const memoryPressure = require('./src/server/memory-pressure-watch.js').create({ activeSessions, BUFFERS_DIR, getUserTodos: () => userTodos, getSessionStatus: () => sessionStatus, sessionStatusKey: (...a) => sessionStatusKey(...a), jobsWiringOf: () => { try { return jobsWiring; } catch { return null; } }, getKeeper: () => { try { return require('./src/server/browser-keeper.js').keeper(); } catch { return null; } }, log: console });
const {
  AGENT_BIN_DIR, EDITOR_DIR, EDITOR_CMD, STATUS_CMD, USAGE_STATUSLINE_CMD, HOOK_CMD,
  createEditorHelper, createStatusHelper, createHookHelper, userStatuslineCmd,
  ensureAgentHooks, stripAgentHookEntries, removeAgentHooks, hookRegistrationSafe, ownerWriteRefusal, refuseOwnerWrite, rootRecovery,
  agentHooksStatus, HOOK_OPTOUT_FILE,
} = require('./src/server/agent-tool-generators.js').create({ rootDir: __dirname, port: PORT, onHookFileCreated: (ev) => hooksLate.noteCreated(ev) });
// ── Harness settings (src/server/harness-config-sync.js; docs/design-harness-settings.zh.md) ──
// THE typed accessors over the descriptor-declared tables (harnessSetting /
// harnessDeclares / harnessSpawnSettings — threaded to ws-create and the pool
// engine via deps, never a literal harness id) + the CLI-config plan every
// machine applies (local: in-process below; remote: VIBESPACE_CLI_CONFIG on the
// install/prelude/dial sites in hosts.js and ws-create.js).
const harnessConfig = require('./src/server/harness-config-sync.js').create({
  serverSetting: (...a) => serverSetting(...a), harnesses: require('./src/harnesses'), adapterRegistry, activeSessions, hookRegistrationSafe, ownerWriteRefusal, refuseOwnerWrite, rootRecovery,
  log: (...a) => console.log(...a), warn: (...a) => console.warn(...a),
});
const { harnessSetting, harnessDeclares, harnessSpawnSettings, cliConfigPlanB64 } = harnessConfig;
// Generic operator-visible notice channel (2.226.0, user directive "不要静默
// 失败"): server-side probes report through this instead of dying in the log —
// every connected client toasts it (+ it lands in toast/notification history)
// and a telemetry event carries the key to the fleet collector. Key-deduped
// per boot so a recurring probe can't spam. RETURNS how many clients got it (r5): a caller that latches "already said" latches on THIS — the boot probes fire into an EMPTY client set on a systemd restart.
const _sentNotices = new Map(); // key → clients it reached
function serverNotice(key, text, { level = 1, i18n = null } = {}) { // i18n = {key, params}: the client words it with t(key, params); `text` stays the English (journal, older clients)
  if (_sentNotices.has(key)) return _sentNotices.get(key);
  console.warn('[notice]', text);
  global.__vsEvent?.('server-notice', key);
  let delivered = 0;
  try {
    const payload = JSON.stringify({ type: 'server-notice', key, text, level, ...(i18n && i18n.key ? { i18n } : {}) });
    for (const c of wss.clients) { try { if (c.readyState === WS_OPEN) { c.send(payload); delivered++; } } catch {} }
  } catch {}
  // No client connected (e.g. the 60s post-boot probe right after a pod
  // restart) → don't burn the key; the next probe run re-notices when
  // someone is actually there to see it (review finding).
  if (delivered > 0) _sentNotices.set(key, delivered); return delivered;
}
// Agent-hook health probe (2.226.0; born from the 2-day silent MODULE_NOT_FOUND
// outage whose CAUSE 2.225.1 fixed): a registration that goes stale or points
// at a missing script MID-RUN now self-heals + notifies instead of silently
// dropping every Stop/SessionStart/UserPromptSubmit delivery. Boot(+60s) +
// every 6h. NOTE the heal only fixes the FILE — running CLI sessions snapshot
// hook config and pick it up after restart/compaction; the notice says so.
function checkAgentHookHealth() {
  try {
    if (!hookRootWatch.probeMayRun() || !integrationEnabled() || fs.existsSync(HOOK_OPTOUT_FILE)) return; // verify r2 ①: an unjudgeable root arms the backoff re-judge, never a silent return
    const scriptMissing = !fs.existsSync(HOOK_CMD);
    if (scriptMissing) { try { createHookHelper(); } catch {} }
    const st = agentHooksStatus();
    for (const [key, info] of Object.entries(st)) {
      if (!info || typeof info !== 'object' || !('installed' in info)) continue; // hookPath/optedOut fields
      if (!info.fileExists || info.parseError) continue; // that CLI isn't set up here / unreadable
      if (info.stale || !info.installed || scriptMissing) {
        global.__vsEvent?.('agent-hook-broken', `${key}${info.stale ? '/stale' : ''}${!info.installed ? '/missing-entry' : ''}${scriptMissing ? '/script-missing' : ''}`);
        ensureAgentHooks({ auto: true }); // self-heal the registration in place
        if (!hookRootWatch.saidRecoveryInstead(info, scriptMissing)) serverNotice(`hook-health-${key}`, // verify r2 ①: a root never registered because it could not be read is a recovery, not "broken and repaired"
          `VibeSpace's ${key} agent-hook registration was broken (stale or missing path) and has been repaired — CLI sessions already running pick the fix up only after they restart or compact.`,
          { level: 2 });
      }
    }
  } catch (e) { console.warn('[hook-health] probe failed:', e.message); }
}

// Credential expiry sweeps (B-211a): every descriptor's expirySweep({accounts, serverNotice}) — claude: the
// long-lived setup-token warning (src/harnesses/claude-oat-expiry.js). Notice-deduped per account.
function checkCredentialExpiry() {
  for (const h of require('./src/harnesses').list()) {
    if (typeof h.expirySweep !== 'function') continue;
    try { h.expirySweep({ accounts, serverNotice }); } catch { }
  }
}
setTimeout(checkCredentialExpiry, 20000);
setInterval(checkCredentialExpiry, 6 * 3600e3); // stable instances stay up for weeks — a one-shot sweep would sail past the threshold (serverNotice keys dedupe per boot, so re-fires are cheap)
// Boot-time hook registration is DEFERRED until settings are readable (after
// setupPersistence below) — the Integration master switch decides whether we
// register or actively strip. See "Agent-hook boot registration".

// ── File System API (extracted to src/routes/files.js) ──
app.locals.xEnv = X_ENV;
app.locals.refreshXEnv = refreshXEnv; // paste route retries through this after an X cookie rotation
app.locals.activeSessions = activeSessions; // paste-image resolves a session's host server-side (B-65ec)
// Remote fs (Files cross-host) — resolved lazily; `hosts` is created below.
app.locals.getRemoteFs = () => remoteFs;
// ── SafeFs: dedicated worker_threads pool for LOCAL user-path fs ops ──
// STRUCTURAL isolation for the hung-mount class (complements the tactical
// canary/watchdog/circuit-breaker + UV_THREADPOOL_SIZE=32 above): every local
// file-route fs call runs on a worker's own thread with a per-op deadline and
// kill-and-respawn, so a wedged mount can never again saturate the shared libuv
// pool and freeze /login. path.resolve/permission decisions stay in-main; the
// worker only executes the already-resolved absolute path. mounts.pathBlocked
// still fails known-hung roots fast in the route middleware BEFORE dispatch.
try {
  app.locals.safeFs = new SafeFs({
    poolSize: parseInt(process.env.VIBESPACE_SAFEFS_POOL || '', 10) || 4,
  });
  console.log(`[safe-fs] worker pool up (${app.locals.safeFs.poolSize} workers)`);
} catch (e) {
  console.error('[safe-fs] pool init failed, file ops fall back to in-main fs:', e.message);
}
app.use(fileRoutes);

// Browser proxy — full-rewriting web proxy via node-unblocker
// Rewrites all URLs in HTML/CSS, injects JS to rewrite XHR/WebSocket, strips security headers
const Unblocker = require('unblocker');
const unblocker = new Unblocker({
  prefix: '/proxy/',
  responseMiddleware: [
    function stripFrameHeaders(data) {
      delete data.headers['x-frame-options'];
    }
  ],
});
app.use(unblocker);

// Ctrl+G editor: POST /api/editor/open (the `code` helper, vsst_ auth) + /api/editor/signal — src/routes/editor.js
require('./src/routes/editor.js').registerEditorRoutes(app, { activeSessions, wss, WS_OPEN, readSessionMeta, writeSessionMeta, getRemoteFs: () => remoteFs });

// ── Persistence API (extracted to src/routes/persistence.js) ──
const syncStores = {};
function getSyncStore(name) { return syncStores[name]; }
// THE server-side settings reader (data/settings.json via persistence.js's
// cached accessor). getSyncStore('settings') is NOT it — that SyncStore is an
// empty migration target; reads through it silently return undefined.
function serverSetting(key) {
  try { return persistenceRouter.readSettings ? persistenceRouter.readSettings()[key] : undefined; } catch { return undefined; }
}
require('./src/server/owner-facts.js').configure({ setting: serverSetting, userState: () => persistenceRouter.readUserState() });   // lane agent-context-owner-facts (B-7960): THE owner's clock (instance.timezone) and tray words every agent-facing door says
// Integration master switch (agents.vibespaceIntegration, default ON): OFF =
// pristine CLI — no hook registration, no VIBESPACE_API/agent-tools env in new
// spawns, no context/nudge delivery even to already-running sessions. THE one
// definition — threaded into ws-handler and agent-routes via their deps.
function integrationEnabled() {
  try { return serverSetting('agents.vibespaceIntegration') !== false; } catch { return true; }
}
// ONE convergence rule for boot AND the live toggle: hook registration follows
// the master switch. ensureAgentHooks({auto:true}) still honors the manual
// data/.agent-hooks-optout marker (Manage-Agents Remove) — the switch never
// overrides that narrower explicit choice; Install there clears it.
const hookRootWatch = require('./src/server/hook-root-watch.js').create({ dataDir: path.join(__dirname, 'data'), ensureAgentHooks, rootRecovery, ownerWriteRefusal, integrationEnabled: () => integrationEnabled(), serverNotice: (...a) => serverNotice(...a) });
function syncHookRegistration() {
  try {
    if (integrationEnabled()) hookRootWatch.sync(); // the unknown ⇒ the notice once per cause + the backoff re-judge; ok ⇒ the recovery said once // verify r1 (hook-root-guard): an UNJUDGEABLE root (a read error on .git) is said to the OWNER, not only the journal; every writer re-reads, the probe heals + notifies
    else stripAgentHookEntries();
  } catch (e) { console.warn('[integration] hook registration sync failed:', e.message); }
}

syncStores.drafts = new SyncStore('drafts', path.join(__dirname, 'data', 'drafts.json'), wss);
syncStores.settings = new SyncStore('settings', path.join(__dirname, 'data', 'settings-sync.json'), wss);
syncStores.uploads = new SyncStore('uploads', path.join(__dirname, 'data', 'uploads-sync.json'), wss); const grants = require('./src/server/grants-store.js').install(require('./src/server/grants-store.js').create({ dataDir: path.join(__dirname, 'data'), wss, log: (...a) => console.warn(...a) })); syncStores.grants = grants.sync; // THE GRANTS STORE (lane grants-unify): every grant the owner gives agents in ONE file (data/grants.json), ONE writer, judged by the ONE model (src/grant-model.js admits) — created before every door, its server-owned mirror live to every client and flushed with the other stores; each door re-judges NOW on a change (grants.onChange below)
syncStores.stage = new SyncStore('stage', path.join(__dirname, 'data', 'stage-sync.json'), wss); // dynamic desktop (docs/design-dynamic-desktop.md)

setupPersistence({ dataDir: path.join(__dirname, 'data'), wss, WS_OPEN, getSyncStore, activeSessions, auth, getExitProxy: () => { try { return exitProxy; } catch { return null; } } /* lane grants-unify: a machine's exit lists ride the config bundle as grant rows */,
  getHosts: () => hosts, getMounts: () => mounts, getTasks: () => tasks,
  getAccounts: () => accounts, getUsageHistory: () => usageHistory, onUserStateWrite: (st) => { try { channelsWiring.groups.noteUserState(); } catch {} try { tasks.noteArchived(st && st.archivedSessions); } catch {} }, // lane pair-group-fate: the sidebar archive (THE user-state write) ends that conversation's group waits; lane task-group-fanout: …and leaves every group's members (sessions[])
  // React server-side to the Integration master switch: register/strip the
  // CLI-config hook entries the moment the setting flips (the only settings
  // key with a server-side side effect — everything else reads lazily).
  onSettingsWrite: (next, prev) => {
    const was = (prev || {})['agents.vibespaceIntegration'] !== false;
    const now = (next || {})['agents.vibespaceIntegration'] !== false;
    if (was !== now) syncHookRegistration();
    // Harness settings (design-harness-settings §5): a cli-config row changed ⇒
    // re-apply the plan on this machine; a spawn row with a `live` verb changed
    // (claude disableModelFallback → formatSetFallbackPolicy: apply_flag_settings
    // merges switchModelsOnFlag into the CLI's inline flag-settings layer,
    // effective from the next turn, local and remote chat sessions alike) ⇒ the
    // verb goes to every running chat session whose ADAPTER has it. Sessions
    // spawned after the flip get it at spawn instead.
    harnessConfig.onSettingsWrite(next, prev); try { plugins.onSettingsWrite(next, prev); } catch { } // lane plugin-settings-p0: a plugin row that re-applies (frp relay fields, Tailscale mode) moved ⇒ that plugin re-applies (before the plugin wiring exists nothing can have changed)
  } });
app.use(persistenceRouter);
// ── Agent-hook boot registration (deferred from the hook-machinery block so
// the Integration master switch is readable) — a toggle flipped just before a
// restart, or an imported config bundle carrying it, converges here.
syncHookRegistration();
// CLI-CONFIG PLAN AT BOOT (design-harness-settings §5): every cli-config row of every harness (claude transcriptRetentionDays → cleanupPeriodDays, codex historyPersistence → [history] persistence) is written on THIS machine through the CAS writers — guarded by hookRegistrationSafe() inside (a /tmp worktree server never writes the real HOME) and by the smoke belt here; remote machines get the same plan as VIBESPACE_CLI_CONFIG on install / spawn (hosts.js, ws-create.js)
if (!process.env.VIBESPACE_SKIP_AGENT_HOOKS) harnessConfig.syncCliConfig({ reason: 'boot' });
// Health probe: catches MID-RUN poisoning (the 2.225.1 incident class) that
// boot-time registration can't — self-heals + notifies. 60s in, then 6h.
setTimeout(checkAgentHookHealth, 60000).unref();
setInterval(checkAgentHookHealth, 6 * 3600 * 1000).unref();

// ── Task Groups (岗位; task system — docs/design-task-system.md + refactor) ──
// data/task-groups.json is AUTHORITATIVE for everything the board renders (the
// store migrates the legacy data/tasks.json forward once). The one-time legacy
// Groups migration (sessionGroups/groupFolders) runs in the constructor.
const { TaskGroupManager } = require('./src/task-groups');
const tasks = new TaskGroupManager({
  dataDir: path.join(__dirname, 'data'), grants, // lane grants-unify: a group's outside visibility is its row of the ONE grants store
  readUserState: () => persistenceRouter.readUserState(),
  getSetting: (k) => serverSetting(k), isPathShadowed: (p) => { try { return mounts.shadowedBy(p); } catch { return null; } }, mirrorFs: () => app.locals.safeFs || null, isLiveKey: (k) => { for (const [id, s] of activeSessions) { const sk = sessionStatusKey(s, id); if (sk === k || sk.endsWith(':' + k)) return true; } return false; }, // lane cli-call-timeouts: TASK.md is mirrored through SafeFs, off the store write; lane task-group-fanout: an archived conversation still RUNNING keeps its groups until it ends
  onChange: (ch) => {
    try { taskFanout.note(ch && ch.ids); } catch { } // lane task-group-fanout: THE broadcast = a coalesced DELTA of the groups this write named (src/server/task-fanout.js); the store never travels whole (GET /api/tasks only)
    try { exitProxy.rejudgeAll('task-groups'); } catch { } // verify-r2: a group change is a revoke too — open exit connections judged NOW (exitProxy is built later: a boot-time change is a caught TDZ)
    // identity verify r4 (2026-09-28): a Task Group change re-judges every browser lease a list admits THROUGH a Task
    // Group — a conversation removed from the group (or whose group is deleted) loses the kept profile AT ONCE like a
    // narrowing (its tab closes, a mediated grant is revoked), not at its next command. The keeper singleton is null before install.
    try {
      const rj = require('./src/server/browser-keeper.js').keeper()?.rejudgeAll?.('task-groups-changed');
      // each detached conversation hears it at its next message (layer ②, zero billed turns) — the PATCH's own notice
      for (const d of (rj && rj.detached) || []) {
        const s = d.sessionId ? activeSessions.get(d.sessionId) : null;
        if (!s) continue;
        const label = (() => { try { return require('./src/server/browser-keeper.js').keeper()?.profile?.(d.profileId)?.label || ''; } catch { return ''; } })();
        try { sessionStatus.pushNotice(sessionStatusKey(s, d.sessionId), { ...require('./src/browser-profiles.js').profileChangeNotice({ was: label, now: '', by: 'user', handles: [] }), kind: 'browser-profile' }); } catch { /* optional */ }
      }
    } catch (e) { console.warn('[browser] the Task Group change re-judge failed — ' + (e && e.message)); }
  },
});
const taskFanout = require('./src/server/task-fanout.js').create({ list: () => tasks.list(), send: (json) => wss.clients.forEach((c) => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } }) }); // lane task-group-fanout: the ONE tasks-updated broadcaster ({epoch, base, seq} — a client off `base` re-fetches)
// System info + memory-pressure watch (2.216.0, userL's 32Gi OOM kill —
// the pod-level kill takes every dtach session; warn BEFORE the kernel acts)
// ── Sysinfo wiring (src/server/sysinfo-wiring.js): remote snapshot ladder ──
const { sysinfo, remoteSysinfo, remoteProcs, signalProc } = require('./src/server/sysinfo-wiring.js').create({ getHosts: () => hosts });
// ── Incident capture (src/server/incident-wiring.js) ──
const { _srvConsoleRing } = require('./src/server/incident-wiring.js').create({
  app, rootDir: __dirname,
  getActiveSessions: () => activeSessions,
  getHosts: () => { try { return hosts; } catch { return null; } },
  getNoConvoRef: () => { try { return noConvoRef; } catch { return null; } },
  readLayouts: (...a) => readLayouts(...a),
  sysinfo,
  listLayoutHistory: () => { try { return persistenceRouter.listLayoutHistory(); } catch { return []; } },
  getDesktop: () => ({ vnc, keeper: desktopKeeper, stream: desktopStream, access: desktopAccess }), // 2.369.118: the desktop scene (late-bound — created further down)
});
app.get('/api/sysinfo', async (req, res) => {
  try {
    const hostId = String(req.query.host || '');
    if (hostId) return res.json(await remoteSysinfo(hostId));
    res.json({ ...(await sysinfo.read(path.join(__dirname, 'data'))), storeWrites: storeTiming.enabled() ? storeTiming.slowest() : undefined, serverMemory: memSampler.latest() || undefined }); // the System window's "slowest store writes (last hour)" (design 011 lane 1)
  } catch (e) { res.status(500).json({ error: e.message }); }
});
// Process manager (2.354.0, btop-like): full table + user-initiated signal.
app.get('/api/sysinfo/procs', async (req, res) => {
  try {
    const hostId = String(req.query.host || '');
    if (hostId) return res.json(await remoteProcs(hostId));
    res.json({ serverPid: process.pid, ...(await sysinfo.listProcs()) });
  } catch (e) { res.status(500).json({ error: e.message }); }
});
app.post('/api/sysinfo/signal', async (req, res) => {
  try { res.json(await signalProc(String(req.body?.host || ''), req.body?.pid, req.body?.sig, { by: require('./src/device-audit.js').byOfReq(req) })); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Resource HISTORY for the System rail charts (2.223.0): self-sampled CPU/
// memory rings — 24h at the 45s watch cadence, 7d at 15min. range=1h|24h|7d.
app.get('/api/sysinfo/history', (req, res) => {
  const ranges = { '1h': 3600e3, '24h': 24 * 3600e3, '7d': 7 * 24 * 3600e3 };
  const ms = ranges[String(req.query.range || '24h')] || ranges['24h'];
  res.json({ points: sysinfo.history(ms), rangeMs: ms, cpus: require('os').cpus().length });
});
sysinfo.startWatch({
  dataDir: path.join(__dirname, 'data'), onSample: (mem) => memoryPressure.onSample(mem), // lane browser-resource-care (B-afeb): the memory-pressure episode (src/server/memory-pressure-watch.js)
  broadcast: (msg) => { const json = JSON.stringify(msg); wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } }); },
});

