P2: découverte & reprise des sessions Claude

Arboretum découvre désormais toutes les sessions Claude de la machine
(scan ~/.claude/projects + registre ~/.claude/sessions), distingue
vivantes/mortes par pid+procStart, et permet de reprendre une morte
(--resume dans son cwd d'origine) ou forker une vivante sans la corrompre.

- shared: SessionSummary enrichi (source, claudeSessionId, pid, resumable,
  attachable, registryStatus) — additif, PROTOCOL_VERSION inchangé ;
  types REST resume/fork.
- db: migration id:2 (claude_session_id, resumed_from).
- core: jsonl-discovery (parseur tolérant, scan asynchrone non bloquant),
  session-registry (vivacité pid+procStart), discovery-service (cache +
  refresh périodique + diff/broadcast), pty-manager (resume/fork + capture
  du claudeSessionId via le registre).
- routes: /sessions/:id/resume (garde-fou 409 anti-corruption sur session
  vivante) et /fork ; GET fusionné managées + découvertes ; relais WS.
- web: badges managed/discovered + busy/idle/waiting, actions conditionnelles
  (Open/Observe/Kill vs Fork/View vs Resume/Fork), vue read-only des sessions
  externes, i18n EN/FR.
- tests: jsonl-discovery, session-registry, discovery-service + resume/fork
  (130 verts) ; acceptation E2E acceptance-p2.mjs (sans quota) ALL GREEN.

Conforme aux verdicts S1 (resume dans cwd d'origine, vivacité pid+procStart)
et S4 (munge cwd, parseur tête+queue, priorité de titre).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/server/scripts/acceptance-p2.mjs

