v0.12.0 — Slack, one agent session per thread (+ @-mention switch) - #211

…the same sid

After `ccteam daemon restart`, a claude stream-json body that still has a
background task running (a run_in_background dev server, a watcher) does
not exit on stdin EOF: real claude 2.1.296 stays alive until that task
ends and then self-continues. The new daemon registers it DETACHED and
waits for it, which is unbounded, so every message to the sid queues
behind it forever. The receipt pointed at `/stop`, which ends the session:
it sets stopped_at, drops the chat's focus routes (the next message mints
a new sid) and strands the queued turns. The session looked permanently
lost.

`/interrupt` (IM and `POST /api/v1/sessions/{sid}/interrupt`) on a
detached sid now ends only that process. The DETACHED entry, the queue
and the focus routes stay, and the body watcher takes the same path it
takes for a body that exits on its own: it recovers what the body said,
rebuilds the sid with --resume (same context) and drains the queued
turns. The receipt names this way out, and the usage docs describe it.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…en back" from

When `<uuid>.jsonl` exists, start_thread resumed and, on any failure, fell
back to a fresh `--session-id <uuid>` on the SAME uuid. Real claude refuses
that ("Session ID … is already in use", exit 1), so the fallback could never
start. It turned one failed resume into a second failure, and it logged a
chat_session_reset claiming the context was lost when the transcript was
intact.

The local arm now returns the resume failure itself, as a readable,
retryable error. Nothing sticks: the transcript is untouched, the killed
handshake child's body record is cleared (so the next spawn does not
post-mortem a turn that never ran), and the next message tries --resume
again. The remote fallback stays: there the transcript's existence is only
a guess.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A detached body was waited for until it exited, and real claude stays
alive after stdin EOF for as long as a background task it started is
running. A session nobody steered by hand (a delegated child, a
scheduled run, an unwatched chat) stayed stuck behind it, with every
turn queued and none delivered.

The body watcher now ends the wait on its own, but only while a turn is
queued for that sid. A body nobody is waiting on is left alone, so a job
it scheduled for later still runs. The adapter reads the vendor record
(`detached_activity`; for claude, the tail of the transcript plus the
subagent transcripts beside it):
- last turn ended and quiet for 30s: the process is kept alive only by
  background work and can never take the turn;
- a turn still open but silent for 30 min: treated the same way (no
  record: 30 min since the body was detached).
A body that is mid-turn and still writing keeps the wait.

The process is ended with one SIGKILL to the recorded pid
(`session_body::kill_body`), and the same path is used for `/interrupt`.
SIGTERM is not used: claude answers it by killing every background task
it started (measured on 2.1.296), and those tasks are the user's dev
servers, stacks and scheduled jobs. With SIGKILL they keep running,
reparented to init, and ccteam signals nothing else. Only the process
ends, never the session: sid, ledger and focus routes stay, and the
watcher's natural-exit path resumes the same sid with --resume and
delivers the queued turns. The ledger records the reason as
`ended_idle` or `ended_stalled`.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

A. Bodies are spawned as their own process-group leaders. Ending one
   (stop, /interrupt, or the automatic bound) now signals the group:
   SIGTERM, then a group SIGKILL that also sweeps members which outlived
   the leader. So no orphaned dev server is left holding a port that the
   resumed session needs. A body that does not lead its own group (spawned
   by an older build, inside the daemon's group) has only its own pid
   signalled. The receipt, the IM reply and the docs now say the
   background processes end with it.
B. Every path that brings a session back drains its FIFO before any new
   line is submitted: the backlog goes out first, in order, on the next
   message. If the watcher's rebuild fails after a body ends, the reply
   target is told why and that the queued messages are kept.
D. When a line was queued for a dead child and the resume then failed, the
   line is withdrawn. The error says the message was NOT delivered (so
   resending cannot deliver it twice) and names `/new` as the way out.
   The harness error no longer gives advice of its own.
C. The ledger records why a detached body ended: `interrupted`,
   `auto_recovered` or `exited`. The recovered-answer and unrecoverable
   notes are worded for the reason recorded.
Minors: the kill never runs under the gateway lock. REST /interrupt and
   /stop await it off the lock. The IM /interrupt door hands it to its own
   task, which wakes the watcher when done. A failed REST interrupt now
   returns 502 with the cause instead of 404 "unknown session".

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…d says so

Owner decision: ending a detached body to keep its session (`/interrupt`,
or the automatic bound) ends ONLY the body's process. It is one SIGKILL to
the fingerprint-checked pid (`session_body::kill_body`). claude answers
SIGTERM by killing every background task it started, and those tasks are
the user's dev servers, stacks and scheduled jobs. An explicit `/stop`
still ends the whole process group: the session is over, and so is its
work.