app.get('/api/tasks', (req, res) => { const at = taskFanout.mark(); res.json({ tasks: tasks.list(), ...at }); }); require('./src/server/task-context-routes.js').mount(app, { tasks, serverSetting }); // lane task-group-context: the Context table's preview + path probe (no new line — the size ratchet)
app.post('/api/tasks', (req, res) => {
  try { res.json({ success: true, task: tasks.create(req.body || {}) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
app.patch('/api/tasks/:id', (req, res) => {
  try { res.json({ success: true, task: tasks.update(req.params.id, req.body || {}) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.delete('/api/tasks/:id', (req, res) => {
  try { tasks.remove(req.params.id); res.json({ success: true }); }
  catch (e) { res.status(404).json({ error: e.message }); }
});
// Granular tag ops (atomic server-side — concurrent clients can't clobber
// each other's read-modify-write of the sessions array)
const convOps = require('./src/server/conversation-ops.js'); convOps.provide({ tasks, spendGuard }); // lane automation-verbs: the conversation verbs' seams reach the task store + THE spend guard (an automation open is charged there)
app.post('/api/tasks/:id/bind', (req, res) => {
  try { res.json({ success: true, task: convOps.bindConversation({ sessionKey: req.body?.sessionKey }, req.params.id, { kind: 'human', actBy: require('./src/device-audit.js').byOfReq(req) }) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.post('/api/tasks/:id/unbind', (req, res) => {
  try { res.json({ success: true, task: tasks.unbind(req.params.id, req.body?.sessionKey) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.post('/api/tasks/:id/progress', (req, res) => {
  try { res.json({ success: true, task: tasks.addProgress(req.params.id, req.body || {}) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
// OLDER ACTIVITY (2.369.204): one page of a group's Activity log older than ?before=<ms> (≤ ?limit=200) — the live
// list, then data/task-groups-archive/ — for the Task log window's scroll. The owner (cookie); an agent's token reads
// only a group it belongs to (the vibespace-task scope), a job token none.
app.get('/api/tasks/:id/progress', (req, res) => {
  const bearer = String(req.headers.authorization || '').replace(/^Bearer\s+/i, '');
  if (/^(vsst_|jbt_)/.test(bearer)) {
    const hit = bearer.startsWith('vsst_') ? [...activeSessions].find(([, s]) => sameToken(bearer, s.agentToken)) : null;
    const mine = !!hit && tasks.groupsForSession({ sessionKey: sessionStatusKey(hit[1], hit[0]), cwd: hit[1].cwd, initialGroupId: hit[1]._initialGroupId, initialGroupIds: hit[1]._initialGroupIds }).some((g) => g.id === req.params.id);
    if (!mine) return res.status(403).json({ error: 'this session does not belong to that Task Group', code: 'not_member' });
  }
  try { res.json({ success: true, ...tasks.readProgress(req.params.id, { before: req.query.before, limit: req.query.limit }) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
// P4 repo task files: export a task to a committable markdown file / import one.
app.post('/api/tasks/:id/export', (req, res) => {
  try { res.json({ success: true, path: tasks.exportToFile(req.params.id, req.body?.path) }); }
  catch (e) { res.status(e.message === 'task not found' ? 404 : 400).json({ error: e.message }); }
});
app.post('/api/tasks/import', (req, res) => {
  try { res.json({ success: true, task: tasks.importFromFile(req.body?.path) }); }
  catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Remote context-folder auto-sync ("mount"): a REMOTE session's belonged
// groups with a contextDir get a live-synced copy at
// <remoteHome>/.vibespace/ctx/<groupId> (bidirectional rsync, newer-wins, no
// deletes, .vibespace excluded), and the injected file index is path-translated
// to the remote copy (remoteCtxBase). Triggers: session spawn + a 60s timer
// while any live remote session belongs to the group. Remote writes sync back
// → the local signature changes → every member re-injects next turn. ──
const { syncGroupCtx, FILE_CAP: CTX_FILE_CAP, MAX_FILES: MAX_CTX_FILES } = require('./src/ctx-sync');
const machineProbes = require('./src/machine-probes');
const { parseRateLimitEvent, captureRateLimitEvent } = require('./src/rate-limit-capture.js');
const _ctxSyncBusy = new Set(); // `${hostId}:${groupId}` in-flight guard
const _ctxSkipNoticed = new Set(); // one honest notice per host:group:file per boot
async function syncRemoteGroupCtx(h, g) {
  const key = `${h.id}:${g.id}`;
  if (_ctxSyncBusy.has(key)) return;
  _ctxSyncBusy.add(key);
  try {
    const home = await hosts.homeDir(h);
    if (!home) return;
    const rdir = `${home}/.vibespace/ctx/${g.id}`;
    // ONE implementation for every transport (src/ctx-sync.js, 2.277.0):
    // hashed newer-wins sync over the device link; ssh degrades to its legacy
    // rsync pair when the link is down. The old split (ssh=rsync uncapped,
    // dial=hashed with a SILENT 2MB/400-file cap) meant a 3MB context file
    // reached every ssh host and never reached a dial device, invisibly.
    await syncGroupCtx({
      hosts, host: h, group: g, remoteDir: rdir,
      onSkip: (rel, why, size) => {
        const k = `${key}:${rel}:${why}`;
        if (_ctxSkipNoticed.has(k)) return;
        _ctxSkipNoticed.add(k);
        const msg = why === 'count'
          ? `Context folder for "${g.title || g.id}" has more than ${MAX_CTX_FILES} files — the rest won't sync to ${h.name}.`
          : `Context file ${rel} (${Math.round((size || 0) / 1024 / 1024)}MB) exceeds the ${Math.round(CTX_FILE_CAP / 1024 / 1024)}MB sync cap and won't reach ${h.name}.`;
        console.warn('[ctx-sync]', msg);
        try { serverNotice(`ctx-skip:${k}`, msg, { level: 2 }); } catch { }
      },
    });
  } catch (e) { console.warn('[ctx-sync]', h.name, g.id, e.message); }
  finally { _ctxSyncBusy.delete(key); }
}
// Groups a session belongs to that have a syncable context folder.
function ctxGroupsOf(session, id) {
  if (!session.host) return [];
  return tasks.groupsForSession({ sessionKey: sessionStatusKey(session, id), cwd: session.cwd, initialGroupId: session._initialGroupId, initialGroupIds: session._initialGroupIds })
    .map((g) => tasks.view(g.id)).filter((g) => g.contextDir && g.injectContext !== false);   // lane task-group-context: the view's contextDir = the 记笔记 row
}
function scheduleCtxSync(session, id) {
  try {
    if (!session.host || !hosts) return;
    let h; try { h = hosts.get(session.host); } catch { return; }
    for (const g of ctxGroupsOf(session, id)) syncRemoteGroupCtx(h, g);
  } catch { }
}
setInterval(() => {
  try {
    if (!integrationEnabled()) return; // master switch off ⇒ no ctx-folder pushes either
    const seen = new Set();
    for (const [id, s] of activeSessions) {
      if (!s.host) continue;
      let h; try { h = hosts.get(s.host); } catch { continue; }
      for (const g of ctxGroupsOf(s, id)) {
        const k = s.host + ':' + g.id;
        if (seen.has(k)) continue;
        seen.add(k);
        syncRemoteGroupCtx(h, g);
      }
    }
  } catch { }
}, 60000);
// Absolute remote path the injection should show for a group's context folder
// (null → local session, keep local paths). Uses the cached remote home; if
// the home isn't known yet (first contact) fall back to local paths this turn.
function remoteCtxBaseFor(session) {
  if (!session.host || !hosts) return null;
  const home = hosts._homes?.get(session.host);
  if (!home) { try { hosts.homeDir(hosts.get(session.host)); } catch { } return null; } // warm the cache async
  return (gid) => `${home}/.vibespace/ctx/${gid}`;
}

// ── Anthropic accounts (subscription ↔ API/console per-session switching) ──
// Keys AES-GCM encrypted in data/accounts.json; injected as ANTHROPIC_API_KEY
// into the session's spawn env (process-env channel — never argv/proc-visible).
// The CLI's own /login is mutually exclusive; this store is what lets both
// identities coexist. Design: docs/design in CLAUDE.md "Accounts".
const { AccountManager } = require('./src/accounts');
const accounts = new AccountManager({
  dataDir: path.join(__dirname, 'data'),
  onChange: (list) => {
    const json = JSON.stringify({ type: 'accounts-updated', ...list });
    for (const client of wss.clients) if (client.readyState === WS_OPEN) client.send(json);
    broadcastActiveSessions(); // account names on live session cards may change
  },
  onSessionLinks: () => broadcastActiveSessions(), // lane badge-stale: a per-session pool link moved ⇒ auth.poolTarget in the payload (one frame per burst — accounts.js _notifyLinks)
});
// ── Usage history: a PERMANENT per-request token ledger mined from Claude's
// JSONL transcripts (terminal + chat), for the Usage window. resolveAccount
// bakes WHICH account + its billing TYPE into each event so subscription and
// API-key usage are never conflated. ──
const { UsageHistory, ackOf: usageAckOf } = require('./src/usage-history');
// Forward URL/token: user setting wins; the VIBESPACE_TELEMETRY_FORWARD_* env
// vars are the DEPLOYMENT defaults (helm/compose set them fleet-wide so no
// per-user settings edit is needed on managed instances).
const telemetry = new Telemetry({
  dataDir: path.join(__dirname, 'data'),
  version: require('./package.json').version,
  getForwardUrl: () => {
    try { return serverSetting('telemetry.forwardUrl') || process.env.VIBESPACE_TELEMETRY_FORWARD_URL || ''; }
    catch { return process.env.VIBESPACE_TELEMETRY_FORWARD_URL || ''; }
  },
  getForwardToken: () => {
    try { return serverSetting('telemetry.forwardToken') || process.env.VIBESPACE_TELEMETRY_FORWARD_TOKEN || ''; }
    catch { return process.env.VIBESPACE_TELEMETRY_FORWARD_TOKEN || ''; }
  },
});
// Server-side fatals land in the same ledger (journald has them too, but the
// diagnostics report should show one unified picture).
process.on('uncaughtException', (e) => { if (e && e.code === 'EVSMOUNTSYNC') { console.error(`[mount-guard] a refused ${e.syscall} on ${e.path} unwound a callback — the hub keeps serving (the call never reached the mount)`); return; } // lane hub-fuse-sync-guard: the guard's refusal throws BEFORE any syscall — exiting would trade a refused call for a whole-hub restart
  try { if (e && (e.code === 'EMFILE' || e.code === 'ENFILE')) console.error('[fd] ' + fdGauge.blame(e, e.path).words); } catch {} // lane-dead-bridge: NAME an EMFILE before dying — this process, the mount's FUSE daemon (12:03) or the machine
  try { bridgeWatch.endAttachPtys(); } catch {} // …and end the attach clients like the clean shutdown does: a crash that left them alive left ORPHANS whose stuck socket kept the next server's attach dead for 3 h (lane-dead-bridge)
  try { telemetry.record({ kind: 'server-error', name: e.message || 'uncaughtException', stack: e.stack }); telemetry.flush(); } catch {}
  // Same flush belt as the clean shutdown (2.219.0 audit) — a crash used to
  // drop up to 2s of debounced writes (layouts, session-status, user-todos).
  try { for (const store of Object.values(syncStores)) { try { store.flush(); } catch {} } } catch {}
  try { flushLayouts(); } catch {}
  try { sessionStatus.flush(); } catch {}
  try { userTodos.flush(); } catch {}
  console.error(e); process.exit(1);
});
process.on('unhandledRejection', (e) => { try { telemetry.record({ kind: 'server-error', name: (e && e.message) || 'unhandledRejection', stack: e && e.stack }); } catch {} console.error('unhandledRejection:', e); });

const memSampler = require('./src/server/memory-sampler.js').create({ record: (ev) => telemetry.record(ev), log: console, caches: () => [...usageHistory.cacheCensus(), require('./src/session-store').jsonlCacheCensus(), usageEstimator.lineCacheCensus()] }); // lane server-memory-census: main heap + every worker isolate + external + native every 60 s (started at listen: ONE boot census line); GET /api/sysinfo serverMemory; B-9428: + each bounded cache by name
// Server performance metrics — RSS/heap, event-loop lag, live session count. Every 5 min; names-and-numbers only, same ndjson ledger as everything else.
{
  let lagProbeAt = Date.now();
  let maxLagMs = 0;
  setInterval(() => { // 1s cadence lag probe (cheap): drift beyond the interval = loop blocked
    const now = Date.now();
    const lag = now - lagProbeAt - 1000;
    if (lag > maxLagMs) maxLagMs = lag;
    lagProbeAt = now;
  }, 1000);
  setInterval(() => {
    try {
      const mu = process.memoryUsage();
      telemetry.record({ kind: 'metric', name: 'srv-rss-mb', value: Math.round(mu.rss / 1048576) });
      telemetry.record({ kind: 'metric', name: 'srv-heap-mb', value: Math.round(mu.heapUsed / 1048576) });
      telemetry.record({ kind: 'metric', name: 'srv-evloop-max-lag-ms', value: Math.max(0, maxLagMs) });
      telemetry.record({ kind: 'metric', name: 'srv-live-sessions', value: activeSessions.size });
      telemetry.record({ kind: 'metric', name: 'srv-ws-clients', value: wss.clients.size });
      // store-timing (design 011 lane 1): each named store's slowest sync write / read of these 5 min + its bucket counts
      for (const [name, w] of Object.entries(storeTiming.takeWindow())) telemetry.record({ kind: 'metric', name: 'srv-store-ms:' + name, value: w.max, detail: 'n=' + w.n + ' b=' + w.buckets.join(',') });
      // Leak canaries — the exact classes the 2.81-2.91 audits kept finding:
      // subagent watchers that outlive their agent, normalizer message piles.
      let watchers = 0, normMsgs = 0;
      for (const [, sess] of activeSessions) {
        watchers += sess.subagentWatchers?.size || 0;
        normMsgs += sess._normalizer?.total || 0;
      }
      telemetry.record({ kind: 'metric', name: 'srv-subagent-watchers', value: watchers });
      telemetry.record({ kind: 'metric', name: 'srv-normalizer-msgs', value: normMsgs });
      try { telemetry.record({ kind: 'metric', name: 'srv-buffer-files', value: fs.readdirSync(BUFFERS_DIR).length }); } catch {}
      if (_httpWin.n) {
        telemetry.record({ kind: 'metric', name: 'srv-http-reqs-5min', value: _httpWin.n });
        telemetry.record({ kind: 'metric', name: 'srv-http-avg-ms', value: Math.round(_httpWin.sum / _httpWin.n) });
        telemetry.record({ kind: 'metric', name: 'srv-http-max-ms', value: Math.round(_httpWin.max) });
        for (const sl of _httpWin.slow) telemetry.record({ kind: 'event', name: `slow-request ${sl.route}`, value: sl.ms });
        _httpWin.n = 0; _httpWin.sum = 0; _httpWin.max = 0; _httpWin.slow.length = 0;
      }
      maxLagMs = 0;
    } catch {}
  }, 300000);
}