@@ -0,0 +1,164 @@
+#!/usr/bin/env node
+// Acceptation P2 (sans navigateur, sans quota Claude) : découverte & reprise de sessions.
+// Faux ~/.claude jetable (--claude-home) + faux binaire `claude` (script bash) injecté dans le PATH.
+// Couvre : découverte d'une session morte (resumable) et vivante (registre + pid réel),
+// resume refusé sur une vivante (409), fork autorisé, resume d'une morte dans SON CWD d'origine,
+// broadcast WS d'une session découverte au rafraîchissement périodique.
+import { spawn } from 'node:child_process';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, rmSync, chmodSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const WebSocket = require('ws');
+
+const PORT = 7542;
+const ORIGIN = `http://127.0.0.1:${PORT}`;
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const munge = (p) => p.replace(/[^A-Za-z0-9]/g, '-');
+const serverDir = join(dirname(fileURLToPath(import.meta.url)), '..');
+const results = [];
+const check = (name, ok, detail = '') => {
+  results.push({ name, ok, detail });
+  console.log(`${ok ? '✅' : '❌'} ${name}${detail ? ` — ${detail}` : ''}`);
+};
+
+const tmp = mkdtempSync(join(tmpdir(), 'arb-accept-p2-'));
+const claudeHome = join(tmp, 'claude');
+const projects = join(claudeHome, 'projects');
+const sessions = join(claudeHome, 'sessions');
+const workDir = join(tmp, 'work'); // cwd d'origine des sessions découvertes
+const fakeBin = join(tmp, 'bin');
+mkdirSync(projects, { recursive: true });
+mkdirSync(sessions, { recursive: true });
+mkdirSync(workDir, { recursive: true });
+mkdirSync(fakeBin, { recursive: true });
+
+// Faux binaire `claude` : imprime ses arguments + son cwd, puis reste vivant un instant.
+writeFileSync(join(fakeBin, 'claude'), '#!/usr/bin/env bash\necho "FAKE-CLAUDE args=[$*] cwd=$(pwd)"\nsleep 30\n');
+chmodSync(join(fakeBin, 'claude'), 0o755);
+
+function writeJsonl(cwd, sid) {
+  const d = join(projects, munge(cwd));
+  mkdirSync(d, { recursive: true });
+  writeFileSync(join(d, `${sid}.jsonl`), `${JSON.stringify({ type: 'user', sessionId: sid, cwd, message: { content: `prompt ${sid}` } })}\n`);
+}
+
+// Session découverte MORTE (aucune entrée registre) → resumable.
+writeJsonl(workDir, 'sid-dead');
+
+// Session découverte VIVANTE : un vrai process `sleep` fournit pid + procStart concordants.
+const liveProc = spawn('sleep', ['300']);
+const livePid = liveProc.pid;
+const liveStat = readFileSync(`/proc/${livePid}/stat`, 'utf8');
+const liveProcStart = liveStat.slice(liveStat.lastIndexOf(')') + 2).split(' ')[19];
+writeJsonl(workDir, 'sid-live');
+writeFileSync(
+  join(sessions, `${livePid}.json`),
+  JSON.stringify({ pid: livePid, procStart: liveProcStart, sessionId: 'sid-live', cwd: workDir, status: 'busy' }),
+);
+
+const srv = spawn(
+  'node',
+  [join(serverDir, 'dist', 'index.js'), '--port', String(PORT), '--db', join(tmp, 'a.db'), '--claude-home', claudeHome],
+  { env: { ...process.env, ARBORETUM_LOG: 'warn', PATH: `${fakeBin}:${process.env.PATH}` }, stdio: ['ignore', 'pipe', 'pipe'] },
+);
+let srvOut = '';
+srv.stdout.on('data', (d) => (srvOut += d));
+srv.stderr.on('data', (d) => (srvOut += d));
+
+function wsClient(cookie) {
+  const ws = new WebSocket(`ws://127.0.0.1:${PORT}/ws`, { headers: { Origin: ORIGIN, Cookie: cookie } });
+  ws.binaryType = 'arraybuffer';
+  const state = { msgs: [], outputs: new Map() };
+  ws.on('message', (data, isBinary) => {
+    if (!isBinary) {
+      state.msgs.push(JSON.parse(String(data)));
+      return;
+    }
+    const buf = Buffer.from(data);
+    const type = buf.readUInt8(0);
+    const channel = buf.readUInt32LE(1);
+    const payload = buf.subarray(5);
+    const prev = type === 0x02 ? '' : (state.outputs.get(channel) ?? '');
+    state.outputs.set(channel, (prev + payload.toString('latin1')).slice(-100000));
+  });
+  const waitMsg = async (pred, timeout = 8000) => {
+    const t0 = Date.now();
+    while (Date.now() - t0 < timeout) {
+      const m = state.msgs.find(pred);
+      if (m) return m;
+      await sleep(50);
+    }
+    return null;
+  };
+  return { ws, state, waitMsg, send: (m) => ws.send(JSON.stringify(m)) };
+}
+
+const postJson = (path, cookie) =>
+  fetch(`${ORIGIN}${path}`, { method: 'POST', headers: { Origin: ORIGIN, Cookie: cookie } });
+
+try {
+  await sleep(1500);
+  const token = /arb_[0-9a-f]+/.exec(srvOut)?.[0];
+  check('boot + token bootstrap', !!token);
+
+  const login = await fetch(`${ORIGIN}/api/v1/auth/login`, {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Origin: ORIGIN },
+    body: JSON.stringify({ token }),
+  });
+  const cookie = login.headers.get('set-cookie')?.split(';')[0] ?? '';
+  check('login → cookie', login.status === 200 && cookie.startsWith('arb_session='));
+
+  // GET /sessions : la découverte (scan initial) doit exposer les deux sessions.
+  const listRes = await fetch(`${ORIGIN}/api/v1/sessions`, { headers: { Origin: ORIGIN, Cookie: cookie } });
+  const list = (await listRes.json()).sessions;
+  const dead = list.find((s) => s.id === 'sid-dead');
+  const live = list.find((s) => s.id === 'sid-live');
+  check('découverte session morte (resumable, discovered)', dead?.source === 'discovered' && dead?.resumable === true && dead?.live === false);
+  check('découverte session vivante (live, registryStatus)', live?.live === true && live?.attachable === false && live?.registryStatus === 'busy');
+
+  // Garde-fou : resume d'une session VIVANTE refusé (409), fork autorisé (201).
+  const resumeLive = await postJson('/api/v1/sessions/sid-live/resume', cookie);
+  check('resume d’une session vivante → 409 SESSION_LIVE', resumeLive.status === 409 && (await resumeLive.json()).error.code === 'SESSION_LIVE');
+  const forkLive = await postJson('/api/v1/sessions/sid-live/fork', cookie);
+  check('fork d’une session vivante → 201', forkLive.status === 201);
+
+  // Resume d'une session MORTE → nouveau PTY managé claude, DANS SON CWD D'ORIGINE.
+  const c = wsClient(cookie);
+  await new Promise((res, rej) => (c.ws.on('open', res), c.ws.on('error', rej)));
+  c.send({ type: 'hello', protocol: 1 });
+  await c.waitMsg((m) => m.type === 'hello_ok');
+  c.send({ type: 'sub', topics: ['sessions'] });
+
+  const resumeDead = await postJson('/api/v1/sessions/sid-dead/resume', cookie);
+  const resumed = (await resumeDead.json()).session;
+  check('resume d’une session morte → 201 (PTY managé claude)', resumeDead.status === 201 && resumed?.command === 'claude' && resumed?.source === 'managed');
+
+  c.send({ type: 'attach', sessionId: resumed.id, mode: 'interactive', cols: 120, rows: 32 });
+  const att = await c.waitMsg((m) => m.type === 'attached');
+  await sleep(600);
+  const out = c.state.outputs.get(att?.channel) ?? '';
+  check('resume lance `--resume sid-dead` dans le bon cwd', out.includes('args=[--resume sid-dead]') && out.includes(`cwd=${workDir}`), out.replace(/\s+/g, ' ').slice(0, 120));
+
+  // Broadcast : une nouvelle session découverte est poussée via session_update au rafraîchissement périodique.
+  writeJsonl(workDir, 'sid-new');
+  const pushed = await c.waitMsg((m) => m.type === 'session_update' && m.session?.id === 'sid-new', 13000);
+  check('broadcast WS d’une session découverte (refresh périodique)', pushed?.session?.source === 'discovered');
+
+  c.ws.close();
+} catch (err) {
+  check('exception', false, String(err));
+} finally {
+  liveProc.kill('SIGKILL');
+  srv.kill('SIGTERM');
+  await sleep(1500);
+  check('arrêt propre du daemon (SIGTERM)', srv.exitCode === 0 || srv.signalCode === null || srv.exitCode === null);
+  rmSync(tmp, { recursive: true, force: true });
+  const failed = results.filter((r) => !r.ok);
+  console.log(failed.length === 0 ? '\nACCEPTANCE P2: ALL GREEN' : `\nACCEPTANCE P2: ${failed.length} FAILURE(S)`);
+  process.exit(failed.length === 0 ? 0 : 1);
+}

