run the agent as a pm2 peer instead of a child of officer

the process that runs claude (sidecar/claude/user-instance.ts) had no pm2 entry
and was spawned on demand by the main server, with stdout/stderr inherited. that
made every agent session a grandchild of officer, so pm2's tree-kill took the
session down on every `pm2 restart officer` — the single thing that makes it
impossible to work on the platform while an agent is running.

give it its own entry (officer-agent) and delete the spawn machinery:
ensureClaudeSidecar, spawnAndWaitForRegistration, the 50ms registration poll and
the per-email claudeProcs/claudeSpawnWaiters maps, ~77 lines. officer now spawns
no sidecar at all.

for that to work the sidecar had to stop needing officer to start:

- it resolves the owner from the database (getOwnerUser) instead of reading
  CLAUDE_USER_EMAIL out of the env officer built. single-user is a hard
  invariant, so there is nothing to fan out over. CLAUDE_USER_EMAIL still wins
  when set, for manual runs, and a fresh install waits for bootstrap rather
  than exiting into a restart loop.
- it reads the anthropic proxy secret from the proxy sidecar's own state file
  rather than being handed it in env. lazily, because ensureProxySecret
  persists on a 30s debounce and pm2 starts both processes together.

it registers as 'agent' with capability 'claude', so the registry finds it the
way it finds every other sidecar. that removes the email argument from
killClaude, interruptClaude and clearClaudeSession, which only ever existed to
locate a per-email sidecar by name.

what officer keeps is a short wait-for-capability, because pm2 brings peers up
together and the first request after a boot can beat the sidecar's registration.

also align the two officer port fallbacks in the sidecar (5000 for the socket,
9010 for the rest base) — same instance, so they cannot disagree.

this fixes R1 and R2 from CLAUDE_SIDECAR_ISOLATION.md. events produced while
officer is down are still lost; that is stage 2.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/databases/officer_db/src/index.ts

@@ -2,6 +2,7 @@ export {
   getUsers,
   getUserById,
   getUserByEmail,
+  getOwnerUser,
   getUserCount,
   createUser,
   updateUser,

src/databases/officer_db/src/queries/auth.ts

@@ -19,6 +19,14 @@ export async function getUserByEmail(email: string): Promise<UserSelect | undefi
   return user;
 }
 
+// Single-user platform: there is exactly one account, created once by POST /auth/bootstrap. Sidecars
+// that need "who is the owner" (e.g. the agent sidecar, which PM2 starts with no email in its env)
+// resolve it here rather than being told by the main server.
+export async function getOwnerUser(): Promise<UserSelect | undefined> {
+  const [user] = await db.select().from(users).orderBy(users.id).limit(1);
+  return user;
+}
+
 export async function getUserCount(): Promise<number> {
   const [result] = await db.select({ count: sql<number>`count(*)::int` }).from(users);
   return result?.count ?? 0;

src/servers/api/chat/websocket.ts

@@ -572,7 +572,7 @@ async function handleStop(ws: ServerWebSocket<WSData>): Promise<void> {
         if (isClaudeModel(session.model)) {
           // Interrupt the current turn but KEEP the persistent session alive (background tasks + the
           // warm worker survive). Full teardown is 'disconnect' → deleteSession → _claudeKill.
-          void sidecar.interruptClaude(sessionId, session.email);
+          void sidecar.interruptClaude(sessionId);
           logger.info('Interrupted Claude Code turn via sidecar (session stays warm)', { sessionId });
         } else {
           session._claudeKill?.(); // OpenCode: abort the turn via the stored handle

src/servers/channels/send-claude-code.ts

@@ -18,8 +18,8 @@ type ClaudeCodeResult = {
   cost: MessageCost;
 };
 
-export function clearClaudeCodeSession(sessionKey: string, email?: string): void {
-  sidecar.clearClaudeSession(sessionKey, email);
+export function clearClaudeCodeSession(sessionKey: string): void {
+  sidecar.clearClaudeSession(sessionKey);
 }
 
 export async function sendClaudeCode(params: ClaudeCodeParams): Promise<ClaudeCodeResult> {
@@ -61,7 +61,7 @@ export async function sendClaudeCodeStreaming(params: ClaudeCodeStreamingParams)
 
   return {
     kill: () => {
-      sidecar.killClaude(params.sessionKey, params.email);
+      sidecar.killClaude(params.sessionKey);
       unsub();
     },
   };

src/servers/sidecar-registry.ts

@@ -1,6 +1,4 @@
-import { resolve } from 'node:path';
 import type { ServerWebSocket } from 'bun';
-import type { Subprocess } from 'bun';
 import type {
   SidecarCommand,
   SidecarEvent,
@@ -113,13 +111,6 @@ function findSidecarByCapability(cap: string): RegisteredSidecar | undefined {
   return undefined;
 }
 