// Zero-coupling metric hook for deep modules (session-store slow-parse etc.)
global.__vsMetric = (name, value, detail) => { try { telemetry.record({ kind: 'metric', name, value, detail }); } catch {} }; // detail = short attribution (account=… bucket=…), never content (B-a5c0)
// Server-side EVENT hook (2.207.0): the debugging-pain batch — session
// lifecycle anomalies, CLI error classes, probe failures — flows into the
// same Diagnostics report/fleet forwarding as client events. NAMES + short
// enum-ish details only, never content (telemetry charter).
global.__vsEvent = (name, detail) => { try { telemetry.record({ kind: 'event', name, detail }); } catch {} };

// ── Threadpool canary (2.108.6; off the main thread since design 011 lane 1) ── src/server/fs-canary.js says why: the
// stat is timed in its own SafeFs worker and the main loop's delay is a second fact, so a blocked loop never reads as
const mountHealth = require('./src/server/mount-health-watch.js').create({ file: path.join(__dirname, 'package.json'), getUserTodos: () => userTodos, ownerIds: (procs) => memoryPressure.ownerIds(procs), log: console }); // a slow mount. Three stats past 5 s in a row still kick the mount health sweep; lane fuse-canary-notice (B-b327): every answered probe drives the mount-health EPISODE — ONE For-you item naming the mount + who presses it, the server's own scans paused on it (src/server/mount-health-watch.js)
{ const syncFs = require('./src/server/sync-fs-witness.js').create().wire({ record: (ev) => telemetry.record(ev), guardOn: () => serverSetting('mounts.mainThreadSyncGuard') !== false, registry: () => mounts.storageRoots() }); // lane hub-fuse-sync-guard: the witness boot-trace started gets telemetry, the setting and the storage rows (mounts exists later: a ReferenceError until then = no rows)
  const fsCanary = require('./src/server/fs-canary.js').createFsCanary({
    file: path.join(__dirname, 'package.json'),
    record: (ev) => telemetry.record(ev), witness: syncFs, onHeld: (e) => mountHealth.onHeld(e), // a held loop is named by the witness's call; ≥ 5 s on a mount ⇒ the For-you item names it
    onWedged: () => { try { mounts._healthSweep().catch(() => {}); } catch {} }, onProbe: (p) => mountHealth.onProbe(p),
  });
  setInterval(() => { fsCanary.tick().catch(() => {}); }, 10000).unref();
}

const usageHistory = new UsageHistory({
  dataDir: path.join(__dirname, 'data'), paused: (roots) => mountHealth.paused('usage-walk', roots), // lane fuse-canary-notice: a wedged mount under the walk pauses it
  // THE RECORD, not list() (prod-stall-202): list() reads every account's login files and the
  // walker asks this once per ledger line — seconds of synchronous NFS reads per walk step on
  // production. The same three fields list()'s row carries: its type/backend defaults, and a
  // tail only on the key rows (a pool or subscription row has none).
  resolveAccount: (id) => {
    const a = accounts.get(id);
    if (!a) return null;
    const type = a.type || 'api', backend = a.backend || 'claude';
    let ledgerType = null; try { ledgerType = require('./src/harnesses').get(backend).creds?.ledgerType || null; } catch { } // codex: every account is 'codex-subscription'
    return { type: ledgerType || type, name: a.name, tail: type === 'pooled' || type === 'subscription' ? undefined : a.tail };
  },
});
// OTel receiver (2.361.0, B-345b; DEMOTED TO CORROBORATION 2026-09-07 — the
// observed org is the identity the CLI cached at SPAWN, not the token that
// authorized the request, so it attributes nothing now). Routes are
// cookie-exempt (auth.js); the loopback+token gate is the only door.
const otelIngest = require('./src/server/otel-ingest.js').create({
  dataDir: path.join(__dirname, 'data'), PORT, serverSetting,
  getUsageHistory: () => usageHistory, identityGroups: () => usageIdentityGroupsCached(),
  listAccounts: () => accounts.list().accounts || [],
});
otelIngest.registerRoutes(app); bootTrace.span('otel-replay', otelIngest.replayed); bootTrace.register(app); // B-1319: the stash replay runs off the loop; GET /api/boot-trace
const bridgeWatch = require('./src/server/bridge-watch.js').create({ activeSessions, BUFFERS_DIR, SOCKETS_DIR, reattachLocalPty, serverSetting, getOtelIngest: () => otelIngest, feedPeerCard, log: console }); // THE DEAD-BRIDGE WATCH (lane-dead-bridge): the attach-pty teardown shared by shutdown + crash, the orphan sweep, silence judged against the CLI's own witnesses (buffer file / OTel), the catch-up card
// `usageHistory.setTruthLookup(otelIngest.…)` is DELIBERATELY UNWIRED since
// 2026-09-07 — reasoning at the seam (usage-history.js) + otel-ingest's header.
const { recordUsageAttribution } = require('./src/server/usage-attribution.js').create({ activeSessions, accounts, usageHistory }); // the by-time billing attribution log (moved, lane dc-seams-server)
// Rescan the ledger periodically (incremental — only new JSONL bytes). Also
// rescanned on demand when the Usage window opens.
// The walk YIELDS every MiB (perf ⑥): warm() reads the ledger only once the
// boot walk has settled, and the metric is the walk's WALL time (settle − start).
setTimeout(() => { try { usageHistory.scan(); usageHistory.scanSettled().then(() => { try { if (bootTrace.syncControl) bootTrace.step('usage-ledger-warm', () => usageHistory.warm()); else bootTrace.span('usage-ledger-warm', usageHistory.warmStepped(), (r) => r); } catch {} }); } catch {} }, 8000); // B-1319: the warm takes a MiB per tick (warmStepped)
setInterval(() => { try {
  const t0 = Date.now();
  const r = usageHistory.scan();
  if (!r?.skipped) Promise.resolve(r).then(() => telemetry.record({ kind: 'metric', name: 'srv-usage-scan-ms', value: Date.now() - t0 })).catch(() => {});
} catch {} }, 180000);
// Telemetry ingest (client errors + feature events) + diagnostics summary.
// telemetry.enabled=false drops ingest silently (client still posts — cheap).
app.post('/api/telemetry', (req, res) => {
  try {
    let enabled = true;
    try { enabled = serverSetting('telemetry.enabled') !== false; } catch {}
    if (enabled) {
      const events = Array.isArray(req.body?.events) ? req.body.events.slice(0, 20) : [];
      for (const ev of events) telemetry.record(ev);
    }
    res.json({ success: true });
  } catch { res.json({ success: true }); }
});
app.get('/api/telemetry/summary', (req, res) => {
  try {
    telemetry.flush();
    res.json({ ...telemetry.summary({ days: Math.min(parseInt(req.query.days) || 14, 90) }), ...(req.query.drift === '1' ? { driftLedger: driftLedgerRows() } : {}) }); // ?drift=1 = ⚙ Diagnostics: the drift ledger (lane record-oracle-2-1-296)
  } catch (e) { res.status(500).json({ error: e.message }); }
});
// ── Account + usage routes (src/server/account-usage-routes.js, decomposition #9) ──
require('./src/server/account-usage-routes.js').create({
  app, rootDir: __dirname, HOST, CLAUDE_CMD, NODE_CMD,
  CLAUDE_SUBSCRIPTION_LOGIN_HELPER, activeSessions, auth,
  engine: { oatAnswer, oatIdentityAttach, oatRebind, clearSealedOrders, answerCrossProviderAsk, establishedWindows, resetCreditPreview, consumeResetCreditFor, claimColdRestarts, refreshCodexForPerson, settleResetCreditByRead, memberRemoved, decideDefaultTarget, fallbackDefaultTarget, removalTargetFor, maybePoolAutoSwitchForPool, setConversationPin, gatherPlan, onMemberLoginSuccess }, // + the login re-check (2026-09-29: a member that signs in ⇒ ONE usage read + ONE pool re-decision) + the removed-member wall (2026-09-28: the members route evicts through the engine's ONE entry point, the default re-point by decision) // + claimColdRestarts (r4: the manual routes never double a restart in flight) + the manual reset-credit use (design-reset-credits p2, src/routes/reset-credit.js)
  serverSetting: (...a) => serverSetting(...a),
  recordUsageAttribution: (...a) => recordUsageAttribution(...a),
  liveAccountIdSet: (...a) => liveAccountIdSet(...a),
  buildClaudeSubscriptionLoginCommand: (...a) => buildClaudeSubscriptionLoginCommand(...a),
  getAccounts: () => { try { return accounts; } catch { return null; } }, broadcastActiveSessions: () => broadcastActiveSessions(), // + the pin route's session-facts broadcast (2026-09-28)
  getHosts: () => { try { return hosts; } catch { return null; } },
  getMounts: () => { try { return mounts; } catch { return null; } }, getModels: () => AVAILABLE_MODELS, refreshModels: () => refreshHarnessModels(), getIntegrations: () => { try { return integrationsWiring.store; } catch { return null; } }, // + the harness catalogs a built-in model provider lists (lane provider-record); + their mtime-guarded re-read and the Integrations store a provider's key is read from (lane models-at-session)
  getTelemetry: () => { try { return telemetry; } catch { return null; } },
  getUsageHistory: () => { try { return usageHistory; } catch { return null; } }, broadcastAll: (m) => bcastAll(m), getLoginExpiryWatch: () => { try { return loginExpiryWatch; } catch { return null; } }, getCliCmds: () => cliCmds, // + the CLI registry the on-demand usage reading checks (lane antigravity-card-fixes) ← constructed BELOW this stanza; lazy, like every other late singleton (拆分 P1). Sharing a line because server.js is AT the size ratchet — the wiring stanza may not grow.
});
// ── Session status (agent-set via vibespace-status CLI, user-overridable) ──
// The user's override of an agent-set status is injected as a system-reminder
// into the NEXT chat message (see ws-handler chat-input) so the agent learns
// the user disagreed with its self-assessment.
const fdGauge = require('./src/server/fd-gauge.js').create({ serverNotice: (...a) => serverNotice(...a), log: console }); // THE FD GAUGE (lane-dead-bridge): the limit node REALLY runs at, the /proc/self/fd gauge (≥ 80 % ⇒ one notice an hour, by kind) and the NAME of an EMFILE (12:03: the workspace's FUSE daemon ran out) ⇒ src/server/fd-gauge.js
const { SessionStatusManager } = require('./src/session-status');
const sessionStatus = new SessionStatusManager({
  dataDir: path.join(__dirname, 'data'),
  onWriteError: (e, file, o) => fdGauge.reportWriteError(e, file, o), // a failed debounced write retries + is named, never a crash (12:03:17)
  onChange: (statuses, extra) => { // `extra.cleared` = a history clear's ids (a statuses map equal to every client's copy must still reach it)
    const json = JSON.stringify({ type: 'session-status-updated', statuses, ...(extra && extra.sync), ...(extra && Array.isArray(extra.cleared) ? { cleared: extra.cleared } : {}) }); // lane task-group-fanout: `statuses` = the keys a write touched, `sync` = {removed, epoch, base, seq}
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
function sessionStatusKey(session, id) {
  const bsid = session?.backendSessionId || session?.claudeSessionId;
  return bsid ? `${session.backend || 'claude'}:${bsid}` : `webui:${id}`;
}
// ── Global user-facing TODO list (vibespace-ask) — items an agent filed that
// need the USER (decision/input/review). Merged inbox in the taskbar; each
// item belongs to one session and jumps back to it.
const { UserTodoManager } = require('./src/user-todos');
const userTodos = new UserTodoManager({
  dataDir: path.join(__dirname, 'data'),
  onWriteError: (e, file, o) => fdGauge.reportWriteError(e, file, o), // session-status's twin (lane-dead-bridge)
  onChange: (todos) => {
    const json = JSON.stringify({ type: 'user-todos-updated', todos: { ...todos, now: Date.now() } }); // lane wake-approve-card r8: the snapshot says the HUB's time (a card's countdown counts by it — src/lib/user-todos-row.js noteHubClock)
    wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(json); } catch {} } });
  },
});
require('./src/server/helper-asks').install({ userTodos, sessionKeyFor: (s, id) => sessionStatusKey(s, id), activeSessions, persistAskedAt: (s, map) => { if (s && s.sockName) writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), helperAskedAt: map }); } }); require('./src/server/main-asks').install({ userTodos, sessionKeyFor: (s, id) => sessionStatusKey(s, id), activeSessions, readAskedAt: (s) => (s && s.sockName ? (readSessionMeta(s.sockName) || {}).mainAskedAt : null), persistAskedAt: (s, map) => { if (s && s.sockName) writeSessionMeta(s.sockName, { ...(readSessionMeta(s.sockName) || {}), mainAskedAt: map }); } }); // lane S1: a helper's ask unanswered for 60 s ⇒ ONE For-you item, resolved when it is answered; lane parked-ask-inbox: a conversation's OWN ask the same (main-asks)
require('./src/server/unexpected-exit').install({ userTodos, sessionKeyFor: (s, id) => sessionStatusKey(s, id), activeSessions, clients: () => wss.clients, buffersDir: BUFFERS_DIR }); // B-f698: an unexpected exit while working is resumed ONCE by itself (one client asked) + one For-you item
const loginExpiryWatch = require('./src/server/login-expiry-watch.js').create({ accounts, userTodos, dataDir: path.join(__dirname, 'data'), log: (...a) => console.log(...a) }); loginExpiryWatch.start(); // PASSIVE (file reads only, §ban-safety): warns the inbox at 24h/1h/expired before a subscription's LOGIN SESSION dies AND retracts those warnings once the member is re-logged in — see src/login-expiry.js. The handle is kept so the accounts login routes can sweep it IMMEDIATELY on a successful login (up to 5 min of staring at the item you just fixed is the reported defect)
require('./src/server/ledger-shape-notice.js').wire({ usageHistory, userTodos }); // lane ledger-dedup-law F4: a shard out of shape pauses its machine's ingest — ONE named For-you notice per machine, resolved when it is back in shape
app.get('/api/user-todos', (req, res) => res.json({ todos: { ...userTodos.snapshot(), now: Date.now() } })); // r8: + the hub's clock
require('./src/routes/user-todos-reply.js').registerResolveManyRoute(app, { userTodos }); // "Mark all seen" (POST /api/user-todos/resolve-many, owner-only) — registered BEFORE the :id route below, which would otherwise read `resolve-many` as an item id
require('./src/routes/user-todos-reply.js').registerItemReadRoute(app, { userTodos }); // GET /api/user-todos/:id — ONE item whole (the snapshot previews a resolved item's detail at 300 chars; the For-you window fetches the rest here)
app.post('/api/user-todos/:id', (req, res) => { // User actions from the panel: done / dismissed / open (reopen)
  // lane owner-press-attended r2 (the 15th door): the ✓ on a takeover request's item hands the browser back — an ATTENDED
  // turn — so this door refuses EVERY bearer first, and the person's press rides the status to its listeners
  if (require('./src/write-origin.js').pressBearer(req.headers)) return res.status(403).json({ error: 'the For-you item\'s ✓ is the user\'s — a bearer token (an agent, a job, an automation key) cannot press it', code: 'agent_forbidden' });
  const press = require('./src/write-origin.js').pressOf(req);
  try { res.json({ success: true, item: userTodos.setStatus(req.params.id, req.body?.status, 'user', { pressed: press }) }); }
  catch (e) { const decision = e && (e.code === 'decision_row' || e.code === 'decision_final'); res.status(decision ? 409 : 400).json({ error: e.message, ...(decision ? { code: e.code } : {}) }); } // lane wake-approve-card r2: a decision row's two verbs only — refused by name
});
// ── Agent-facing routes ── (extracted to src/agent-routes.js in the 2.92.0 split)
const { setupAgentRoutes } = require('./src/agent-routes');
// ── Background Work (2.342.0): jobs engine — constructed here, INITIALIZED
// only after listen (failure isolated; §5 of docs/design-background-work.md).
// Shared conversation delivery ladder (2.362.0): jobs notifications AND
// agent-to-agent messages ride one implementation — local CLI inbox, then the
// owning machine's daemon (conversation-index names it), then the durable
// stash drained at that conversation's next context injection.
const deliver = require('./src/server/conversation-deliver.js').create({
  dataDir: path.join(__dirname, 'data'),
  peerMsg: require('./src/peer-messaging.js'),
  getHosts: () => hosts,
  getConvIndex: () => hosts && hosts.convIndex,
  serverSetting, activeSessions, onStashChange: () => { try { stashView.changed(); } catch { } }, authorizeSpend: (req) => spendGuard.authorize(req), noteSpend: (rec) => spendGuard.note(rec), releaseSpend: (rec) => spendGuard.release(rec), // THE SPEND CEILING (design §4.4c): every rung can open a BILLED turn on an idle session; a refusal is not a dropped message (the caller stashes and it rides the next injection)
  // 2.363.0: render the peer card at delivery time — server-posted injections
  // are body-less at the CLI, only the delivery site can show them live.
  emitPeerCard: (cid, card) => {
    for (const [, s] of activeSessions) {
      if (addressableId(s) !== cid || !s._normalizer) continue; // verify r6 (channel-withdraw): the card is drawn in the window that OWNS the conversation, never a pending fork's (it carries the parent's id)
      try { feedPeerCard(s, card); } catch { }
      return true;
    }
    return false;
  },
  log: (...a) => console.log(...a), renderBatch: require('./src/agent-routes.js').renderMsgStash,   // renderBatch (notify-retry verify r1): several parked notices go out as ONE frame in the hand-over's shape
});
const jobsWiring = require('./src/server/jobs-wiring.js').create({
  app, dataDir: path.join(__dirname, 'data'), deliver,
  broadcastAll: (msg) => { const payload = JSON.stringify(msg); for (const c of wss.clients) { try { if (c.readyState === WS_OPEN) c.send(payload); } catch {} } },
  userTodos, log: (...a) => console.log(...a), getTelemetry: () => { try { return telemetry; } catch { return null; } }, // jobs-archive-write-failed rides telemetry
  serverSetting, taskGroups: tasks, activeSessions, // owner auto-notify (2.344.0): toggles + channel-lane session lookup
  onStash: () => { try { stashView.changed(); } catch { } }, // 2026-09-27: a job notification stashed / drained ⇒ the session's `stash` fact is re-published
  onRunEnded: (job) => { try { browserKeeper?.releaseJob?.(job.id, 'the job run ended'); } catch { } }, // lane jobs-browser: a run's end releases its browser lease + window
});
// WHAT WAITS FOR AN AGENT (2026-09-27, the owner: "我在界面里完全看不到'有消息在 queue'这件事情"): both stashes summarized as the `stash` session fact + the user's POST /api/sessions/:id/stash/hand-over (ONE ladder turn, spend reason stash-handover) — src/server/stash-handover.js
const stashView = require('./src/server/stash-handover.js').create({ activeSessions, getDeliver: () => deliver, getJobs: jobsWiring.getJobs, getGroups: () => { try { return channelsWiring.groups; } catch { return null; } } /* lane group-report-card: the group messages waiting for a member's next turn (created further down — TDZ-safe) */, getChannels: () => { try { return channelsWiring.channels; } catch { return null; } } /* lane owner-press-attended: a delivered held channel wake clears its row's tag */, broadcastSessions: () => broadcastActiveSessions(), renderMsgStash: require('./src/agent-routes.js').renderMsgStash, renderNotifStash: require('./src/job-model.js').renderNotifStash, dataDir: path.join(__dirname, 'data') }); stashView.register(app);   // verify r4: dataDir = the delivered-hand-over memory on disk (a restart between a delivery and its echo)
deliver.registerFrameRestorer((cid, text, meta) => stashView.restoreHandedOver(cid, text, meta)); deliver.registerRedactor((match, scope) => stashView.redactDelivered(match, scope)); /* "Clear content…": the hand-over memory is a copy of held words */ // verify r2: a hand-over's frame that comes back from a wrapper is restored as its ORIGINAL entries (each store, each kind), never one blob; r4: `meta.kind` — a peer's frame never
function stashFactOf(s) { try { return stashView.summaryFor(s); } catch { return null; } } // boot-order safe: a payload built before the view exists states nothing
function poolPinFactOf(s) { return s._poolPin && s._poolPin.memberId ? { memberId: s._poolPin.memberId, name: accounts.get(s._poolPin.memberId)?.name || s._poolPin.memberId, at: s._poolPin.at || null } : null; } // THE CONVERSATION'S PIN (2026-09-28): one payload key per line (the active-sessions census reads the line's keys)
// Channels v1 (2.362.0): per-session external reach override for agent
// messaging — user-set (Session Properties), widening only; ACL reads the
// live field, meta persists it across restarts.
app.post('/api/sessions/:id/msg-reachability', (req, res) => {
  const s = activeSessions.get(String(req.params.id));
  if (!s) return res.status(404).json({ error: 'no such active session' });
  const lv = String((req.body || {}).level || 'inherit');
  if (!['inherit', 'visible', 'messageable'].includes(lv)) return res.status(400).json({ error: 'level must be inherit|visible|messageable' });
  s._msgReachability = lv === 'inherit' ? null : lv;
  try { writeSessionMeta(s.sockName, { ...readSessionMeta(s.sockName), msgReachability: s._msgReachability }); } catch { }
  res.json({ ok: true, level: lv });
});
const recordClear = require('./src/server/record-clear.js').create({ tasks, userTodos, sessionStatus, getJobs: jobsWiring.getJobs, getGroups: () => channelsWiring.groups, getChannels: () => channelsWiring.channels }); require('./src/routes/records-clear.js').registerRecordClearRoutes(app, { recordClear }); // "Clear content…" (2026-09-28): ONE entry point (PURE verdict, each store's door, the journal line); the owner's POST /api/records/clear[-many] here, an agent's own verbs through setupAgentRoutes
setupAgentRoutes({ app, activeSessions, tasks, sessionStatus, SessionStatusManager, userTodos, sessionStatusKey, serverSetting, spendGuard, scheduleCtxSync, remoteCtxBaseFor, readUserState: () => persistenceRouter.readUserState(), getJobs: jobsWiring.getJobs, deliver, getPublishedPages: () => publishedPages, getChannels: () => channelsWiring.channels, getGroups: () => channelsWiring.groups, getTouches: () => channelsWiring.touches, getRecordClear: () => recordClear, getSendUserInput: () => sendUserInput, getSessionMetaStore: () => ({ readSessionMeta, writeSessionMeta }) }); // B-86d3: the seen marks ride the session meta; lazy getters: all three are created further down (TDZ at boot otherwise); getChannels = the vibespace-channels routes' engine (P3); getSendUserInput = THE typing path for a dispatch's `/compact` (lane worker-dispatch — sendUserInput is declared further down)
app.get('/api/agent-hooks', (req, res) => res.json({ ...agentHooksStatus(), integrationOff: !integrationEnabled(), cliConfig: harnessConfig.cliConfigStatus() })); // cliConfig = fresh per-key receipts for the managed CLI-config rows (Settings window chips + the Machines card; D2: never persisted)
app.post('/api/agent-hooks/install', (req, res) => {
  // The master switch outranks the button: boot/toggle would strip the entries
  // right back — refuse with guidance instead of silently contradicting.
  if (!integrationEnabled()) return res.status(400).json({ error: 'VibeSpace integration is disabled (Settings → Integration → master switch). Enable it first.' });
  createHookHelper(); // regenerate the script too (repair path)
  const results = ensureAgentHooks({ auto: false }); // explicit → clears any opt-out
  // A worktree / temp server refuses BY NAME (src/server-root.js) — never "installed"
  if (results.refused) return res.status(409).json({ error: results.refused.line, refused: results.refused, status: agentHooksStatus() });
  res.json({ success: true, results, status: agentHooksStatus() });
});
hooksLate.registerApplyRoute(app, { ensureAgentHooks, agentHooksStatus, integrationEnabled, harnessConfig, hookRegistrationSafe }); // POST /api/cli-config/apply — the missing-file chip's "Apply" (human-triggered): the boot registration + CLI-config plan on demand (lane hooks-create)
app.post('/api/agent-hooks/uninstall', (req, res) => {
  removeAgentHooks();
  res.json({ success: true, status: agentHooksStatus() });
});