packages/server/src/app.ts

@@ -9,6 +9,7 @@ import type { Config } from './config.js';
 import type { Db } from './db/index.js';
 import { AuthService, LoginRateLimiter, type AuthContext } from './auth/service.js';
 import { PtyManager } from './core/pty-manager.js';
+import { DiscoveryService } from './core/discovery-service.js';
 import { registerAuthRoutes } from './routes/auth.js';
 import { registerSessionRoutes } from './routes/sessions.js';
 import { registerWsGateway } from './ws/gateway.js';
@@ -26,13 +27,19 @@ export interface AppBundle {
   app: FastifyInstance;
   auth: AuthService;
   manager: PtyManager;
+  discovery: DiscoveryService;
 }
 
 export function buildApp(config: Config, db: Db, serverVersion: string): AppBundle {
   const app = Fastify({ logger: { level: process.env.ARBORETUM_LOG ?? 'info' } });
   const auth = new AuthService(db);
   const limiter = new LoginRateLimiter();
-  const manager = new PtyManager(db);
+  const manager = new PtyManager(db, config.claudeSessionsDir);
+  const discovery = new DiscoveryService({
+    ptyManager: manager,
+    projectsDir: config.claudeProjectsDir,
+    sessionsDir: config.claudeSessionsDir,
+  });
 
   void app.register(fastifyCookie);
   void app.register(fastifyWebsocket, {
@@ -72,11 +79,11 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
   });
 
   registerAuthRoutes(app, auth, limiter, serverVersion);
-  registerSessionRoutes(app, manager);
+  registerSessionRoutes(app, manager, discovery);
   // La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
   // encapsulé) — sinon le handler reçoit la signature REST (request, reply).
   void app.register(async (scoped) => {
-    registerWsGateway(scoped, manager, serverVersion);
+    registerWsGateway(scoped, manager, discovery, serverVersion);
   });
 