-function findSidecarByName(name: string): RegisteredSidecar | undefined {
-  for (const sc of sidecars.values()) {
-    if (sc.name === name) return sc;
-  }
-  return undefined;
-}
-
 // ── Event dispatch ──
 
 function dispatchEvent(msg: SidecarEvent | PtyEvent) {
@@ -195,82 +186,27 @@ function sendFireToSidecar(sc: RegisteredSidecar, cmd: SidecarCommand | PtyComma
   sc.ws.send(JSON.stringify(cmd));
 }
 
-// ── On-demand Claude sidecar spawning ──
+// ── Waiting for a sidecar to appear ──
 
-const USER_INSTANCE_SCRIPT = resolve(import.meta.dir, 'sidecar/claude/user-instance.ts');
-const SIDECAR_SPAWN_TIMEOUT_MS = 15_000;
+// Officer no longer spawns any sidecar; PM2 owns every one of them. The only thing left to handle is
+// startup order — PM2 brings `officer` and its peers up together, so the first request after a boot can
+// arrive a beat before the sidecar has finished dialling in. Wait briefly rather than failing the
+// request. (This replaces ~77 lines of spawn-and-poll: `ensureClaudeSidecar`,
+// `spawnAndWaitForRegistration`, and the per-email `claudeProcs`/`claudeSpawnWaiters` maps.)
+const CAPABILITY_WAIT_MS = 15_000;
+const CAPABILITY_POLL_MS = 100;
 
-const claudeProcs = new Map<string, Subprocess>();
-const claudeSpawnWaiters = new Map<string, Promise<RegisteredSidecar>>();
-
-async function ensureClaudeSidecar(email: string): Promise<RegisteredSidecar> {
-  const name = `claude:${email}`;
-
-  // Already registered?
-  const existing = findSidecarByName(name);
+async function waitForCapability(cap: string, timeoutMs = CAPABILITY_WAIT_MS): Promise<RegisteredSidecar> {
+  const existing = findSidecarByCapability(cap);
   if (existing) return existing;
 
-  // Already spawning?
-  const waiter = claudeSpawnWaiters.get(email);
-  if (waiter) return waiter;
-
-  // Spawn and wait for registration
-  const promise = spawnAndWaitForRegistration(email, name);
-  claudeSpawnWaiters.set(email, promise);
-  try {
-    return await promise;
-  } finally {
-    claudeSpawnWaiters.delete(email);
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    await Bun.sleep(CAPABILITY_POLL_MS);
+    const sc = findSidecarByCapability(cap);
+    if (sc) return sc;
   }
-}
-
-async function spawnAndWaitForRegistration(email: string, name: string): Promise<RegisteredSidecar> {
-  const proxySecret = await getProxySecret();
-  const proxyPort = process.env.ANTHROPIC_PROXY_PORT ?? '5051';
-
-  const env: Record<string, string> = {
-    ...(process.env as Record<string, string>),
-    CLAUDE_USER_EMAIL: email,
-    ANTHROPIC_BASE_URL: `http://127.0.0.1:${proxyPort}`,
-    ANTHROPIC_API_KEY: proxySecret,
-  };
-
-  const proc = Bun.spawn(['bun', 'run', USER_INSTANCE_SCRIPT], {
-    env,
-    stdout: 'inherit',
-    stderr: 'inherit',
-  });
-
-  claudeProcs.set(email, proc);
-
-  // Clean up on exit
-  proc.exited.then(() => {
-    claudeProcs.delete(email);
-  });
-
-  // Wait for the sidecar to register
-  return new Promise<RegisteredSidecar>((resolve, reject) => {
-    const timeout = setTimeout(() => {
-      unsub();
-      reject(new Error(`Claude sidecar for ${email} failed to register within ${SIDECAR_SPAWN_TIMEOUT_MS}ms`));
-    }, SIDECAR_SPAWN_TIMEOUT_MS);
-
-    // Poll for registration (the sidecar connects via WebSocket and registerSidecar is called)
-    const check = () => {
-      const sc = findSidecarByName(name);
-      if (sc) {
-        clearTimeout(timeout);
-        clearInterval(interval);
-        resolve(sc);
-      }
-    };
-    const interval = setInterval(check, 50);
-
-    const unsub = () => {
-      clearTimeout(timeout);
-      clearInterval(interval);
-    };
-  });
+  throw new Error(`No sidecar with capability "${cap}" registered within ${timeoutMs}ms`);
 }
 