// ── Hosts (the MACHINE registry — ssh hosts AND dial-out devices, B-f3e8) ──
const { HostManager } = require('./src/hosts');
const hosts = new HostManager({ dataDir: path.join(__dirname, 'data') });
hosts.ownerWriteRefusal = refuseOwnerWrite; // the root verdict (src/server-root.js): a worktree / temp server runs no register helper on another machine either
hosts.cliConfigPlanB64 = cliConfigPlanB64; // the CLI-config plan rides every remote install + the gated --status probe as VIBESPACE_CLI_CONFIG (design-harness-settings §6)
const bcastAll = (msg) => { const j = JSON.stringify(msg); wss.clients.forEach(c => { if (c.readyState === WS_OPEN) { try { c.send(j); } catch {} } }); };
// B-f3e8 one-time migration: dial-tokens.json (deviceId → sha256) folds into
// the dial host records (dialTokenHash) — see hosts.migrateDialTokenFile.
try { hosts.migrateDialTokenFile(path.join(AGENTD_DIR, 'dial-tokens.json')); }
catch (e) { console.warn('[hosts] dial-token migration failed:', e.message); }
hosts.dialOnline = (deviceId) => agentdDials.has(deviceId);
// ── R4 push-triggered remote ledger (docs/design-three-tier.md): a connected
// daemon fs.watches its transcript dirs (.claude/sessions+projects and
// .codex/sessions) and pushes one debounced dirty per change burst; we
// harvest promptly instead of waiting for a turn-end result or the idle
// 15-min cadence. harvestUsage's own 60s/host floor bounds frequency, and
// the op harvest (2.286.0) is incremental + cheap — so ANY remote activity
// (mid-turn tool storms, codex, external terminals) reaches the ledger and
// the billing popup within ~a minute. One dirty signal, two consumers: this
// kick + discovery cache invalidation (armed in hosts._armDirtyPush). ──
// usage-events PUSH consumer (R4 finale, 2.299.0): batches arrive
// seconds-fresh over the device link; ingest through the SAME pipeline the
// pull harvest uses (attribution + rid namespacing + host-bucket honesty),
// then invalidate the estimator so the next pool decision sees the spend.
// Returning normally (not false) tells hosts to ACK — which is what commits
// the device-side cursor (two-phase). A throw leaves the batch unacked → the
// daemon re-emits → rid dedup absorbs the replay.
// ── Session-brain core (src/server/session-brain.js, decomposition #8) ──
const sessionBrain = require('./src/server/session-brain.js').create({
  engine: { kickPoolEval, markLimitBanner, maybeStopOnFallback,
    recordRateLimitEvent, resolveUsageKey, usageEstimator, noteServedModel, noteModelFallback, rerouteAnnouncedBy, notePoolAuthFailure, noteStreamRecord, recordIsLate }, // the device feed shares the parse's ONE served-model/fallback pair + the r4 rule that places the reroute BEFORE the served capture (2026-09-13); notePoolAuthFailure = the api_error 401/403 twin (design-unknown-records; forward-compat — the record is observed only in transcripts, which are NOT fed)
  applyTaskToolUpdate, updateSessionTodos,
  getUsageHistory: () => { try { return usageHistory; } catch { return null; } },
  // design-unknown-records (2026-09-21): the chrome-signal consumers' deps (notification toast,
  // vcs fact + timeline, published-change meta) — one implementation for both feeds
  getServerNotice: () => serverNotice, broadcastActiveSessions: (...a) => broadcastActiveSessions(...a),
  broadcastAll: (msg) => { const json = JSON.stringify(msg); for (const c of wss.clients) { try { if (c.readyState === WS_OPEN) c.send(json); } catch {} } }, // session-vcs must reach an explorer-only client, not just the session's attached ones
  getSessionMetaStore: () => ({ readSessionMeta, writeSessionMeta }), getSessionStatus: () => { try { return sessionStatus; } catch { return null; } }, sessionStatusKey,
});
const { sbNoteServerOp, sbCompare, sbSeenFirst, claudeSideEffects, _sbRing,
  _sbMidCore, SB_RING_MAX,
} = sessionBrain;
hosts.onSessionEvents = (hostId, m) => {
  try {
    if (!m?.sid) return;
    // STEP 3: raw records → the shared side-effect consumers, device-first.
    // Session lookup by the DAEMON's sid (keeperSid); miss = not ours (an
    // externally-adopted pipe session) — parity ring still records below.
    if (Array.isArray(m.raw) && m.raw.length) {
      let sess = null;
      for (const [, s3] of activeSessions) { if (s3.host === hostId && s3.keeperSid === m.sid && s3.backend !== 'codex') { sess = s3; break; } }
      if (sess) {
        for (const line of m.raw) {
          let rec = null; try { rec = JSON.parse(line); } catch { continue; }
          if (sbSeenFirst(sess, rec)) claudeSideEffects(sess, sess._webuiId || null, rec);
        }
      }
    }
    if (!Array.isArray(m.batch)) return;
    const r = _sbRing(hostId + ':' + m.sid);
    for (const ej of m.batch) {
      let op = null; try { op = JSON.parse(ej); } catch { continue; }
      if (op?.op === 'create' && op.msg?.id) {
        r.device.push(_sbMidCore(op.msg.id));
        if (r.device.length > SB_RING_MAX) r.device.splice(0, r.device.length - SB_RING_MAX);
      }
    }
    sbCompare(hostId, m.sid, r);
  } catch { }
};
hosts.onUsageEvents = (hostId, text) => {
  if (!text) return true;
  const h = hosts.get(hostId);
  const done = (r) => {
    if (r.added > 0) { try { for (const [ik] of usageIdentityGroups()) usageEstimator.invalidate(ik); } catch { } try { kickPoolEval(); } catch { } }
    return usageAckOf(r); // lane ledger-dedup-law r5: THE ACK is durability — every row appended or held (a pause alone never withholds it); deferred or a month's hold unwritten ⇒ unacked, the device keeps the batch
  };
  const r = usageHistory.ingestRemoteEvents(hostId, h?.name || hostId, text);
  return r && typeof r.then === 'function' ? r.then(done, () => false) : done(r); // r8: a held month lands on the hold's async road — the ack waits for it
};
{
  const dirtyTimers = new Map();
  // Remote discovery went stale (create / terminate / external kill / device
  // push) — every connected client's cached host list must re-fetch. Trailing-
  // debounced per host so a burst of invalidations is one broadcast.
  // …and the ORCHESTRATOR computes it ONCE and pushes the RESULT (2.310.0).
  // The first cut broadcast a bare "dirty" and let every client re-fetch with
  // ?fresh=1 — which puts the trigger for a heavy scan on the orchestration
  // side and multiplies it by the number of connected clients. The three-tier
  // rule is the opposite: the machine that OWNS the facts computes them (the
  // capability-gated `discovery-claims` op runs the whole claim algorithm on
  // the device, next to the bytes), the orchestrator forwards, the client is a
  // view. One dirty signal ⇒ one computation ⇒ one broadcast, whatever the
  // client count. Skipped entirely when nobody is connected.
  // AUTO-GRADUATE ssh → ws (2.311.0). The graduation mechanism has existed
  // since 2.248.0 but was button-only, so in practice every machine stayed on
  // ssh forever — per-op child spawns, banner hangs on lossy paths, and a
  // ControlMaster whose ESTABLISHED flow survives network changes that every
  // NEW connection fails (the 2.228.1 lie). Once we have proven we can reach
  // the machine, moving to our own ws link is strictly better.
  // DELIBERATELY CONSERVATIVE: only with an operator-declared base URL — never
  // auto-publish this instance to the public relay, which is a side effect the
  // operator has to choose. The machine is still asked whether it can reach
  // that URL BEFORE anything is installed, and any failure leaves it on ssh.
  const gradTried = new Map();
  hosts.onSshConnected = (hostId) => {
    try {
      if (!hostId || serverSetting('agentd.autoGraduate') === false) return;
      const h = hosts.get(hostId);
      if (!h || h.transport === 'dial' || h.deviceId || h.autoGraduate === false) return; // already graduated / opted out
      if (!instanceUrl.url() || instanceUrl.effective().source === 'https') return; // nothing OPERATOR-DECLARED to dial back to (the hub's own https address is not) (was agentdDeps.publicUrl — a ghost binding since the split; auto-graduation silently never fired)
      const last = gradTried.get(hostId) || 0;
      if (Date.now() - last < 6 * 60 * 60 * 1000) return;               // one attempt per machine per 6h
      gradTried.set(hostId, Date.now());
      setTimeout(async () => {
        try {
          const out = await graduateHostToDial(hosts.get(hostId), { by: 'system:graduate' });
          serverNotice('grad-' + hostId, `"${h.name}" now talks to VibeSpace over its own ws link${out.dialedIn ? '' : ' (dialing in shortly)'} — ssh stays as the rescue channel.`);
        } catch (e) {
          // Never silent: the operator asked for ws and did not get it.
          console.warn('[graduate] auto attempt failed for', hostId, e.message);
          serverNotice('grad-fail-' + hostId, `Could not move "${h.name}" to a ws link — staying on ssh. ${String(e.message).slice(0, 180)}`, { level: 'warn' });
        }
      }, 3000); // let the connect that triggered us finish its own work first
    } catch { }
  };

  const discDirtyTimers = new Map();
  hosts.onDiscoveryDirty = (hostId) => {
    if (!hostId || discDirtyTimers.has(hostId)) return;
    discDirtyTimers.set(hostId, setTimeout(async () => {
      discDirtyTimers.delete(hostId);
      try {
        if (!wss.clients.size) return; // nobody to tell — do not spend the scan
        const d = await hosts.discoverSessions(hostId, { ttlMs: 0 });
        bcastAll({ type: 'remote-sessions', hostId, sessions: d?.sessions || [], at: Date.now() });
      } catch (e) {
        // An unreachable machine must not silently freeze the list at a state
        // we know is wrong — say so, and let the client keep its labelled
        // last-known copy (the same degrade the pull path already does).
        try { bcastAll({ type: 'remote-sessions', hostId, error: String(e?.message || e), at: Date.now() }); } catch { }
      }
    }, 400));
  };
  hosts.onDeviceDirty = (hostId) => {
    if (dirtyTimers.has(hostId)) return; // trailing-debounce per host
    dirtyTimers.set(hostId, setTimeout(() => {
      dirtyTimers.delete(hostId);
      try {
        hosts.harvestUsage(hostId, { minIntervalMs: 60 * 1000, scannerPath: USAGE_SCANNER_PATH, ledger: usageHistory }) // lane ledger-dedup-law F2: it ingests, then commits the hub's cursor
          .catch(() => { });
      } catch { }
    }, 3000));
  };
}
const { MachineMounts } = require('./src/machine-mounts');
const machineMounts = new MachineMounts({
  dataDir: path.join(__dirname, 'data'), hosts, mountTokens,
  publicUrl: () => instanceUrl.url(), localPort: () => PORT, // the agentd tunnel's target: our own /dav
  rcloneBin: () => mounts.rcloneBin(),
  broadcast: bcastAll,
  log: (m) => console.log('[machine-mounts]', m),
});
setTimeout(() => { machineMounts.restore().catch(() => {}); }, 5000); // heal pull mounts + re-own push tunnel ports
app.get('/api/machine-mounts', (req, res) => res.json({ mounts: machineMounts.list() }));
app.post('/api/machine-mounts/:hostId', async (req, res) => {
  try {
    const b = req.body || {};
    if (b.dir === 'pull') {
      res.json(await machineMounts.mountPull(req.params.hostId, { remotePath: b.remotePath, mountpoint: b.mountpoint }));
    } else {
      // PRIMARY transport = the agentd tunnel (inside mountPush — no public
      // address needed). The request-derived URL is only the last-resort
      // fallback for hosts without the device agent.
      let pub = b.publicUrl ? String(b.publicUrl) : null;
      if (!pub) pub = require('./src/write-origin.js').ownOriginOf(req.headers, { encrypted: !!(req.socket && req.socket.encrypted) }) || null; // the request's own origin: THE one rule
      res.json(await machineMounts.mountPush(req.params.hostId, { folder: b.folder, mode: b.mode, mountpoint: b.mountpoint, publicUrlFallback: pub }));
    }
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/machine-mounts/:id', async (req, res) => {
  try { res.json(await machineMounts.unmount(String(req.params.id))); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/machine-mounts/:id/remount', async (req, res) => {
  try { res.json(await machineMounts.remount(String(req.params.id))); } catch (e) { res.status(400).json({ error: e.message }); }
});