   // SPA buildée embarquée dans le paquet npm (public/) — absente en dev (vite dev sert le front)
@@ -91,5 +98,5 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
     });
   }
 
-  return { app, auth, manager };
+  return { app, auth, manager, discovery };
 }

packages/server/src/config.ts

@@ -11,6 +11,10 @@ export interface Config {
   /** origins supplémentaires autorisées (ex. https://machine.tailnet.ts.net) */
   allowedOrigins: string[];
   printToken: boolean;
+  /** ~/.claude/projects (transcripts JSONL) — surchargeable via --claude-home (tests). */
+  claudeProjectsDir: string;
+  /** ~/.claude/sessions (registre des sessions CLI vivantes). */
+  claudeSessionsDir: string;
 }
 
 export function loadConfig(argv = process.argv.slice(2)): Config {
@@ -23,6 +27,8 @@ export function loadConfig(argv = process.argv.slice(2)): Config {
       'allow-origin': { type: 'string', multiple: true },
       'print-token': { type: 'boolean', default: false },
       'i-know-this-exposes-a-terminal': { type: 'boolean', default: false },
+      // racine de l'install Claude (~/.claude par défaut) — surchargée par les tests d'acceptation.
+      'claude-home': { type: 'string' },
     },
     strict: true,
   });
@@ -39,6 +45,7 @@ export function loadConfig(argv = process.argv.slice(2)): Config {
 
   const dataDir = join(process.env.XDG_DATA_HOME ?? join(homedir(), '.local', 'share'), 'arboretum');
   mkdirSync(dataDir, { recursive: true });
+  const claudeHome = values['claude-home'] ?? join(homedir(), '.claude');
   return {
     port: Number(values.port),
     bind,
@@ -46,5 +53,7 @@ export function loadConfig(argv = process.argv.slice(2)): Config {
     dataDir,
     allowedOrigins: values['allow-origin'] ?? [],
     printToken: values['print-token'] ?? false,
+    claudeProjectsDir: join(claudeHome, 'projects'),
+    claudeSessionsDir: join(claudeHome, 'sessions'),
   };
 }

packages/server/src/core/claude-launcher.ts

@@ -6,6 +6,12 @@ export interface SpawnSpec {
   env: NodeJS.ProcessEnv;
 }
 
+export interface SpawnOptions {
+  command: 'claude' | 'bash';
+  /** reprise d'une session existante (P2) : `--resume <id>`, `--fork-session` si fork. */
+  resume?: { claudeSessionId: string; fork?: boolean };
+}
+
 let cachedClaudeBin: string | null = null;
 
 export function resolveClaudeBin(): string {
@@ -21,14 +27,20 @@ export function resolveClaudeBin(): string {
 }
 
 /** Module volontairement abstrait : le plan B « BYO API key / Agent SDK » se brancherait ici. */
-export function buildSpawnSpec(command: 'claude' | 'bash'): SpawnSpec {
+export function buildSpawnSpec(opts: SpawnOptions): SpawnSpec {
   const env: NodeJS.ProcessEnv = {
     ...process.env,
     TERM: 'xterm-256color',
     COLORTERM: 'truecolor',
   };
-  if (command === 'bash') {
+  if (opts.command === 'bash') {
     return { file: 'bash', args: ['--norc'], env };
   }
-  return { file: resolveClaudeBin(), args: [], env };
+  const args: string[] = [];
+  if (opts.resume) {
+    // `--resume` doit toujours s'exécuter dans le cwd d'origine (garanti par l'appelant — spike S1).
+    args.push('--resume', opts.resume.claudeSessionId);
+    if (opts.resume.fork) args.push('--fork-session');
+  }
+  return { file: resolveClaudeBin(), args, env };
 }