 // ── Public API ──
@@ -303,10 +239,14 @@ export function getProxySecretSync(): string {
   return cachedState?.proxySecret ?? '';
 }
 
-// ── Claude Code (per-user routing) ──
+// ── Claude Code (the `officer-agent` sidecar, capability 'claude') ──
+
+// Single-user platform, so there is exactly one agent sidecar and it is found by capability like every
+// other one. The `email` on the params is still passed through to the sidecar — it needs it to resolve
+// paths — but officer no longer uses it to *locate* anything.
 
 export async function spawnClaude(params: ClaudeSpawnParams): Promise<ClaudeCodeResult> {
-  const sc = await ensureClaudeSidecar(params.email);
+  const sc = await waitForCapability('claude');
   const res = await sendCommandToSidecar(sc, { type: 'claude:spawn', id: nextId(), params }, LONG_TIMEOUT_MS);
   if (res.type === 'claude:result') return res.result;
   if (res.type === 'claude:error') throw new Error(res.error);
@@ -314,36 +254,24 @@ export async function spawnClaude(params: ClaudeSpawnParams): Promise<ClaudeCode
 }
 
 export async function spawnClaudeStreaming(params: ClaudeSpawnStreamingParams): Promise<void> {
-  const sc = await ensureClaudeSidecar(params.email);
+  const sc = await waitForCapability('claude');
   const res = await sendCommandToSidecar(sc, { type: 'claude:spawn-streaming', id: nextId(), params });
   if (res.type === 'claude:spawned') return;
   if (res.type === 'claude:error') throw new Error(res.error);
   throw new Error('Unexpected response');
 }
 
-export function killClaude(sessionKey: string, email: string): void {
-  const sc = findSidecarByName(`claude:${email}`);
-  if (sc) sendFireToSidecar(sc, { type: 'claude:kill', id: nextId(), sessionKey });
+export function killClaude(sessionKey: string): void {
+  sendFire('claude', { type: 'claude:kill', id: nextId(), sessionKey });
 }
 
 // Interrupt the current turn but keep the persistent session warm (the "stop" button).
-export function interruptClaude(sessionKey: string, email: string): void {
-  const sc = findSidecarByName(`claude:${email}`);
-  if (sc) sendFireToSidecar(sc, { type: 'claude:interrupt', id: nextId(), sessionKey });
+export function interruptClaude(sessionKey: string): void {
+  sendFire('claude', { type: 'claude:interrupt', id: nextId(), sessionKey });
 }
 
-export function clearClaudeSession(sessionKey: string, email?: string): void {
-  if (email) {
-    const sc = findSidecarByName(`claude:${email}`);
-    if (sc) sendFireToSidecar(sc, { type: 'claude:clear-session', id: nextId(), sessionKey });
-  } else {
-    // Broadcast to all claude sidecars (used when email is not available)
-    for (const sc of sidecars.values()) {
-      if (sc.capabilities.includes('claude')) {
-        sendFireToSidecar(sc, { type: 'claude:clear-session', id: nextId(), sessionKey });
-      }
-    }
-  }
+export function clearClaudeSession(sessionKey: string): void {
+  sendFire('claude', { type: 'claude:clear-session', id: nextId(), sessionKey });
 }
 
 export function onClaudeEvent(handler: (sessionKey: string, event: ChatEvent) => void): () => void {

src/servers/sidecar/claude/state.ts

@@ -101,6 +101,31 @@ export async function flushAndSave(): Promise<void> {
   await saveState();
 }
 
