fix: harden managed runtime lifecycle and terminal history

Preserve Claude startup, resume, transcript acknowledgements and network settings.
Keep daemon takeover and forced process-tree cleanup independent of graceful stop,
with suspended Windows Job registration and retryable child ownership.

Retain repainted and long terminal history across backward pages. Fix sidebar
ordering, group menus, mobile layout, composer suggestions and modal navigation.

Add regression coverage and Windows CI checks for suspended launch and Job
cleanup. Align formatting, lint diagnostics and cross-platform test fixtures.

Author: waterbang

.github/workflows/ci.yml

@@ -146,6 +146,18 @@ jobs:
           manager_windows_tests::npm_style_batch_actor_survives_utf8_message_delivery
           -- --test-threads=1
 
+      - name: Verify Windows suspended process launch
+        timeout-minutes: 2
+        run: >-
+          cargo test --package cccc-windows-process --lib --locked
+          -- --test-threads=1
+
+      - name: Verify Windows owned Job cleanup
+        timeout-minutes: 2
+        run: >-
+          cargo test --package cccc-pair-runtime --lib --locked
+          process_tree::windows_tests:: -- --test-threads=1
+
       - name: Verify Windows console UTF-8 encoding lifecycle
         timeout-minutes: 10
         run: >-

.gitignore

@@ -69,6 +69,7 @@ graphify-out
 AGENTS.md
 .graphifyignore
 .claude/skills
+/.claude/worktrees/
 .shared/
 .agents/
 .codex/

CHANGELOG.md

@@ -7,13 +7,25 @@ The format follows [Keep a Changelog](https://keepachangelog.com/), and versions
 ## [Unreleased]
 
 ### Added
+
 - **Claude Code now provides the same visible, precisely observed session to Group Actors and Voice Analyst.** CCCC observes authoritative turns and tool results from Claude Agent View and attaches the native writable Claude TUI to that exact session; ordinary stop/start resumes the validated provider conversation.
 
 ### Changed
 - **Claude Code uses one strict managed-session path instead of separate Hook and `claude -p` implementations.** Runtime Profiles retain supported model, effort, tools, plugins, settings, and private environment while CCCC owns session topology, MCP identity, YOLO policy, cancellation, and resume. Unsupported wrappers, prompt tails, transport flags, and legacy receipts fail explicitly instead of falling back to a divergent session.
 - **Actors no longer expose PTY versus Headless as a configuration choice.** CCCC derives the Runtime surface automatically: CLI Actors retain their native writable terminal, while Codex, Claude Code, Grok Build, and OpenCode pair it with structured lifecycle observation on the same session. Incoming Actor messages are handed to that native terminal without CCCC waiting for provider idleness or choosing queue-versus-steer semantics.
 
 ### Fixed
+- **Forced launcher exit terminates owned process trees independently of normal shutdown.** PTY, managed providers, DeepSeek and Web-owned daemon launches register OS resources at spawn; the second interrupt or normal-shutdown deadline terminates those resources without protocol/session locks or another cleanup timeout. Unix exit polling revokes ownership before reaping to avoid reused PID/PGID targets.
+- **Group action menus no longer activate mouse sorting.** Menu mouse-down events stay inside the trigger while row dragging remains available.
+- **Long terminal history no longer loses newer lines when older pages are loaded.** Scrolled-off lines have a separate bounded history buffer with explicit truncation reporting.
+- **Windows managed processes join their Job before executing.** Standard launches remain suspended through Job assignment, preserving detached launch flags and cleaning up failed starts.
+- **Failed managed-process stops retain retryable ownership.** Child handles remain owned until confirmed exit and reaping, including signal and wait failures.
+- **Sidebar group reordering updates immediately.** The rendered list now subscribes to order changes, preventing drag snap-back and subsequent moves based on stale row positions.
+- **Claude resume recovers stale transcript paths after worktree moves.** Missing published paths are resolved to a unique retained transcript for the same session only during initial recovery; history offsets and active-file identity checks remain intact, and missing-history errors identify the path and session.
+- **Daemon takeover validates the actual CLI subcommand before targeting a PID.** Global options no longer cause one-shot commands to be mistaken for daemon hosts.
+- **Terminal history preserves ANSI state across backward pages and remains keyboard accessible.** Rendering preserves inferred frames before repainting within a fixed cumulative range. Short pages require explicit loading, errors pause automatic loading, and the nested dialog traps focus and restores its opener.
+- **Managed Claude sessions retain host proxy and CA settings.** HTTP/HTTPS/ALL/NO proxy aliases and custom CA paths survive the cleared launcher environment and are included in the private settings used for session respawn. Explicit network overrides, including empty proxy values, take precedence.
+- **Managed Claude and Codex sessions recover before their first completed turn.** Claude can locate its exact validated transcript before Agent View publishes `linkScanPath`, preserving the resume read boundary. New Codex threads materialize metadata and pass a same-thread resume check before CCCC exposes the native terminal; startup does not inject a model prompt.
 - **Managed terminal startup no longer accepts truncated first messages.** Actor and Voice Analyst native input waits for the TUI's input mode before writing, without injecting startup work or waiting for the current model turn to finish.
 - **Claude sessions stop and resume reliably across empty starts and observer failures.** Verified empty sessions retain their conversation ID without requiring nonexistent history; observer failures use confirmed background-task shutdown, and normal closure releases event readers. Transcript replacement checks now use file handles supported by stable Rust on Windows.
 - **Native Windows Actors now start and receive messages reliably.** Runtime launch resolves executables in the configured PATHEXT order without restoring excluded extensions or selecting extensionless npm shell shims, routes `.cmd`/`.bat` through the Windows command processor, preserves backslashes in `actor --command`, and uses the last stable `portable-pty` ConPTY behavior. A Windows-only regression test delivers UTF-8 text through an npm-style batch shim and verifies that the Actor stays alive.