packages/server/src/core/discovery-service.ts

@@ -0,0 +1,137 @@
+// Service de découverte : second producteur de SessionSummary (à côté du PtyManager).
+// Scanne ~/.claude/projects (JSONL) + ~/.claude/sessions (registre), corrèle par claudeSessionId,
+// calcule la vivacité, met en cache et notifie les changements. Lecture seule du disque.
+import { EventEmitter } from 'node:events';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import type { SessionSummary } from '@arboretum/shared';
+import { scanProjects, type DiscoveredJsonl } from './jsonl-discovery.js';
+import { readRegistry, type RegistryEntry } from './session-registry.js';
+import type { PtyManager } from './pty-manager.js';
+
+const DEFAULT_REFRESH_MS = 10_000;
+
+export interface DiscoveryServiceEvents {
+  /** session découverte nouvelle ou modifiée (relayée en session_update par la gateway). */
+  discovery_update: [SessionSummary];
+}
+
+export interface DiscoveryOptions {
+  ptyManager: PtyManager;
+  projectsDir?: string;
+  sessionsDir?: string;
+  refreshMs?: number;
+}
+
+export class DiscoveryService extends EventEmitter<DiscoveryServiceEvents> {
+  private readonly projectsDir: string;
+  private readonly sessionsDir: string;
+  private readonly ptyManager: PtyManager;
+  private readonly refreshMs: number;
+  private timer: NodeJS.Timeout | null = null;
+  private cache: SessionSummary[] = [];
+  private byId = new Map<string, DiscoveredJsonl>();
+  private prevJson = new Map<string, string>();
+
+  constructor(opts: DiscoveryOptions) {
+    super();
+    this.ptyManager = opts.ptyManager;
+    this.projectsDir = opts.projectsDir ?? join(homedir(), '.claude', 'projects');
+    this.sessionsDir = opts.sessionsDir ?? join(homedir(), '.claude', 'sessions');
+    this.refreshMs = opts.refreshMs ?? DEFAULT_REFRESH_MS;
+  }
+
+  start(): void {
+    if (this.timer) return;
+    void this.refresh(); // premier scan asynchrone : ne bloque pas le boot
+    this.timer = setInterval(() => void this.refresh(), this.refreshMs);
+    this.timer.unref(); // ne maintient pas le process en vie
+  }
+
+  stop(): void {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+    }
+  }
+
+  /** Cache courant (jamais de scan synchrone dans le chemin chaud). */
+  list(): SessionSummary[] {
+    return this.cache;
+  }
+
+  /** Session découverte (avec son cwd d'origine lu sur disque) — pour resume/fork. null si absente. */
+  getDiscovered(claudeSessionId: string): DiscoveredJsonl | null {
+    return this.byId.get(claudeSessionId) ?? null;
+  }
+
+  /**
+   * Vivacité FRAÎCHE d'une session (relit le registre, ne se fie pas au cache) — garde-fou
+   * anti-corruption : la route /resume doit refuser une session devenue vivante depuis le dernier scan.
+   */
+  isClaudeSessionLive(claudeSessionId: string): boolean {
+    const entry = readRegistry(this.sessionsDir).find((r) => r.claudeSessionId === claudeSessionId);
+    return entry?.live ?? false;
+  }
+
+  /** Recalcule le cache depuis le disque. Tolérant : ne lève jamais. */
+  async refresh(): Promise<void> {
+    const regBySid = new Map<string, RegistryEntry>();
+    for (const r of readRegistry(this.sessionsDir)) {
+      if (r.claudeSessionId) regBySid.set(r.claudeSessionId, r);
+    }
+    const known = this.ptyManager.knownClaudeSessionIds();
+
+    // Dédoublonnage des JSONL par claudeSessionId (on retient le plus récent).
+    const latest = new Map<string, DiscoveredJsonl>();
+    for (const d of await scanProjects(this.projectsDir)) {
+      const prev = latest.get(d.claudeSessionId);
+      if (!prev || d.mtimeMs > prev.mtimeMs) latest.set(d.claudeSessionId, d);
+    }
+
+    const summaries: SessionSummary[] = [];
+    const byId = new Map<string, DiscoveredJsonl>();
+    for (const d of latest.values()) {
+      if (known.has(d.claudeSessionId)) continue; // déjà gérée comme session managée
+      byId.set(d.claudeSessionId, d);
+      const r = regBySid.get(d.claudeSessionId);
+      const live = r?.live ?? false;
+      summaries.push({
+        id: d.claudeSessionId, // les découvertes s'identifient par leur claudeSessionId
+        cwd: d.cwd,
+        command: 'claude',
+        title: d.title,
+        status: live ? 'running' : 'exited',
+        live,
+        createdAt: new Date(d.mtimeMs).toISOString(),
+        endedAt: null,
+        exitCode: null,
+        clients: 0,
+        source: 'discovered',
+        claudeSessionId: d.claudeSessionId,
+        pid: live ? (r?.pid ?? null) : null,
+        resumable: !live, // morte → --resume direct ; vivante → fork/observe (jamais resume : corruption)
+        attachable: false, // Arboretum ne tient pas le PTY d'une session externe
+        registryStatus: r?.status ?? null,
+      });
+    }
+
+    this.cache = summaries;
+    this.byId = byId;
+
+    // Diff : n'émettre que les sessions nouvelles ou modifiées.
+    const nextJson = new Map<string, string>();
+    for (const s of summaries) {
+      const j = JSON.stringify(s);
+      nextJson.set(s.id, j);
+      if (this.prevJson.get(s.id) !== j) this.emit('discovery_update', s);
+    }
+    this.prevJson = nextJson;
+  }
+}
+
+/** Fusionne sessions managées + découvertes en dédoublonnant par claudeSessionId (managé prioritaire). */
+export function mergeSessions(managed: SessionSummary[], discovered: SessionSummary[]): SessionSummary[] {
+  const managedSids = new Set(managed.map((s) => s.claudeSessionId).filter((x): x is string => x != null));
+  return [...managed, ...discovered.filter((s) => !(s.claudeSessionId && managedSids.has(s.claudeSessionId)))];
+}