// ── Port forwarding (B-0b60, tunnel path): expose a machine's loopback
// service at http://127.0.0.1:<localPort> on this instance, over the agentd
// data plane (no frps / public exposure). ──
const { PortForwardManager } = require('./src/port-forward');
const portForwards = new PortForwardManager({
  dataDir: path.join(__dirname, 'data'), hosts, broadcast: (m) => { bcastAll(m); require('./src/server/artifact-registry.js').noteForwards(m); }, // lane artifacts-services-url: a service card's link follows its forward
  serverSetting, getJobs: jobsWiring.getJobs, // Background Work ⇄ ports sync (2.343.0)
  log: (m) => console.log('[port-forward]', m),
});
jobsWiring.jm.d.getPorts = () => portForwards; // late singleton — lazy getter, never a Proxy
setTimeout(() => { portForwards.restore().catch(() => {}); }, 5500);
const instanceUrl = require('./src/server/instance-url.js').create({ dataDir: path.join(__dirname, 'data'), port: PORT, serverSetting, httpsUrl: () => hub.url(), log: (...a) => console.log(...a), authEnabled: () => auth.enabled, broadcast: (m) => bcastAll(m), plugins: { relayStatus: () => plugins.relayStatus(), frpPublish: (...a) => plugins.frpPublish(...a), frpUnpublish: (...a) => plugins.frpUnpublish(...a), setSelfDialSub: (...a) => plugins.setSelfDialSub?.(...a) } }); // ONE resolver for "this instance's URL" (frp mapping layered OVER agentd.publicUrl, never written into it) + the ONLY publisher of the 'vibespace-instance' proxy; plugins arrives later so its accessors are lazy ⇒ src/server/instance-url.js
const autoResume = require('./src/server/auto-resume.js').create({ dataDir: path.join(__dirname, 'data'), activeSessions, serverSetting, beforeFire: (id, s) => { try { return beforeAutoResumeFire(id, s); } catch (e) { console.warn('[auto-resume] pre-fire gate threw — refusing the continue (fail closed):', e && e.message); return false; } }, fireIdentity: (id, s) => { try { return fireIdentityFor(s); } catch { return null; } }, authorizeSpend: (id, s, identity, o) => spendGuard.authorize({ reason: 'auto-resume', session: s, sessionId: id, sessionName: s && s.name, identity, hold: !!(o && o.hold) }), noteSpend: (id, s, identity, hold) => spendGuard.note({ reason: 'auto-resume', session: s, identity, hold }), releaseSpend: (id, s, hold) => spendGuard.release({ hold }), log: (...a) => console.log(...a), broadcast: (id, m) => { const s = activeSessions.get(id); if (s) broadcastToSession(s, id, m); }, notify: (id, s, text, extra) => { try { feedPeerCard(s, { fromName: 'VibeSpace', kind: 'notification', text, ...(extra && extra.resetCredit ? { resetCredit: extra.resetCredit } : {}) }); } catch { } }, resetCreditOffer: (id, s) => { try { return resetCreditOffer(s); } catch { return null; } }, sendToSession: (id, s, text, carried) => { try { const ad = adapterRegistry.get(s.backend); if (!ad || !s.pty || s.mode !== 'chat') return false; const { stdinPayload, userMsg } = ad.formatChatInput(text, Date.now() + '-auto', { origin: 'auto-resume' }); /* a frame the wrapper holds mid-turn stays VibeSpace's: never edited, never put back (2.369.354) */ s._isStreaming = true; s._machineInputAt = Date.now(); /* a turn nobody typed — prompt-context withholds next-turn group reports from it (§22) */ s.pty.write(stdinPayload + '\n'); if (userMsg) { userMsg.originKind = 'auto-resume'; if (userMsg.payload) userMsg.payload.webui_origin = 'auto-resume'; const note = carried && typeof carried.note === 'string' && carried.note ? carried.note.slice(0, 200) : null; if (note) { userMsg.originNote = note; if (userMsg.payload) userMsg.payload.webui_origin_note = note; } s.buffer = (s.buffer + JSON.stringify(userMsg) + '\n').slice(-500000); feedLive(s, userMsg); } return true; } catch (e) { console.warn('[auto-resume] send failed:', e.message); return false; } } }); // continue a limited session when its quota resets ⇒ src/server/auto-resume.js
autoResume.start();
const permissionRules = require('./src/server/permission-rules.js').create({ activeSessions, adapterRegistry, accounts, agentEnv: (...a) => require('./src/ws-handler').agentEnv(...a), buffersDir: BUFFERS_DIR, codexCmdRef: () => CODEX_CMD, telemetry: { record: (e) => { try { telemetry.record(e); } catch { } } } }); permissionRules.registerRoutes(app); instanceUrl.registerRoutes(app); hub.registerRoutes(app); instanceUrl.restore(); Object.defineProperty(app.locals, 'instancePublicUrl', { get: () => { try { return instanceUrl.url(); } catch { return null; } } }); app.get('/api/port-forwards', (req, res) => res.json({ forwards: portForwards.list() })); // permissionRules = the READ-ONLY "where does this rule come from" view (owner ruling 10) + the human-triggered zero-network local oracles (ruling 6) ⇒ src/server/permission-rules.js
app.get('/api/hosts/:id/ports', async (req, res) => {
  // the UI path probes protocols (http/https/tcp chip); the watch sweep doesn't
  try { res.json({ ports: await portForwards.detect(req.params.id, { probe: true }) }); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.post('/api/hosts/:id/port-forward', async (req, res) => {
  try {
    const b = req.body || {};
    res.json(await portForwards.forward(req.params.id, b.port, { label: b.label || '', targetHost: b.targetHost || '' }));
  } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/port-forward/:id', async (req, res) => {
  try { await portForwards.unforward(String(req.params.id)); res.json({ ok: true }); } catch (e) { res.status(400).json({ error: e.message }); }
});
// public exposure (frp relay) — publish/unpublish a forward; body.sub = a
// user-chosen FIXED subdomain (2.358.0; blank keeps prior/random)
app.post('/api/port-forward/:id/publish', async (req, res) => {
  try { res.json(await portForwards.publish(String(req.params.id), { sub: (req.body || {}).sub })); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/port-forward/:id/publish', async (req, res) => {
  try { await portForwards.unpublish(String(req.params.id)); res.json({ ok: true }); } catch (e) { res.status(400).json({ error: e.message }); }
});
// main-domain PATH mount (2.358.0): /svc/<name>/ → the forward. body.public
// (2.359.0) = shareable WITHOUT login; default private, auth enforced
// per-mount inside path-mounts (the /svc prefix is middleware-exempt).
app.post('/api/port-forward/:id/path', (req, res) => {
  try { res.json(portForwards.setPathMount(String(req.params.id), (req.body || {}).name ?? null, { public: (req.body || {}).public })); } catch (e) { res.status(400).json({ error: e.message }); }
});
app.delete('/api/port-forward/:id/path', (req, res) => {
  try { res.json(portForwards.setPathMount(String(req.params.id), null)); } catch (e) { res.status(400).json({ error: e.message }); }
});
const pathMounts = require('./src/server/path-mounts.js').create({ getPortForwards: () => portForwards, requestAuthed: (req) => auth.requestAuthed(req) });
app.use('/svc', pathMounts.handler);
const publishedPages = require('./src/server/published-pages.js').create({ // 2.364.0 接管artifact: /p/<id> auth-exempt, gated PER PAGE in the module (CSP sandbox = the XSS guard); onPublished = the ONE notify point (dialog + agent publishes)
  dataDir: path.join(__dirname, 'data'), requestAuthed: (req) => auth.requestAuthed(req), log: (...a) => console.log(...a), publicUrl: () => instanceUrl.url(),
  onPublished: (page, extra) => { const s2 = page.sessionId && activeSessions.get(page.sessionId); if (s2) broadcastToSession(s2, page.sessionId, { type: 'page-published', sessionId: page.sessionId, page }); require('./src/server/artifact-registry.js').notePage(page, extra); }, // lane artifacts-registries: + its conversation's `page` row
});
publishedPages.registerRoutes(app); // 2.364.0 published pages (/p/<id> + /api/pages); the Design window publishes through the same store (lane design-docs: the Claude CLI kit that was wired here is gone — the Design window is VibeSpace's own, src/server/design-engine.js)
// protocol override: {proto: 'http'|'https'|'tcp'|null} (null = back to auto);
// a published forward is transparently re-published in the new mode
app.post('/api/port-forward/:id/proto', async (req, res) => {
  try { res.json(await portForwards.setProtoOverride(String(req.params.id), (req.body || {}).proto ?? null)); }
  catch (e) { res.status(400).json({ error: e.message }); }
});
// Kill a LOCAL orphaned listener (B-16d9): killOrphan re-verifies the
// deleted-cwd condition at kill time, so this can't target a healthy process.
app.post('/api/ports/kill-orphan', (req, res) => {
  try { res.json(portForwards.killOrphan((req.body || {}).pid)); } catch (e) { res.status(400).json({ error: e.message }); }
});
// On-demand EXIT (task #164): let an agent borrow a machine's network / run a command on it for ONE command.
// Who may, per machine: two lists (lane-pairing ⑥, PURE src/exit-reach.js) — the routes are src/server/exit-routes.js.
const { ExitProxyManager } = require('./src/exit-proxy');
// lane device-upgrade-stuck: an agent upgrade the hub gave up on reaches the user — ONE For-you item per (machine, version) + the row's line, gone at that version (every transport's door); lane host-stale-dialer (B-6136): a second agent with an old token — its row's line, ONE For-you item per episode, a 10-min journal line (src/server/dial-health-watch.js)
const deviceAlerts = require('./src/server/device-alerts.js').create({ userTodos, dataDir: path.join(__dirname, 'data'), log: (...a) => console.log(...a) }); hosts.onDeviceAlert = (kind, facts) => deviceAlerts.file(kind, facts); /* lane device-act-audit: a pairing minted, a first dial from a new address, a pushed update = URGENT For you */ const deviceUpgradeWatch = require('./src/server/device-upgrade-watch.js').create({ userTodos, dataDir: path.join(__dirname, 'data'), log: (...a) => console.log(...a), bcast: () => { try { bcastAll({ type: 'hosts-updated' }); } catch { } }, alerts: deviceAlerts });
hosts.onAgentUpgrade = (event, facts) => deviceUpgradeWatch.onAgentUpgrade(event, facts); hosts.agentUpgradeOf = (id) => deviceUpgradeWatch.rowOf(id); const dialHealthWatch = require('./src/server/dial-health-watch.js').create({ userTodos, hosts, dataDir: path.join(__dirname, 'data'), log: (...a) => console.log(...a), bcast: () => { try { bcastAll({ type: 'hosts-updated' }); } catch { } } });
const exitProxy = new ExitProxyManager({ hosts, grants, log: (m) => console.log('[exit]', m), dataDir: path.join(__dirname, 'data'), userTodos, settingOf: (k) => serverSetting(k), sessionsMap: () => activeSessions, bcastAll: (...a) => bcastAll(...a),
  emitCard: (s, card) => feedPeerCard(s, { ...card, belongsTo: require('./src/exit-call.js').cardMatcher(card) }), groupsOf: (s, id) => tasks.groupsForSession({ sessionKey: sessionStatusKey(s, id), cwd: s.cwd, initialGroupId: s._initialGroupId, initialGroupIds: s._initialGroupIds }).map((g) => g.id) });
hosts.onReachChange = (why) => exitProxy.rejudgeAll(`hosts-${why}`); require('./src/server/hub-act-ask.js').wire({ hosts, userTodos, exitProxy, settingOf: (k) => serverSetting(k), activeSessions }); // verify-r3 A-r3a: an import / a removal / a reshape of hosts.json re-judges every lent machine (the PATCH was the only writer that did); lane hub-act-ask (q-042 D4): on a cluster instance a hub act nobody clicked asks the owner first
setTimeout(() => { try { const n = exitProxy.reconcileAsks(); if (n) console.log(`[exit] ${n} "ask me" item(s) from before the restart resolved expired`); } catch { } }, 3000).unref?.(); grants.onChange(({ door }) => { if (door === 'exit') { try { exitProxy.rejudgeAll('grants'); } catch { } try { bcastAll({ type: 'hosts-updated' }); } catch { } } if (door === 'group-visibility') { try { tasks._notify(); } catch { } } }); /* lane grants-unify: a machine's exit rows / a group's visibility changed ⇒ re-judged NOW */
// ── Exit routes + RemoteFs singletons (src/server/exit-routes.js, decomposition #10) ──
const { exitAgentSession, remoteFs, sshKey,
} = require('./src/server/exit-routes.js').create({
  app, rootDir: __dirname, AGENT_BIN_DIR, activeSessions, auth, wss, WS_OPEN,
  bcastAll: (...a) => bcastAll(...a),
  integrationEnabled: (...a) => integrationEnabled(...a),
  unpairDialDevice: (...a) => unpairDialDevice(...a),
  hosts,
  getExitProxy: () => { try { return exitProxy; } catch { return null; } },
  getMounts: () => { try { return mounts; } catch { return null; } },
  getPortForwards: () => { try { return portForwards; } catch { return null; } },
  getTasks: () => tasks,
});
const { readLayouts, writeLayouts, flushLayouts } = persistenceRouter;
// ── Integrations & keys (src/server/integrations-wiring.js; design §14) — the ONE resolver of the cluster integration env ──
const integrationsWiring = require('./src/server/integrations-wiring.js').create({
  app, dataDir: path.join(__dirname, 'data'), bcastAll: (...a) => bcastAll(...a), drivePresets: () => require('./src/mounts').MountManager.drivePresets(),
}); // created BEFORE the mounts-plugins wiring: the agent browser's key consumer (P4 §7.5) registers its Test runners with this store and the keeper resolves through it
// ── Mounts + plugins + dial-session wiring (src/server/mounts-plugins-wiring.js, decomposition #12) ──
const { decisionEngine, mounts, plugins, dialBridge, graduateHostToDial, createSessionMessages, browserKeeper, bootBrowserKeeper, browserStream, browserHandback, browserTrace, browserKeys, browserDialogs, bootEngineDistribution, pluginLoader,
} = require('./src/server/mounts-plugins-wiring.js').create({
  app, server: hub, rootDir: __dirname, HOST, PORT, BUFFERS_DIR, PERMISSION_MODES, integrations: integrationsWiring.store, getJobs: () => jobsWiring.getJobs(), // + lane jobs-browser: a job browses as its owner conversation // + agent browser P4 second half (§7.5): the key consumer's store
  auth, wss, WS_OPEN, syncStores, agentdDialDevices, getAccounts: () => accounts, getChannels: () => channelsWiring.channels, // + lane vault-contents-window: the Vault window lists these two stores
  bcastAll: (...a) => bcastAll(...a), serverNotice: (...a) => serverNotice(...a), // + agent browser P1: the keeper's runaway/ceiling notices
  serverSetting: (...a) => serverSetting(...a),
  mountTokens, persistenceRouter, hosts,
  agentdDials, agentdHostToken,
  agentdMintDialPair: (...a) => agentdMintDialPair(...a),
  deviceForDial: (...a) => deviceForDial(...a),
  lockOutDialHolder: (...a) => lockOutDialHolder(...a), // verify-r2 B8-r2: a rotation's in-place push that did not land ends the holder's link
  ensureAgentdOnHost: (...a) => ensureAgentdOnHost(...a),
  readSessionMetaOf: (session) => (session?.sockName ? readSessionMeta(session.sockName) : null), integrationEnabled: () => integrationEnabled(), // B-f7ab: the late browser key extends the session's own record, under THE integration switch
  // + agent browser P3 (§4.3.1): the handback announcer forwards to THE ladder under 'browser-handback'; an idle handback files one inbox item // + agent browser P2 (§3.8 ③): a stamped last-used profile re-publishes the live facts // + agent browser P1 second half: the Task-Group default rung, the zero-billed notice queue, the pin's meta persistence — the notes used to sit MID-LINE and swallowed the two keys appended after them (2.369.134: getTelemetry never reached the wiring; the r-fix moved activeSessions after them and every browser route answered "no such live session")
  // lane H (2026-09-25): rebindSessionMeta = the SAME meta record written back, so the meta choke point's browser-binding rule re-runs (a real record only, never a partial one) // lane J r2: adapterRegistry = the permission-answer path (src/server/permission-answer.js) for the stale-approval sweep
  getPortForwards: () => { try { return portForwards; } catch { return null; } }, instanceUrl, onMountsUpdated: () => tasks.syncAllContextMd(), getTasks: () => tasks, sessionStatusKey, getSessionStatus: () => sessionStatus, persistSessionMeta: (session, patch) => { if (session?.sockName) writeSessionMeta(session.sockName, { ...(readSessionMeta(session.sockName) || {}), ...patch }); }, rebindSessionMeta: (session) => { const m = session?.sockName ? readSessionMeta(session.sockName) : null; if (m && m.browserKey && m.webuiSessionId) writeSessionMeta(session.sockName, { ...m }); }, broadcastActiveSessions: () => broadcastActiveSessions(), deliver, userTodos, getTelemetry: () => { try { return telemetry; } catch { return null; } }, activeSessions, adapterRegistry,
});
// ── Session API (extracted to src/routes/sessions.js) ──
const { router: sessionsRouter, setup: setupSessions } = require('./src/routes/sessions');
setupSessions({ activeSessions, webuiPids, refreshWebuiPids, createSessionMessages, BUFFERS_DIR, PERMISSION_MODES, execFileSync, hosts, accounts, sessionAuth, serverSetting, paused: (kind) => mountHealth.paused(kind), stoppedSessions });
// ── Channels / communication panel (src/server/channels-wiring.js) ──
const channelsWiring = require('./src/server/channels-wiring.js').create({
  app, dataDir: path.join(__dirname, 'data'), bcastAll: (...a) => bcastAll(...a), integrations: integrationsWiring.store, getMounts: () => mounts, decisionEngine, // lanes decision-attention + decision-rule: the judged rows and the decision rule's pre-judge ask THE decisions caller // 2.369.195: a storage mount's own OAuth client, borrowed by an account (server-side copy)
  userTodos, readUserState: () => persistenceRouter.readUserState(), convIndex: () => hosts && hosts.convIndex, // lane pair-group-fate: the archived list the groups' liveness reads (+ r2: which machine owns a conversation — another's is never gone) · P1: a failing adapter files ONE "For you" item after 3 consecutive failed passes and the same engine retracts it on recovery (fence 8)
  onGroupsPending: () => { try { stashView.changed(); } catch { } }, // lane group-report-card: a post / a marker / a membership change moves what waits for a member — the strip above its composer re-publishes (debounced)
  deliver, serverSetting, authEnabled: () => auth.enabled, publicUrl: () => instanceUrl.url(), sessions: () => activeSessions, sessionMeta: () => ({ readSessionMeta, writeSessionMeta }), // §26 (B-099e): the channel witness's ring lives on the live session + its meta · P2: THE delivery ladder (fence 2 — the one door to an unattended turn, spendReason 'channel-message', the authorizer inside it) + the coalescing window setting (fence 12) · r2: `authEnabled` — with auth OFF the owner's group routes are paced like an agent's (anyone local can reach them)
  liveSessions: () => { const out = []; for (const [id, s] of activeSessions) { const cid = addressableId(s); /* verify r5 (channel-withdraw): a BORROWED id (a pending fork) is nobody's address — listed under its parent's id it let a third session mint the pair under the parent and bill it; ONE predicate with agent-routes' _msgEndpoints */ if (!cid) continue; let groups = []; try { groups = (tasks.groupsForSession({ sessionKey: sessionStatusKey(s, id), cwd: s.cwd, initialGroupId: s._initialGroupId, initialGroupIds: s._initialGroupIds }) || []).map((g) => g.id); } catch { } out.push({ cid, name: s.name || null, groups, webuiId: id, reachability: s._msgReachability || null }); } return out; }, groupSetting: (gid) => { try { return grants.rowsFor('group-visibility', String(gid)); } catch { return []; } }, /* lane grants-unify: the group's visibility ROWS (msg-acl judges them — a member left out is not exposed) */ // P2: the agent sessions an assignment can address (group = task group, round-robin over its live members); §22 agent groups: + each session's msg-acl override and the Task Groups' externalVisibility = the reach msg-acl answers
});
// Backend readiness for onboarding (src/server/backend-status-route.js)
require('./src/server/backend-status-route.js').create({ app, machineProbes, accounts, claudeCmd: CLAUDE_CMD, codexCmd: CODEX_CMD, cliCmds }); require('./src/server/oat-file-sync.js').start({ accounts, machineProbes, claudeCmd: CLAUDE_CMD, onCliVersion: require('./src/server/cli-registration.js').mount(app, { dataDir: path.join(__dirname, 'data'), rootDir: __dirname, claudeCmd: () => cliCmds.current('claude') || CLAUDE_CMD }).noteHub }); // lane pool-oat-materialize: the spawned claude's --version gates a member's long-lived token in its folder (cli-caps oatInFile) + the sweep for logins that die after a mint; the same tick tells src/server/cli-registration.js the build (lane cli-2-1-308-records: an unregistered one is said ONCE + its record draft)