The background processes are never signalled, but they are made visible.
Before the kill, the body's descendants are walked in /proc and
fingerprinted. Each one still running afterwards is recorded as `orphans`
(pid + short cmdline) on the `session_body_exited` ledger event, and the
reply target is told: "still running, unattended: pid 1234 `npm run dev`".
A port the resumed session cannot bind is no longer a mystery. The ledger
reasons are `interrupted`, `ended_idle` and `ended_stalled`. The receipt,
the IM reply and the docs say the background processes keep running.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…t sticky

D1. end_detached_body_shared no longer overwrites an existing end mark.
    The watcher decides off the lock, so it could reach a body already
    marked by a user's /stop and relabel that end as its own. The watcher
    would then rebuild the session the user had just stopped and drain the
    queue into it. Only a stop may take over an interrupt. The exit handler
    leaves a stop-marked body to the stop. A stop also drops the sid's
    rebuild reservation, so a rebuild already spawning off the lock is
    discarded rather than installed after the stop.
D2. When the &mut /interrupt door's kill task fails, it flags the sid. The
    next reader of the mark lifts `interrupted`, so a later /interrupt
    really ends the body and a later natural exit is not recorded as an
    interrupt.
Gap 1. When the watcher's rebuild fails, a waiting delegation parent now
    gets an honest failure through the normal completion path
    (vendor_error, error_kind resume_failed), not just the reply target.
Gap 2. Project delete ends detached bodies off the gateway lock before
    stopping their sessions.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

N1. A detached body's end is now one hand-over entry per sid: in
    progress, then ended (with what it left running) or failed. The
    watcher, and the exit handler in the same lock as it removes the entry,
    defer while a kill has not handed over. So the report never goes out
    without the orphans, and a late hand-over can no longer be reported for
    a later incarnation. Each orphan carries its start-time fingerprint and
    is re-verified when reported, so a reused pid is never named. A stop
    drops any stale entry for the sid.
N2. Orphan command lines are redacted before they reach IM or the ledger:
    `key=value` and `--key value` for keys naming a token, secret,
    password, passwd, key, auth or credential; `Bearer` values; URL
    credentials; known token prefixes (sk-, ghp_, gho_, github_pat_,
    xox?-, AKIA); and runs of 32+ base64/hex characters. Control
    characters and backticks are replaced and the home directory reads as
    `~`. For claude's Bash wrapper, the eval payload is shown instead of
    the wrapper.
N3. signal_group's doc is back on signal_group. kill_body re-verifies the
    body right before the SIGKILL, because the /proc walk widens the
    pid-reuse window. Descendants take their start time from the same
    /proc/N/stat read. The doc no longer claims that no transcript line is
    cut: /interrupt and ended_stalled can tear the last line, which claude
    resumes past.
D1 stays as committed in 9e92aa4: an existing mark is never overwritten,
except that a stop may take over an in-flight interrupt.
Docs: /stop ends the session's current process and that process's
background processes; ones left by an earlier /interrupt or automatic end
are not touched.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…header secrets

C1. A body's kill and its hand-over now run on their own task. Shared
    callers (REST /interrupt, /stop, project delete) await the task's
    JoinHandle, so a web client that disconnects mid-kill no longer leaves
    `InProgress` behind forever, with the sid stuck detached and its queue
    undelivered. Each `InProgress` carries a token and a start time: only
    the kill that set it writes the outcome, and one older than 30s is
    settled as a failed end.
C2. The redactor now also covers:
    - quoted values (`--password='x'`, `TOKEN="x"`, `--token "x"`);
    - header and JSON members (`X-Api-Key: x`, `{"token":"x"}`) and Basic
      credentials;
    - `curl -u user:x`, mysql/mariadb `-px` and `sshpass -p x`;
    - `pass` and a whole-word `pwd` as sensitive keys;
    - URL userinfo with an empty user (`redis://:pw@h`).
    Every example from the review is in the test table.
Minors. If a stop finds its body already gone (an /interrupt's SIGKILL got
    there first), it still sweeps the body's process group, but only when
    a member still carries the sid in its environment. When the watcher's
    rebuild fails, the delegated tasks queued for the sid are withdrawn as
    their parents are told; a parent's resend is then the only run, never
    a late second completion. A human's queued lines stay.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

… path

When the watcher cannot bring a session back, the delegated tasks queued
for it are withdrawn. Their resume_failed signal used to carry no
execution turn, and plan_delegation_delivery answers a boundary nobody's
request is bound to with nobody: the parent was never told, and the
request stayed outstanding in delegation.json forever. The withdrawn
requests are now bound, durably and under the child's store claim, to a
turn of their own. That turn is delivered through the ordinary completion
path, so the notification has the same identity matching, the same
two-phase durability and restart dedup, and the same submission (a live
parent is steered, a released one gets the pending FIFO and a resume) as
any completion. Each parent hears once that the task was withdrawn and
did not run.

A REST /stop now runs the whole stop on its own task. A client that
disconnects mid-kill no longer leaves a dead body marked `stopping`
forever with messages queued behind it.

Redaction adds Cookie / Set-Cookie header values, `docker login … -p`,
and `echo|printf SECRET | … --password-stdin`.

Refs docs-local issue #211.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>