Cargo.lock

@@ -11,6 +11,7 @@ members = [
   "crates/cccc-notebooklm",
   "crates/cccc-web",
   "crates/cccc-windows-console",
+  "crates/cccc-windows-process",
   "crates/cccc-cli",
 ]
 exclude = [

Cargo.toml

@@ -30,6 +30,7 @@ cccc-web = { package = "cccc-pair-web", version = "=0.4.37", path = "../cccc-web
 clap.workspace = true
 fs2.workspace = true
 reqwest.workspace = true
+rustls.workspace = true
 semver.workspace = true
 serde_json.workspace = true
 shell-words.workspace = true
@@ -39,6 +40,9 @@ tempfile.workspace = true
 [target.'cfg(target_os = "linux")'.dependencies]
 openssl-sys = { version = "0.9", features = ["vendored"], optional = true }
 
+[target.'cfg(unix)'.dependencies]
+nix.workspace = true
+
 [target.'cfg(windows)'.dependencies]
 cccc-windows-console = { path = "../cccc-windows-console" }
 

crates/cccc-cli/Cargo.toml

@@ -0,0 +1,59 @@
+//! Asking the operator before stopping something that is already running.
+//!
+//! Every "should I stop the process that is already here?" decision shares one
+//! safety rule: without a terminal to ask, the answer is no. A launcher started
+//! by an MCP bridge, a service manager, or CI has nobody to consult, and
+//! guessing there would terminate processes on behalf of an operator who never
+//! saw the question. Keeping the rule in one place is what keeps the two call
+//! sites -- the Web instance lock and the daemon lock -- from drifting apart.
+
+use anyhow::Result;
+use std::io::{self, BufRead, IsTerminal, Write};
+
+/// Ask a yes/no question, defaulting to no.
+///
+/// Returns `false` without prompting when stdin is not a terminal.
+pub(crate) fn ask(question: &str) -> Result<bool> {
+    if !io::stdin().is_terminal() {
+        return Ok(false);
+    }
+    ask_with(question, &mut io::stdin().lock(), &mut io::stderr().lock())
+}
+
+pub(crate) fn ask_with(
+    question: &str,
+    input: &mut impl BufRead,
+    output: &mut impl Write,
+) -> Result<bool> {
+    write!(output, "{question} [y/N] ")?;
+    output.flush()?;
+
+    let mut answer = String::new();
+    input.read_line(&mut answer)?;
+    Ok(matches!(
+        answer.trim().to_ascii_lowercase().as_str(),
+        "y" | "yes"
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::ask_with;
+
+    #[test]
+    fn accepts_only_explicit_yes() {
+        let mut output = Vec::new();
+        assert!(ask_with("Stop it?", &mut "yes\n".as_bytes(), &mut output).expect("yes"));
+        assert!(ask_with("Stop it?", &mut "y\n".as_bytes(), &mut output).expect("y"));
+        assert!(!ask_with("Stop it?", &mut "\n".as_bytes(), &mut output).expect("default no"));
+        assert!(!ask_with("Stop it?", &mut "n\n".as_bytes(), &mut output).expect("no"));
+        // Anything that is not an explicit yes must not be read as consent.
+        assert!(!ask_with("Stop it?", &mut "sure\n".as_bytes(), &mut output).expect("not yes"));
+    }
+
+    #[test]
+    fn eof_is_not_consent() {
+        let mut output = Vec::new();
+        assert!(!ask_with("Stop it?", &mut "".as_bytes(), &mut output).expect("eof"));
+    }
+}