app.use(sessionsRouter);

// ── Usage / Rate Limit ──
// Usage / rate limits read NON-INVASIVELY from the OAuth token store. Cached,
// refreshed every ~5 min. See _fetchOAuthUsage below for the why.
// ── Usage / Rate Limit ── (extracted to src/usage-routes.js in the 2.92.0 split)
const { setupUsage } = require('./src/usage-routes');
const usage = setupUsage({ app, accounts, hosts, usageHistory, activeSessions, serverSetting, ensureDir, USAGE_CACHE_FILE, USAGE_CACHE_DIR, CODEX_SESSIONS_DIR, META_DIR, AVAILABLE_MODELS, BUFFERS_DIR, apiDerivedWindow, establishedWindows, repairIdentityAnchors, probeUsageForAccountKey, onMemberReadingFresh, CLAUDE_CMD });

// ── auto-cli quota refresh loop (2.329.0; src/server/auto-cli-loop.js since
// quota r2 — its pacing state persists in data/auto-cli-state.json). One
// `claude -p /usage` spawn per 60 s tick at most, burn-aware, never a cadence.
require('./src/server/auto-cli-loop.js').createAutoCliLoop({ serverSetting, accounts, autoCliReady, memberServeLapsed, USAGE_CACHE_DIR, usageIdentityGroupsCached, usageEstimator, projectionRereadFor, projectionBillingIndex, lastMemberReadAt, usage, onMemberReadingFresh, dataDir: path.join(__dirname, 'data') }).start();
// Normalizer-level settings reads (chat.hideEmptyHooks) go through the REAL store
MessageManager.getSetting = (k) => { try { return serverSetting(k); } catch { return undefined; } };
const { getOAuthToken, usagePollingEnabled, summarizeCodexRateLimit, summarizeCodexRateLimits } = usage;
app.locals.harnessAvailability = harnessAvailability; app.get('/api/available-models', (req, res) => { // S8: /api/home reads harnessAvailability (installed ACP harnesses for the picker)
  refreshHarnessModels(); // mtime-guarded local reads — stay current despite old-CLI cache rewrites
  res.json(AVAILABLE_MODELS);
});
app.get('/api/session-options', (req, res) => { // ?backend=<id>[&model=]: each harness's OWN effort levels + extras (src/harness-efforts.js) — never claude's ultracode for another backend (lane effort-menu-per-harness)
  res.json(require('./src/harness-efforts.js').sessionOptionsAnswer(req.query, { harnessOf: (id) => require('./src/harnesses').get(id), cliLevels: EFFORT_LEVELS, permissionModes: PERMISSION_MODES, catalog: AVAILABLE_MODELS }));
});

// ── WebSocket Terminal Handler (extracted to src/ws-handler.js) ──
const sendUserInput = require('./src/server/user-input.js').createUserInputSender({ activeSessions, adapterRegistry, BUFFERS_DIR, broadcastToSession, feedLive, autoResume, reattachLocalPty, ptyQuietSince, writeSessionInput, log: (...a) => console.log(...a) }).send; require('./src/routes/user-todos-reply.js').registerUserTodoReplyRoutes(app, { userTodos, activeSessions, sendUserInput, sessionStatusKey, reopen: (item, o) => inboxReopen.reopen(item, o) }); // THE typing path, ONE implementation: the ws chat-input case AND the For-you reply route (POST /api/user-todos/:id/reply, owner-only — design-user-inbox-reply D1)
const designEngine = require('./src/server/design-engine.js').create({ dataDir: path.join(__dirname, 'data'), rootDir: __dirname, activeSessions, getRemoteFs: () => remoteFs, getPublishedPages: () => publishedPages, getDeliver: () => deliver, sendUserInput, broadcastAll: (m) => bcastAll(m), broadcastToSession, log: (...a) => console.log(...a), serverSetting, onDesign: (d, extra) => require('./src/server/artifact-registry.js').noteDesign(d, extra) }); require('./src/routes/design.js').registerDesignRoutes(app, { design: designEngine, activeSessions, getJobs: jobsWiring.getJobs }); // THE DESIGN WINDOW (lane design-core, docs/design-design-window.md §3.3): the registry, one-op reads, the 2 s watch while a window looks, a comment → THE typing sender (else the stash), publish → published pages
const docEngine = require('./src/server/doc-engine.js').create({ activeSessions, getDeliver: () => deliver, sendUserInput, artifacts: require('./src/server/artifact-registry.js'), dataDir: path.join(__dirname, 'data'), log: (...a) => console.log(...a) }); require('./src/routes/doc.js').registerDocRoutes(app, { doc: docEngine }); // THE DOC WINDOW (lane doc-window): comments → THE typing sender (else the stash), a save → the registry's row (by: user) + the owner's next-turn note (src/server/artifact-registry.js — configured below)
{ const { turnDigest } = require('./src/server/turn-facts.js'); let lastTurns = ''; setInterval(() => { const d = turnDigest(activeSessions); if (d !== lastTurns) { lastTurns = d; broadcastActiveSessions(); } }, 1000).unref(); } // the payload's `turn` column ('running'|'idle'|'waiting' — the inbox's running dot; carried, never gating) is DERIVED: one 1 s digest over _isStreaming/_turnState, a list broadcast only when it moved — never a hook at the nine flip sites (design-user-inbox-reply D1.7)
const { registerWsHandler, noConvoRef, pickCodexThreadCandidate } = require('./src/ws-handler');
const wsApi = registerWsHandler(wss, {
  poolChooser: poolChooserForModel,
  sbNoteServerOp,
  otelEnv: otelIngest.envFor,
  agentdRemote: { ensureAgentdOnHost, agentdHostToken, lockedWhy: (id) => hostTokens.lockedWhy(id), agentdDir: AGENTD_DIR, attachBundle: path.join(__dirname, 'data', 'bin', 'vibespace-agentd-attach.js') },
  dialBridge,
  activeSessions, WS_OPEN, broadcastActiveSessions, broadcastToSession, resizeSessionToMin,
  setupSessionPty, reattachLocalPty, ptyQuietSince, refreshWebuiPids, deleteSessionMeta, writeSessionMeta, readSessionMeta, autoResume,
  readLayouts, writeLayouts, getSyncStore, serverSetting, integrationEnabled,
  harnessSetting, harnessDeclares, harnessSpawnSettings, cliConfigPlanB64, ownerWriteRefusal: refuseOwnerWrite, // harness settings (design-harness-settings §5/§6)
  sessionCounterRef, createSessionMessages,
  SOCKETS_DIR, BUFFERS_DIR, PTY_WRAPPER, CHAT_WRAPPER,
  NODE_CMD, DTACH_CMD, CLAUDE_CMD, EDITOR_CMD, AGENT_BIN_DIR, PORT, X_ENV, cliCmds,
  adapterRegistry, pty, path, fs, os, execFileSync, ensureDir, hosts,
  accounts, scheduleCtxSync, activeSessionsPayload, serverNotice,
  getExitProxy: () => { try { return exitProxy; } catch { return null; } }, // verify-r2 A3-r2 / ask-a: the kill path ends a dead conversation's pairs + asks
  USAGE_STATUSLINE_CMD, userStatuslineCmd, telemetry, sendUserInput, getDesign: () => designEngine, setCustomName: (k, n) => persistenceRouter.setCustomName(k, n), /* lane peer-card-sender: rename-session → customNames */ // getDesign = the Design window's watch (design-watch / design-unwatch); telemetry: the ws switch's `default:` counts unknown message types (Plugin Ph1); sendUserInput = THE typing path (src/server/user-input.js), shared with the For-you reply route
});
const inboxReopen = require('./src/server/inbox-reopen.js').create({ getOpenConversation: () => wsApi && wsApi.convOps && wsApi.convOps.openConversation, activeSessions, readUserState: () => persistenceRouter.readUserState(), discover: async (key) => (((await require('./src/routes/sessions').warmSessions()) || {}).sessions || []).find((s) => s && s.sessionKey === key) || null, locate: (b, id, cwd) => { const h = require('./src/harnesses').get(b); return h && h.store && typeof h.store.locate === 'function' ? h.store.locate(id, cwd) : null; }, defaultsFor: (b) => ({ permission: harnessDeclares(b, 'defaultPermissionMode') ? String(harnessSetting(b, 'defaultPermissionMode') ?? '') : '', extraArgs: harnessDeclares(b, 'defaultExtraArgs') ? String(harnessSetting(b, 'defaultExtraArgs') ?? '') : '' }), taskFor: (key) => (tasks.list().find((g) => (g.sessions || []).includes(key)) || {}).id || null }); // a For-you reply to an ENDED conversation reopens it by the resume road (the ws create case, a headless creator) — lane inbox-reply-dead-session

// Billing identity for the card badge. Precedence: env-key spawn (definite) →
// the CLI's OWN init statement (apiKeySource: 'none'=subscription OAuth,
// '/login managed key'=console login=API billing, 'ANTHROPIC_API_KEY'=env) →
// spawn-time global-login guess (marked guessed) → unknown. This is what tells
// the user WHICH sessions still burn API money after they re-login to the
// subscription: env-key/console sessions keep their auth for their lifetime.
function sessionAuth(s) {
  const be = s.backend || 'claude';
  // A remote session's billing identity lives ON ITS MACHINE — qualify every
  // auth object with the host name so a "CLI login" badge names WHICH
  // machine's login it is (2.188.0: a remote host-login session rendered
  // byte-identical to a local one, and the tooltip pointed at the wrong box).
  const hostName = s.host ? (() => { try { return hosts.get(s.host)?.name || s.host; } catch { return s.host; } })() : null;
  const withHost = (o) => (o && hostName ? { ...o, hostName } : o);
  // POOLED pseudo-account (B-6217; codex pools 2.368.20): ONE shape for both backends — the pool + the real account it currently
  // bills, so no chip mislabels it (real reports: claude pools rendered as 'API key', codex pools as a plain 'ChatGPT account', no target).
  const poolAuth = (a) => { let cur = null, curId = null; try { curId = accounts.poolMemberOfSession(a.id, s, s._webuiId || null).id || null; cur = curId ? (accounts.get(curId)?.name || null) : null; } catch {} const prio = Array.isArray(a.priority) ? a.priority : []; const rank = curId ? prio.indexOf(curId) : -1; const pinId = s._poolPin && s._poolPin.memberId && s._accountId === a.id ? s._poolPin.memberId : null; return withHost({ source: 'pooled', name: a.name, poolTarget: cur, poolTargetId: curId, placement: pinId ? 'pinned' : prio.length ? 'priority' : 'automatic', priorityRank: rank >= 0 ? rank + 1 : null, pinned: pinId ? (accounts.get(pinId)?.name || pinId) : null, pinnedId: pinId, poolDefault: (() => { try { const d = accounts.poolCurrent(a.id); return d ? (accounts.get(d)?.name || d) : null; } catch { return null; } })() }); }; // 2026-09-28: WHICH rule placed it (the chip's tooltip — "(priority #1)" / "(automatic)") // plan C: THIS session's link target (claude), else the pool default — a non-hot pool process: the member it HOLDS (reset credits r3)
  // THE HARNESS answers (descriptor billingIdentity — claude.js / codex.js own their
  // rungs); a harness that declares none bills nothing (shell terminals, ACP agents).
  let h = null; try { h = require('./src/harnesses').get(be); } catch { }
  return h && typeof h.billingIdentity === 'function' ? h.billingIdentity(s, { accounts, withHost, poolAuth }) : null;
}