+/**
+ * Read the Anthropic proxy secret out of the *proxy* sidecar's state file.
+ *
+ * The proxy (`officer-anthropic-proxy`) and the agent (`officer-agent`) keep separate state — see
+ * `initPaths`: `DATA_PATH/sidecar/` versus `DATA_PATH/<email>/sidecar/` — so the agent cannot reach
+ * the secret through `getState()`. It used to be handed the secret in env by the main server, and
+ * needing that handoff is precisely why the agent had to be spawned by `officer` (and therefore died
+ * with it). Reading it off disk keeps the two processes independent, with the proxy still the only
+ * writer.
+ *
+ * Returns '' when the secret is not on disk yet: `ensureProxySecret` persists through a 30s debounce,
+ * so a brand-new install has a window where the file exists without it. Callers should treat '' as
+ * "retry later" rather than fatal.
+ */
+export function readProxySecretFromDisk(): string {
+  try {
+    const proxyStateFile = join(DATA_PATH, 'sidecar', 'claude-state.json');
+    if (!existsSync(proxyStateFile)) return '';
+    const parsed = JSON.parse(readFileSync(proxyStateFile, 'utf-8')) as Partial<PersistedState>;
+    return parsed.proxySecret ?? '';
+  } catch {
+    return '';
+  }
+}
+
 // ── Lockfile ──
 
 export function acquireLock(): boolean {

src/servers/sidecar/claude/user-instance.ts

@@ -2,30 +2,39 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { homedir } from 'node:os';
 import type { SidecarCommand, SidecarEvent } from '../protocol';
-import { initPaths, loadState, flushAndSave, acquireLock, releaseLock } from './state';
+import { initPaths, loadState, flushAndSave, acquireLock, releaseLock, readProxySecretFromDisk } from './state';
 import { setMcpConfigPath } from './claude-manager';
 import * as claudeManager from './claude-manager';
 import { createSidecarConnector } from '../connect';
 import { sign } from '../../jwt';
-import { getUserByEmail, getEmailAccounts } from 'officerdb';
+import { getUserByEmail, getOwnerUser, getEmailAccounts } from 'officerdb';
 
-const email = process.env.CLAUDE_USER_EMAIL;
-if (!email) {
-  console.error('[user-instance] CLAUDE_USER_EMAIL is required');
-  process.exit(1);
+// PM2 starts this sidecar with no user in its env. Single-user platform, so resolve the owner from the
+// database rather than being told who to run as by the main server — one less thing that has to come
+// from `officer` before this process can work. CLAUDE_USER_EMAIL still wins when set, for manual runs.
+async function resolveOwner() {
+  const explicit = process.env.CLAUDE_USER_EMAIL?.trim();
+  for (;;) {
+    const user = explicit ? await getUserByEmail(explicit) : await getOwnerUser();
+    if (user) return user;
+    // Fresh install: wait for POST /auth/bootstrap instead of exiting into a PM2 restart loop.
+    console.log(`[agent] no ${explicit ? `user "${explicit}"` : 'owner account'} yet — retrying in 5s`);
+    await Bun.sleep(5_000);
+  }
 }
 
+const dbUser = await resolveOwner();
+const email = dbUser.email;
+
 const DATA_PATH = process.env.DATA_PATH ?? join(process.cwd(), 'data');
-const API_URL = process.env.API_URL ?? `ws://127.0.0.1:${process.env.PORT ?? '5000'}`;
-const OFFICER_API_URL = process.env.OFFICER_API_URL ?? `http://127.0.0.1:${process.env.PORT ?? '9010'}`;
+// Same officer instance for both, so the fallback port has to agree. It used to default to 5000 for the
+// WebSocket and 9010 for the REST base, which would have split them apart if PORT were ever unset.
+const OFFICER_PORT = process.env.PORT ?? '9010';
+const API_URL = process.env.API_URL ?? `ws://127.0.0.1:${OFFICER_PORT}`;
+const OFFICER_API_URL = process.env.OFFICER_API_URL ?? `http://127.0.0.1:${OFFICER_PORT}`;
 const MCP_SERVER_SCRIPT = resolve(import.meta.dir, '../../mcp-tool-server.ts');
 
 // Mint a long-lived JWT for this user so tools (e.g. gmail) can call back to dev-platform as them
-const dbUser = await getUserByEmail(email);
-if (!dbUser) {
-  console.error(`[user-instance] no user found for ${email}`);
-  process.exit(1);
-}
 const OFFICER_AUTH_TOKEN = await sign({ id: dbUser.id, email, username: dbUser.username }, '30d');
 