// THE single active-sessions payload builder — used by every broadcast AND the
// per-connection initial snapshot (ws-handler). A second hardcoded field list
// anywhere means new fields silently vanish for freshly-(re)connected clients
// until the next organic broadcast (bit us twice: host badges, then auth/todo).
function activeSessionsPayload() {
  try { require('./src/server/unexpected-exit').healResumed(); } catch (e) { console.warn('[unexpected-exit] heal pass failed:', e.message); } // lane exit-item-heal: a live session new to the list answers its conversation's "resume it" items (one pass per session; every create / resume / restore and a fresh client's first list pass through here)
  const getSessionKey = (session = {}) => {
    const backend = session.backend || 'claude';
    const backendSessionId = session.backendSessionId || session.sessionId || session.claudeSessionId || null;
    return backendSessionId ? `${backend}:${backendSessionId}` : '';
  };
  const activeList = [];
  for (const [id, s] of activeSessions) {
    // Exclude tmux view sessions — they shouldn't appear as separate "live" entries
    if (s.isTmuxView) continue;
    activeList.push({
      id,
      name: s.name, nameExplicit: !!s._nameExplicit, purpose: s._purpose || undefined, // nameExplicit (lane peer-card-sender): a name given at creation / by a rename — it outranks the first message on the card; purpose (lane door-day-one-landing): 'sign-in' — a sign-in terminal, no sidebar row
      cwd: s.cwd,
      host: s.host || null,
      hostName: s.hostName || null,
      // transport truth for the card (2.219.1): a remote session whose local
      // wrapper is alive but whose HOST is unreachable used to show a plain
      // LIVE card — user read it as "conversable" while every input queued
      remoteState: s._vaultWait ? 'vault-locked' : (s._remoteState && s._remoteState.state !== 'connected') ? s._remoteState.state : null,   // r2: waiting for the vault (a state)
      createdAt: s.createdAt,
      backend: s.backend || 'claude',
      backendSessionId: s.backendSessionId || s.claudeSessionId || null,
      sessionKey: getSessionKey(s),
      claudeSessionId: s.claudeSessionId || null,
      sourceKind: s.sourceKind || null,
      agentKind: s.agentKind || 'primary',
      agentRole: s.agentRole || '',
      agentNickname: s.agentNickname || '',
      parentThreadId: s.parentThreadId || null,
      // Billing identity badge: which account this session's env was spawned
      // with (null = the CLI's global login / subscription).
      accountId: s._accountId || null,
      accountName: s._accountId ? (accounts.get(s._accountId)?.name || 'API key') : null,
      accountTail: s._accountId ? (accounts.get(s._accountId)?.tail || null) : null,
      todo: s._todos || null, autoAllowed: s._autoAllowed || 0, // {done, total, current} — the agent's own TodoWrite/plan
      poolPin: poolPinFactOf(s), // THE CONVERSATION'S PIN (2026-09-28): the billing submenu's ✓ "pinned" row + Session Properties
      stash: stashFactOf(s), // 2026-09-27: what waits for this agent's next turn (both stashes, src/stash-summary.js) — the strip above its composer + the card's hint
      auth: sessionAuth(s), // billing identity (subscription / api-console / api-key / unknown)
      // outputStyle = the EFFECTIVE style (2.369.58; null = the agent's own config decides); worktree/worktreePath = the per-session git worktree (owner ruling 9) — the card badge + the path the CLI ITSELF announced in its init frame
      cliTitle: s._cliTitle || null, vcs: s._vcs || null, prLinks: Array.isArray(s._prLinks) && s._prLinks.length ? s._prLinks : null, // lane session-title-record: cliTitle = the CLI's own title (the name ladder's middle rung) · design-unknown-records: the last VCS fact (git chip) + the published changes (PR chips)
      turn: require('./src/server/turn-facts.js').turnOf(s), mode: s.mode || 'terminal', outputStyle: s._outputStyle || null, worktree: !!s._worktree, worktreePath: s._worktreePath || null, spawnModel: s._spawnModel || null, effort: s._effort || null, modelOrigin: s._modelOrigin || null, effortOrigin: s._effortOrigin || null, browserKey: s._browserKey || null, browserVariant: s._browserVariant || null, browserProfileId: s._browserProfileId || null, browserPinOrigin: s._browserPinOrigin || null, browserProfileActive: s._browserProfileActive === undefined ? null : s._browserProfileActive, browserCap: Number.isInteger(s._browserCap) ? s._browserCap : null /* MULTIVIEW D4: the conversation's EXPLICIT browser cap (null = the default) — Session Properties' row; the comment sits BEFORE the comma so the next key follows a `,` (test-worktree-userchan-ui's payload census) */, browserInput: (() => { try { const v = browserKeeper?.inputSummaryFor?.(s._browserKey); return v ? v.input : null; } catch { return null; } })(), browserLive: (() => { try { return browserKeeper?.liveHoldingFor?.(s._browserKey, s._browserProfileActive === undefined ? null : s._browserProfileActive) || ''; } catch { return ''; } })(), browserFact: (() => { try { return s._browserKey && browserKeeper?.factFor ? browserKeeper.factFor(require('./src/browser-fact.js').sessionFactsOf(s)) : (browserKeys?.keylessFactOf?.(s) || null); } catch { return null; } })(), /* B-f7ab: no key yet ⇒ "no browser yet" where its first browser command gets one */ /* lane S2: THE browser fact — which browser this conversation uses NOW, its pin and why they differ (src/browser-fact.js); every surface prints its words */ // lane H: the LIVE browser the agent holds ('' / 'ephemeral' / a profile id) — the card + status chip // + agent browser P3 (§4.3): 'user' while somebody drives one of this conversation's browsers, 'agent' when it has one, null when none — the card badge / status-bar chip // + agent browser P2 (§3.8 ③): the profile the agent LAST USED (null = never, '' = the ephemeral one) beside the PINNED one — the status-bar Browser chip's pair, each with its own LIVE_SESSION_FACTS digest // + agent browser P1 (§3.2.5): the conversation's browser key/rung, the PINNED profile and which rung chose it (Session Properties' Browser section, the card picker) // EFFECTIVE response style (2.369.58) + the model/effort this session was SPAWNED with and WHICH FACT each came from (B-6b6d: 'chosen'|'conversation'|'instance'|'harness'). null = the agent's own config decides / a session that predates the field. Session Properties names value AND origin, which neither the saved PICK nor the value itself can give it — a conversation's own value and the instance default are frequently the same string, and only the server ever read the conversation's records
    });
  }
  return activeList;
}

function broadcastActiveSessions() { try { channelsWiring.groups.noteRoster(); } catch {} try { convOps.settleBirthGroups(); } catch { } // r3: the session list's ONE notify point — a renamed/ended member re-announces its groups (their views' names are live-roster derived; nothing moved ⇒ nothing sent); lane open-task-binds: a conversation opened INTO a Task Group joins its sessions[] once its own id is adopted (every adoption broadcasts; before convOps exists a caught TDZ)
  try { exitProxy.rejudgeAll('sessions'); } catch { } try { require('./src/server/local-index.js').note('sessions'); } catch { } // lane human-cli: the person's session index (src/server/local-index.js, the ONE writer) rides this ONE notify point · verify-r3 census: a session's own reach facts moved (a fork adopting its id, a codex / ACP thread change, its cwd under the folder rule) — every such writer broadcasts, so the exit re-judge rides this ONE notify point (a boot-time call before exitProxy exists is a caught TDZ)
  const msg = JSON.stringify({ type: 'active-sessions', sessions: activeSessionsPayload() });
  wss.clients.forEach(client => {
    if (client.readyState === WS_OPEN) {
      try { client.send(msg); } catch {}
    }
  });
}

// ── Desktop apps + the in-container desktop: ONE keeper, ONE ws bridge, one route family
// (docs/design-desktop-apps.zh.md §2 — src/server/desktop-app-keeper.js · desktop-stream.js ·
// src/routes/desktop-apps.js; the singleton desktop src/vnc.js is stream id DESKTOP_SINGLETON_ID
// on the same bridge, so /api/vnc and /api/desktop/<id>/stream are one relay, not twins) ──
const { VncManager } = require('./src/vnc');
const { DESKTOP_SINGLETON_ID } = require('./src/desktop-apps');
const vnc = new VncManager({ dataDir: path.join(__dirname, 'data'), stopOnShutdown: throwawayRoot }); // a throwaway server stops the Xvnc IT started at shutdown; an installed one's desktop outlives a restart (src/vnc.js)
const desktopKeeper = require('./src/server/desktop-app-keeper.js').create({
  dataDir: path.join(__dirname, 'data'), env: () => require('./src/ws-handler').agentEnv(), broadcast: (m) => bcastAll(m),
  serverSetting: (k) => serverSetting(k), getTelemetry: () => { try { return telemetry; } catch { return null; } }, singleton: () => vnc.singletonFacts(),
  serverNotice: (...a) => serverNotice(...a), getUserTodos: () => { try { return userTodos; } catch { return null; } }, // 2026-09-25: the ONE report per resource crossing (the keeper never stops an app for a resource)
  access: () => desktopAccess, hostLabel: (h) => { try { return hosts.get(h).name || h; } catch { return h; } }, // lane C2: a paired machine's apps (late-bound — the access layer needs this keeper's machine half)
  remoteHosts: () => { try { return hosts.list().filter((h) => (h.transport === 'dial' ? h.online : h.dialLive)).map((h) => h.id); } catch { return []; } }, // boot: every dialed-in machine is asked what it runs
});
const desktopAccess = require('./src/server/desktop-access.js').create({ hosts, local: () => desktopKeeper.machine, env: () => require('./src/ws-handler').agentEnv(), log: console, audit: (line) => { try { return exitProxy.audit(line); } catch { return null; } }, installedStore: () => desktopKeeper, integrations: integrationsWiring.store, dataDir: path.join(__dirname, 'data'), broadcast: (m) => bcastAll(m) }); // lane remoteapp-r1b: a RemoteApp's sealed sign-in; lane desktop-picker-instant: the machine rows' last known state + its broadcast row // lane C1 (design-desktop-apps-seamless §3.5): the ONE transport to an app's machine — device #0 in-process against the keeper's OWN machine half, a paired device / an ssh host (its daemon installed over ssh) through the `desktop-serve` agentd op, a handle that cannot run the op refused host_needs_daemon
const appsWiring = require('./src/server/apps-wiring.js').install({ app, access: desktopAccess, userTodos, deliver, activeSessions: () => activeSessions, sessionStatusKey, broadcast: (m) => bcastAll(m), dataDir: path.join(__dirname, 'data'), log: console, throwawayRoot }); // Layer 0 apps (docs/design-app-persistence.zh.md §3.1): the user's door + an agent's proposals over the machine's ONE package slot; the rebuilt machine's replay runs after listen
require('./src/server/artifact-registry.js').configure({ activeSessions: () => activeSessions, deliver, sessionMeta: () => ({ readSessionMeta, writeSessionMeta }), pages: () => publishedPages, designs: () => designEngine, jobs: jobsWiring.getJobs, ports: () => portForwards, instanceUrl, toSession: (s, sid, m) => broadcastToSession(s, sid, m), log: console }).mount(app); require('./src/server/search-index.js').wire({ app, rootDir: __dirname, activeSessions, buffersDir: BUFFERS_DIR }); // lane global-search: the search index (its routes + the backfill, 60 s after boot); lane artifacts-model: the deliverable rows' registry (ownerOf / noteEdit — the doc-window contract)
// P9 window targets (design-agent-browser-v2 §4.9 / §6.6): ONE wiring — the RFB bridge's input policy IS the engine's lease verdict, the routes (user + agent) and the shared handback announcer ride the same engine (src/server/window-live-wiring.js)
const { desktopStream, windowEngine, boot: bootWindowLeases, shutdown: shutdownWindowLeases } = require('./src/server/window-live-wiring.js').install({
  app, auth, vnc, keeper: desktopKeeper, DESKTOP_SINGLETON_ID, dataDir: path.join(__dirname, 'data'), env: () => require('./src/ws-handler').agentEnv(), activeSessions: () => activeSessions, serverSetting: (k) => serverSetting(k), broadcast: (m) => bcastAll(m), browserHandback,
  netemEnabled: process.env.VIBESPACE_DESKTOP_NETEM === '1', access: desktopAccess, deliver, browserStream, groupsOf: (s, id) => tasks.groupsForSession({ sessionKey: sessionStatusKey(s, id), cwd: s.cwd, initialGroupId: s._initialGroupId, initialGroupIds: s._initialGroupIds }).map((g) => g.id) }); // P8-2 D21 (c) validation slice: a dev-only latency/bit-rate injector on the xpra relay, never on by default; lane E: the gated ladder (the window request's wake) + Task Group membership asked at verb time (reach)
desktopKeeper.adoptAll().then(() => desktopKeeper.start()).catch((e) => console.warn('[desktop] boot adoption failed:', e.message)); browserKeeper?.setOtherHolders?.(() => desktopKeeper.liveRecords().filter((r) => !require('./src/desktop-apps').isDisplayForBrowser(r)).map((r) => ({ id: r.id, label: r.label || r.appId || r.id, kind: 'desktop-app' }))); browserKeeper?.setDisplaySessions?.(desktopKeeper); // takeover C3 (D2): the ONE ceiling (CONCURRENT_CAP) counts the live desktop apps beside every browser (lane one-browser-b1: never a browser's own display session — that browser is counted); the attach road's display sessions are the desktop keeper's
const agentdDialWss = new WebSocketServer({ noServer: true }); // Transport B dial-in (2.144.0)

// ── Start Server ──
// THE single WebSocket upgrade dispatcher: /ws (main app), /proxy/ (unblocker
// site WebSockets), /api/vnc + /api/desktop/<id>/stream (the desktop bridge). Everything else is destroyed.
hub.attachToServers('upgrade', (req, socket, head) => { // BOTH servers (http + the https one, src/server/tls.js) — never server.on (§89)
  const pathname = (req.url || '').split('?')[0];
  const deny = () => { socket.write('HTTP/1.1 401 Unauthorized\r\n\r\n'); socket.destroy(); };
  if (pathname === '/ws') {
    if (!auth.requestAuthed(req)) return deny();
    wss.handleUpgrade(req, socket, head, (ws) => wss.emit('connection', ws, req));
  } else if (pathname.startsWith('/proxy/')) {
    if (!auth.requestAuthed(req)) return deny();
    unblocker.onUpgrade(req, socket, head);
  } else if (desktopStream.upgradeId(pathname)) {
    // /api/vnc (the singleton desktop) + /api/desktop/<id>/stream: ONE bridge, cookie auth checked inside
    desktopStream.handleUpgrade(req, socket, head, desktopStream.upgradeId(pathname));
  } else if (pathname === '/api/browser/stream' && browserStream) { browserStream.handleUpgrade(req, socket, head); // agent browser P2 (§4.2): cookie auth INSIDE (401) — the live view's bridge to a session's loopback stream server
  } else if (pathname.startsWith('/svc/')) {
    // path-mounted service WebSockets — auth is PER MOUNT inside path-mounts
    // (2.359.0 public mounts; private ones 401 there)
    pathMounts.handleUpgrade(req, socket, head);
  } else if (pathname === '/api/device-dial' || pathname === '/api/agentd-dial') {
    // /api/device-dial is the name new pairing commands render;
    // /api/agentd-dial stays FOREVER — in-field daemons hold it in dial.json
    // Transport B: a remote device's daemon dialing IN. Gated by the per-device
    // dial token (never cookie auth — daemons have no cookies); real protocol
    // auth (vsht_ hello) happens inside the mux on this stream.
    // lane-pairing ③⑤ (src/server/dial-pairing.js gateDialUpgrade): a refusal is a NAMED frame (401 + the code +
    // its sentence), a --dial-check probe gets its 200 and registers nothing, every attempt's facts are recorded
    const gate = gateDialUpgrade(req, socket);
    if (!gate) return;
    const { deviceId } = gate;
    // verify-r1 B9: a SECOND daemon holding a copy of this pairing is refused by name while the first answers
    // (two daemons replaced each other once a second forever); the socket waits ≤ DUP_PROBE_MS for that verdict
    admitDial(deviceId, gate.facts, socket).then((admit) => { if (!admit) return;
    agentdDialWss.handleUpgrade(req, socket, head, (ws) => {
      // adapt the ws to the duplex shape Mux consumes
      const listeners = { data: [], close: [], error: [] };
      ws.on('message', (d) => listeners.data.forEach((f) => f(Buffer.isBuffer(d) ? d : Buffer.from(d))));
      ws.on('close', () => listeners.close.forEach((f) => f()));
      ws.on('error', () => listeners.error.forEach((f) => f()));
      const stream = {
        write: (d) => { try { ws.send(d); return true; } catch { return false; } },
        on: (ev, fn) => { listeners[ev]?.push(fn); },
        destroy: () => { try { ws.close(); } catch { } },
      };
      agentdDials.set(deviceId, stream);
      noteDialEvent(deviceId, 'accepted', gate.facts); // the streak + previous failure the daemon reported, kept on the record
      deviceForDial(deviceId).catch(() => { }); // the mux hello NOW: a device holding another command's host key shows `auth-fail` at once, not at the first op
      // the device re-dialed with a FRESH stream — drop any cached
      // DeviceManager bound to the previous (dead) stream so the next op
      // rebuilds over this one (stale-stream blank-session fix)
      try { const old = agentdDialDevices.get(deviceId); if (old && old._dialStream !== stream) { old.stop?.(); agentdDialDevices.delete(deviceId); } } catch { }
      try { hosts.invalidateDevice?.('host-dial-' + String(deviceId).replace(/[^\w-]/g, '')); } catch { }
      try { hosts.onDialIn?.(deviceId); } catch { } // graduated ssh host: prefer this fresh dial link (B-6640)
      console.log(`[device] device '${deviceId}' dialed in`);
      // heal recorded pull mounts + re-own push tunnel ports + flip the UI dot
      try { machineMounts.onMachineLinked(hosts.findByDeviceId(deviceId)?.id); } catch { }
      try { portForwards.onMachineLinked(hosts.findByDeviceId(deviceId)?.id); } catch { }
      // Re-own each live dial session's VIBESPACE_API back-tunnel (audit #49):
      // the per-session reverse listener existed only in the DEAD link's
      // DeviceManager — mounts/port-forwards heal from persisted records on
      // dial-in, sessions had none, so vibespace-status/task/ask + remote
      // Ctrl+G went connection-refused forever after any re-dial or server
      // restart while the session kept chatting fine (nothing surfaced it).
      // The daemon's reverseListen `existing` branch re-owns a still-bound
      // port; a reaped one (>10min offline) rebinds at the same number.
      (async () => {
        const netR = require('net');
        for (const [, s] of activeSessions) {
          if (s._dialDeviceId !== deviceId || !s._dialReversePort) continue;
          try {
            const dm = await deviceForDial(deviceId);
            await dm.reverseForward({ port: s._dialReversePort, connectLocal: () => netR.connect(PORT, '127.0.0.1') });
          } catch (e) { console.warn(`[device] session back-tunnel re-own failed (${s._dialReversePort}):`, e.message); }
        }
      })().catch(() => { });
      try { bcastAll({ type: 'hosts-updated' }); } catch { }
      ws.on('close', () => {
        if (agentdDials.get(deviceId) === stream) { agentdDials.delete(deviceId); noteDialEvent(deviceId, 'disconnected', {}); }
        try { bcastAll({ type: 'hosts-updated' }); } catch { }
      });
    });
    }).catch((e) => { console.warn('[device] dial admission failed:', e && e.message); try { socket.destroy(); } catch { } });
  } else {
    socket.destroy();
  }
});

// ── Ops routes (src/server/ops-routes.js, decomposition #11): version/update/maintenance ──
const bootPhase = require('./src/server/boot-phase.js').create({ sessionsCount: () => activeSessions.size, record: (ev) => telemetry.record(ev), testHoldMs: Number(process.env.VIBESPACE_TEST_BOOT_HOLD_MS) || 0 }), bootRestored = bootPhase.step('restore'), bootSessionsIndexed = bootPhase.step('sessions-index'); // B-0ece (src/server/boot-phase.js): `booting` → `ready` once the steps the first page needs are done
const { versionInfo, maintState,
} = require('./src/server/ops-routes.js').create({ app, rootDir: __dirname, wss, WS_OPEN, bootPhase });
// ── Prometheus /metrics exporter (opt-in, generic): a SEPARATE listener on
// VIBESPACE_METRICS_PORT, meant for in-cluster scrapes via pod annotations —
// it is never routed through the app ingress/auth, so keep the port un-exposed
// in any public deployment. Hand-rolled text exposition, no dependencies.
const METRICS_PORT = Number(process.env.VIBESPACE_METRICS_PORT || 0);
if (METRICS_PORT > 0) {
  const metricsStarted = Date.now();
  const pkgVersion = (() => { try { return require('./package.json').version; } catch { return ''; } })();
  http.createServer((mreq, mres) => {
    if (!String(mreq.url).startsWith('/metrics')) { mres.writeHead(404); return mres.end(); }
    let watchers = 0, normMsgs = 0;
    try { for (const [, sess] of activeSessions) { watchers += sess.subagentWatchers?.size || 0; normMsgs += sess._normalizer?.total || 0; } } catch {}
    const mu = process.memoryUsage();
    const L = [];
    const g = (name, val, help) => { L.push(`# HELP ${name} ${help}`, `# TYPE ${name} gauge`, `${name} ${val}`); };
    g('vibespace_process_resident_memory_bytes', mu.rss, 'Server process RSS');
    g('vibespace_nodejs_heap_used_bytes', mu.heapUsed, 'V8 heap used');
    g('vibespace_nodejs_heap_total_bytes', mu.heapTotal, 'V8 heap total');
    g('vibespace_live_sessions', activeSessions.size, 'Active (webui-managed) sessions');
    g('vibespace_ws_clients', (typeof wss !== 'undefined' && wss.clients) ? wss.clients.size : 0, 'Connected WebSocket clients');
    g('vibespace_subagent_watchers', watchers, 'Live subagent fs watchers (leak canary)');
    g('vibespace_normalizer_messages', normMsgs, 'Normalized messages held in memory (leak canary)');
    g('vibespace_uptime_seconds', Math.round((Date.now() - metricsStarted) / 1000), 'Server uptime');
    L.push('# HELP vibespace_info Build info', '# TYPE vibespace_info gauge', `vibespace_info{version="${pkgVersion}"} 1`);
    mres.writeHead(200, { 'Content-Type': 'text/plain; version=0.0.4' });
    mres.end(L.join('\n') + '\n');
  }).listen(METRICS_PORT, () => console.log(`  metrics exporter on :${METRICS_PORT}`));
}

probeSockets().finally(() => hub.listen(PORT, HOST, () => { bootTrace.listening(); // B-1319: after the restore's probes (boot-restore probeSockets) — the one-port demux (src/server/tls.js) — listen errors / EADDRINUSE as before
  const ver = require('./package.json').version;
  console.log(`\n  VibeSpace v${ver} running at http://localhost:${PORT}${hub.bootSuffix()}`); hub.start(); try { require('./src/server/local-index.js').configure({ rootDir: __dirname, port: PORT, host: HOST, version: ver, owner: (() => { try { return ownerWriteRefusal(); } catch { return { kind: 'unknown' }; } })(), adapters: adapterRegistry, sessions: () => activeSessions, buffersDir: BUFFERS_DIR, dataDir: path.join(__dirname, 'data'), turnOf: (s) => require('./src/server/turn-facts.js').turnOf(s), log: console }); } catch (e) { console.warn('[local-index] not started: ' + e.message); } // lane human-cli: the person's CLI index on the machine's own disk · + " and https://<domain>:PORT" while a certificate is live; start = the boot pass + hourly
  // PID file for the supervised-restart path (scripts/update.sh in a container:
  // no systemd — the entrypoint respawn loop restarts us when update.sh kills
  // this pid; dtach sessions live in the same PID namespace and survive).
  try { fs.writeFileSync(path.join(__dirname, 'data', 'server.pid'), String(process.pid)); } catch {}
  setTimeout(() => jobsWiring.initAfterListen(), 1500); setTimeout(() => appsWiring.afterListen(), 2500); setTimeout(() => bootEngineDistribution(), 4000); memSampler.start(); // lane engine-distribution: the fleet's engine plugin (fleet.json browserEngine) — ONE async job, never on the boot path // Background Work engine: adopt-first, never blocks boot; Layer 0 apps: a rebuilt machine's apps put back (the replay marker hit = nothing)
  console.log(`  dtach: ${DTACH_CMD}, node: ${NODE_CMD}, claude: ${CLAUDE_CMD}, codex: ${CODEX_CMD}`);
  if (process.platform === 'linux') console.log(`  X display: ${X_ENV.DISPLAY || '(none)'}${X_ENV.XAUTHORITY ? ' (xauth: ' + X_ENV.XAUTHORITY + ')' : ''} — clipboard image paste ${X_ENV.probed ? 'ready' : 'UNAVAILABLE (no working X display found)'}`);

  // Local sessions run through the device daemon (machine #0) — GRADUATED,
  // no flag. Started here, but the boot restore below does NOT wait for it:
  // attachToDtach takes the daemon only on an ALREADY-live link (2.369.82), so
  // restored sessions attach LOCALLY while connect() is in flight; the onExit
  // re-attach ladder takes the daemon later. Any daemon failure = local pty.
  {
    try {
      const { DeviceManager } = require('./src/agentd/client.js');
      deviceMgr = new DeviceManager({
        dataDir: path.join(__dirname, 'data'),
        bundlePath: path.join(__dirname, 'data', 'bin', 'vibespace-agentd.js'),
        version: require('./package.json').version,
        nodeModules: path.join(__dirname, 'node_modules'),
        log: console.log,
        onUpgradeStuck: (from, to, info) => hosts.onAgentUpgrade?.('stuck', { ...(info || {}), hostKey: 'local', machine: os.hostname(), from, to }), onVersionMatch: (v) => hosts.onAgentUpgrade?.('matched', { hostKey: 'local', version: v }), onUpgradeRefused: (from, to, info) => hosts.onAgentUpgrade?.('refused', { ...(info || {}), hostKey: 'local', machine: os.hostname(), from, to }), onAct: (line) => hosts.noteAct('local', line), // lane device-upgrade-stuck (+ lane device-bundle-signing: `refused`): this machine's own daemon, the same door (no row); lane device-act-audit: its acts audited as `local`
      });
      // device #0 becomes reachable through hosts.device(null) — that is what
      // lets a consumer be written ONCE and run on ANY machine including this
      // one (CS separation, 2.276.0). Wired BEFORE connect so a consumer that
      // races startup gets the handle and awaits its connect like any other.
      try { hosts.setLocalDevice(deviceMgr); } catch { }
      deviceMgr.connect().then(() => console.log('  device-daemon: device session routing ENABLED')).catch((e) => {
        console.warn('  device-daemon: could not reach the daemon — local pty fallback:', e.message);
        deviceMgr = null; // fall back cleanly
        try { hosts.setLocalDevice(null); } catch { } // consumers fall back to their legacy local path
      });
    } catch (e) { console.warn('  device-daemon: init failed — local pty fallback:', e.message); deviceMgr = null; }
  }

  // Restore existing dtach sessions from before restart
  // One-shot data migrations (src/server/migrations.js, plan B step 1): the
  // ledger-driven registry runs BEFORE any session restore touches the data
  // it may reshape. Failures notice + retry next boot, never block startup.
  try { require('./src/server/migrations.js').create({ rootDir: __dirname, serverNotice, hosts /* lane-pairing ⑥: exit-access-lists reshapes THROUGH the live HostManager (it holds hosts.json and saves it whole) */, desktopKeeper, browserKeeper: () => browserKeeper /* 2026-09-25: the runaway-parks-void reshape goes THROUGH the live keepers */, channels: channelsWiring.channels /* 2026-09-22: adapters.json's ONE writer stamps the legacy credential keys */, userTodos /* 2.369.152: the LIVE inbox store — the spend-notices migration reshapes through it, never beside it */, accounts: () => accounts /* 2026-09-28: the pool manual-priority reshape goes THROUGH the live account store */, plugins /* lane plugin-settings-p0: plugins.json config → settings.json goes THROUGH the live PluginManager */, integrations: integrationsWiring.store /* lane llm-plugin-rename: the decision-api → llm row move goes THROUGH the live integration store */, grants /* lane grants-unify: 2026-10-grants-unify seeds THE grants store */, note: (l) => bootTrace.note(l) /* verify F2: a deleted store re-armed / grants_store_missing — ⚙ Diagnostics */, tasks /* lane task-group-context: the Context-table rows go THROUGH the live TaskGroupManager */, usageHistory /* lane ledger-dedup-law: the ledger dedup goes THROUGH the live ledger (its dedupShard: one job per shard, the cache rebuilt after) */ }).runLocalMigrations(); persistenceRouter.reloadSettings?.() /* settings-prune verify r1: settings-rows-retired rewrote settings.json after boot cached it */; usage.reloadRateLimitCache?.(); usageHistory.reloadCursors?.(); usageHistory.reloadEvents?.(); /* a repair may have unlinked data/usage-cache.json AFTER setupUsage loaded it (r6), or REWRITTEN the ledger shards in place (origin backfill) — the event cache reads only appended tails */ }
  catch (e) { console.warn('[migrate] local registry failed to run:', e.message); }
  // B-855a c2: the STANDING identity repair — every boot, AFTER the one-shot registry (it may have reshaped the stores this reads), idempotent; then the panel memory re-reads the repaired disk
  bootTrace.span('identity-repair', require('./src/reading-repair.js').prefetchAnchorRows(path.join(__dirname, 'data', 'usage-anchors')).then(() => { try { repairIdentityAnchors('boot'); usage.reloadRateLimitCache?.(); } catch (e) { console.warn('[usage] boot identity repair failed:', e.message); } })); // B-1319: its anchors read off the loop first
  // …and STANDING (final verifier): a weekly window that moved between boots must not wait for the next boot — hourly, idempotent, quiet unless it changed something, the panel memory re-read only then
  setInterval(() => { require('./src/reading-repair.js').prefetchAnchorRows(path.join(__dirname, 'data', 'usage-anchors')).then(() => { try { const rep = repairIdentityAnchors('hourly'); if (rep && rep.changed) usage.reloadRateLimitCache?.(); } catch (e) { console.warn('[usage] hourly identity repair failed:', e.message); } }); }, 3600e3).unref(); // …the hourly run too
  migrateLegacyHomeProjects();
  restoreSessions(); bootBrowserKeeper(); bootWindowLeases(); try { channelsWiring.groups.noteUserState(); } catch {} hooksLate.ready(); // hooksLate.ready() (lane hooks-create): the live-session set is final — a hook file the boot registration created is told to the sessions just restored. agent browser P1 (§3.5) + P9b window leases (the same rule: after the live-session set is final): leases reconciled + browsers adopted only AFTER the live-key set is final (async, logged, never blocks the boot — mounts-plugins-wiring)
  bootRestored(); require('./src/routes/sessions').warmSessions().catch((e) => console.warn('[boot] first sessions sweep failed:', e.message)).finally(bootSessionsIndexed); bootPhase.arm(); // B-0ece: pages reload onto `ready`, not onto `listening`
  try { fdGauge.bootLine({ sessions: [...activeSessions.values()].filter((x) => x.socketPath).length }); fdGauge.start(); } catch (e) { console.warn('[fd] gauge failed to start:', e.message); } // lane-dead-bridge: the limit node REALLY runs at + the estimate; refuses nothing
  setTimeout(() => { try { bridgeWatch.bootSweep(); bridgeWatch.start(); } catch (e) { console.warn('[bridge] boot sweep failed:', e.message); } }, 1500); // AFTER the restore's attaches connected: end a dead server's orphaned attach clients, then watch (lane-dead-bridge)
  // Plan C boot reconciliation: a per-session pool link whose session did not
  // survive the restart is a billing pointer nobody can see or move — unlink.
  try { const n = accounts.sweepSessionPoolLinks(new Set(activeSessions.keys())); if (n) console.log(`[pool] swept ${n} orphaned per-session link(s)`); } catch { }
  // B-1525 second half: consume the .orphan metas the dead-socket cleanup
  // preserved — remote keeper sessions whose claude is STILL ALIVE on its
  // host come back LIVE by themselves (no manual surgery). Runs even on a
  // zero-socket boot (the pod-recreation case restoreSessions early-returns
  // on); delayed off the boot critical path; probes are read-only ssh.
  setTimeout(() => { readoptOrphanKeeperSessions().catch((e) => console.warn('[readopt] failed:', e.message)); }, 8000);

  // Orphan sweep — AGE-BASED (2.89.1). The activeSessions-keyed sweep was a
  // real data-loss race: a live dtach session the restore didn't re-adopt
  // within 30s (or re-adopted under a different id after meta corruption) had
  // its buffer UNLINKED while the wrapper kept writing the deleted inode —
  // live streaming looked fine, but every restart rebuilt history without the
  // buffer ("重启之后消息就都没了", real incident). Dead buffers stop being
  // WRITTEN, so age is race-free by construction: only files untouched for
  // 7 days are ever deleted, and never for a currently-active session.
  setTimeout(() => {
    const cutoff = Date.now() - 7 * 86400000;
    // <id>.buf / <id>.json / <id>.json.<pid>.tmp (a wrapper killed between its sidecar temp and the rename, ci358-reds round 2) — src/server/wrapper-files.js
    let swept = require('./src/server/wrapper-files.js').sweepAgedWrapperFiles(BUFFERS_DIR, { cutoff, isActive: (id) => activeSessions.has(id) });
    // data/agentd/session-*.json attach configs (0600, vsht_ host token +
    // full spawn command) — the kill-path unlink needs the live session, so
    // pod recreation leaked one per dial/agentd session forever (audit
    // #16/#53). Same age rule: written once at create, so 7d + not-active is
    // race-free (active sessions are protected by the id check alone).
    try {
      for (const fn of fs.readdirSync(AGENTD_DIR)) {
        const m = fn.match(/^session-(.+)\.json$/);
        if (!m || activeSessions.has(m[1])) continue;
        try {
          const st = fs.statSync(path.join(AGENTD_DIR, fn));
          if (st.mtimeMs > cutoff) continue;
          fs.unlinkSync(path.join(AGENTD_DIR, fn)); swept++;
        } catch {}
      }
    } catch {}
    // data/chat-frames: the NEW wrapper unlinks after forwarding; a frame sent
    // to a pre-2.360.0 wrapper is orphaned forever (2.361.1 skew incident) —
    // age-based like everything else here, 48h is far past any redelivery use.
    try {
      const fdir = path.join(__dirname, 'data', 'chat-frames');
      const fcut = Date.now() - 48 * 3600 * 1000;
      for (const fn of fs.readdirSync(fdir)) {
        try { if (fs.statSync(path.join(fdir, fn)).mtimeMs < fcut) { fs.unlinkSync(path.join(fdir, fn)); swept++; } } catch {}
      }
    } catch {}
    if (swept) console.log(`  Swept ${swept} orphaned session-buffer/attach-cfg/chat-frame files (age-based)`);
  }, 30000);

  console.log(`  Ready.\n`);
}));

// On server shutdown: only kill the attach PTYs, NOT the dtach sessions
// Claude processes in dtach survive the server restart
let shuttingDown = false;
function shutdown() {
  if (shuttingDown) return;
  shuttingDown = true;
  // verify r2: a hand-over in flight settles FIRST (its frame may be in the CLI's inbox while its drain is not on disk — exiting here re-delivered it at the next boot); ≤ 5 s
  // verify r3: the door shuts BEFORE the wait — a press during it started a hand-over nobody waited for
  let n = 0, m = 0; try { stashView.close(); n = stashView.inFlightCount(); } catch { } try { deliver.closeRetries(); m = deliver.retryInFlightCount(); } catch { }   // notify-retry verify r1: the park's retry posts in flight settle too
  if (n > 0 || m > 0) { require('./src/server/exit-settle.js').settleInFlight({ stashView, deliver, n, m }).finally(shutdownNow); return; }
  shutdownNow();
}
function shutdownNow() {
  try { spendGuard.flush(); } catch {} try { require('./src/server/local-index.js').stop(); } catch {} // lane human-cli: the index says the hub STOPPED (a reader tells a clean stop from a crash) · the unattended-spend ledger FIRST (a debounced-only write would hand the next boot a fresh hour — the whole point of persisting it)
  bridgeWatch.endAttachPtys(); // THE teardown of every attach pty — shared with the crash path (lane-dead-bridge)
  // SyncStores + layouts persist on a debounce — flush so changes made within
  // the last couple seconds aren't lost across a restart
  for (const store of Object.values(syncStores)) { try { store.flush(); } catch {} }
  try { flushLayouts(); } catch {}
  try { sessionStatus.flush(); } catch {} // debounced session-status writes
  try { userTodos.flush(); } catch {} // debounced user-todo writes
  try { hosts.flushThrottled(); } catch {} // lane-pairing: the throttled dial facts + exit last-run stamps
  try { telemetry.flush(); } catch {} // buffered telemetry records (2.219.0)
  try { sysinfo.persistHistory(); } catch {} // resource-history ring (2.223.0)
  try { channelsWiring.shutdown(); } catch {} // channel index + audit flush (atomic persistence law)
  try { jobsWiring.shutdown(); try { deliver.flush(); } catch { }; } catch {} // jobs store flush + engine lock release
  try { vnc.shutdown(); } catch {} try { desktopKeeper.shutdown(); desktopAccess.shutdown(); shutdownWindowLeases(); } catch {} // vnc: a THROWAWAY server stops the Xvnc it started (never an adopted one; src/vnc.js) — keeper: timers only — desktop apps SURVIVE a restart by design (adopted at boot); window leases persist, their input side is a handback by construction
  try { browserTrace?.shutdown(); } catch {} try { browserDialogs?.shutdown(); } catch {} try { browserStream?.shutdown(); } catch {} try { browserHandback?.shutdown(); } catch {} try { browserKeeper?.shutdown(); } catch {} // agent browser P5 trace + screencast writers, P2 live-view bridge, P3 handback timers, P1 keeper timers only — the profile browsers survive and are adopted next boot
  process.exit(0);
}
process.on('SIGINT', () => {
  console.log('\n  Shutting down (dtach sessions will keep running)...');
  shutdown();
});
process.on('SIGTERM', shutdown); bootTrace.mainEnd(); // B-1319: the main-module evaluation ends here (the boot clock's mainMs)