 // Single-user platform: the owner runs Claude with no isolation — real HOME, real ~/.claude — so
@@ -49,7 +58,7 @@ process.env.HOME = homeDir;
 initPaths(email);
 
 if (!acquireLock()) {
-  console.error(`[claude:${email}] another instance is already running (lock file exists with live PID)`);
+  console.error(`[agent] another instance is already running for ${email} (lock file exists with live PID)`);
   process.exit(1);
 }
 
@@ -85,6 +94,30 @@ function generateMcpConfig(): string {
   return join(contextDir, 'mcp-host.json');
 }
 
+// ── Anthropic credentials ──
+
+// The `claude` CLI inherits this process's env (claude-manager spawns with `process.env`), so the proxy
+// endpoint and secret have to be set here. Officer used to inject both when it spawned this process;
+// reading them ourselves is what lets this sidecar be a PM2 peer instead of a child of the server.
+//
+// Resolved lazily rather than once at boot: PM2 starts the proxy and the agent together, and
+// `ensureProxySecret` persists on a 30s debounce, so on a first-ever boot the secret can be briefly
+// absent. Re-checked before every spawn until it lands.
+const ANTHROPIC_PROXY_PORT = process.env.ANTHROPIC_PROXY_PORT ?? '5051';
+
+function ensureAnthropicEnv(): void {
+  process.env.ANTHROPIC_BASE_URL ??= `http://127.0.0.1:${ANTHROPIC_PROXY_PORT}`;
+  if (process.env.ANTHROPIC_API_KEY) return;
+
+  const secret = readProxySecretFromDisk();
+  if (secret) {
+    process.env.ANTHROPIC_API_KEY = secret;
+    console.log('[agent] anthropic proxy secret loaded from disk');
+  } else {
+    console.warn('[agent] anthropic proxy secret not on disk yet — retrying before next spawn');
+  }
+}
+
 // ── Startup ──
 
 // The owner runs un-isolated with HOME as their real home, so the generated container CLAUDE.md is
@@ -92,8 +125,9 @@ function generateMcpConfig(): string {
 // terminal `claude` loads too.
 
 setMcpConfigPath(generateMcpConfig());
+ensureAnthropicEnv();
 
-console.log(`[claude:${email}] started (HOME=${homeDir})`);
+console.log(`[agent] started for ${email} (HOME=${homeDir})`);
 
 // ── Command handlers ──
 
@@ -106,6 +140,7 @@ async function handleCommand(cmd: SidecarCommand, reply: ReplyFn) {
       break;
 
     case 'claude:spawn': {
+      ensureAnthropicEnv();
       try {
         const result = await claudeManager.spawnClaude(cmd.params);
         reply({ type: 'claude:result', id: cmd.id, result });
@@ -116,6 +151,7 @@ async function handleCommand(cmd: SidecarCommand, reply: ReplyFn) {
     }
 
     case 'claude:spawn-streaming': {
+      ensureAnthropicEnv();
       reply({ type: 'claude:spawned', id: cmd.id, sessionKey: cmd.params.sessionKey });
 
       const onEvent = (event: import('../../api/chat/types').ChatEvent) => {
@@ -158,9 +194,12 @@ async function handleCommand(cmd: SidecarCommand, reply: ReplyFn) {
 
 // ── Connect to API server ──
 
+// A stable identity, not a per-email one. Officer looks this sidecar up by the 'claude' capability, so
+// it no longer needs to know which user is running to find it — that was the last thing tying the
+// registry's claude verbs to an email argument.
 const connection = createSidecarConnector({
   apiUrl: `${API_URL}/api/sidecar/register`,
-  name: `claude:${email}`,
+  name: 'agent',
   capabilities: ['claude'],
   onCommand(cmd, reply) {
     handleCommand(cmd as SidecarCommand, reply as ReplyFn);
@@ -170,7 +209,7 @@ const connection = createSidecarConnector({
 // ── Graceful shutdown ──
 
 async function shutdown(signal: string) {
-  console.log(`[claude:${email}] ${signal} received, saving state...`);
+  console.log(`[agent] ${signal} received, saving state...`);
   connection.destroy();
   await flushAndSave();
   releaseLock();