packages/server/src/core/jsonl-discovery.ts

@@ -0,0 +1,160 @@
+// Découverte des sessions Claude sur disque (~/.claude/projects/**/*.jsonl).
+// Transcription TS du spike S4 (scan.mjs) : parseur strictement tolérant, lecture partielle
+// tête+queue (~1,4 s pour 1300+ fichiers), 99,8 % des transcripts exploitables.
+// I/O ASYNCHRONES : le scan rend la main à la boucle d'événements entre fichiers, pour ne pas
+// figer le streaming des terminaux (il tourne périodiquement dans le DiscoveryService).
+import { readdir, stat, open } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const HEAD_BYTES = 256 * 1024;
+const TAIL_BYTES = 64 * 1024;
+const TITLE_MAX = 120;
+
+/** Reproduit le nom de dossier ~/.claude/projects à partir d'un cwd (validé 100 % — spike S4). */
+export function munge(cwd: string): string {
+  return cwd.replace(/[^A-Za-z0-9]/g, '-');
+}
+
+export interface DiscoveredJsonl {
+  claudeSessionId: string;
+  cwd: string;
+  title: string | null;
+  gitBranch: string | null;
+  version: string | null;
+  mtimeMs: number;
+  /** chemin absolu du .jsonl */
+  file: string;
+}
+
+async function readChunk(path: string, position: number, length: number): Promise<string> {
+  const fh = await open(path, 'r');
+  try {
+    const buf = Buffer.alloc(length);
+    const { bytesRead } = await fh.read(buf, 0, length, position);
+    return buf.subarray(0, bytesRead).toString('utf8');
+  } finally {
+    await fh.close();
+  }
+}
+
+/** Parse tolérant : chaque ligne en try/catch, lignes coupées/malformées ignorées (jamais de throw). */
+export function parseLines(text: string, partialFirst = false, partialLast = false): Array<Record<string, unknown>> {
+  const lines = text.split('\n');
+  if (partialFirst) lines.shift(); // 1re ligne potentiellement coupée (lecture de queue)
+  if (partialLast) lines.pop(); // dernière ligne potentiellement coupée (lecture de tête)
+  const out: Array<Record<string, unknown>> = [];
+  for (const l of lines) {
+    if (!l.trim()) continue;
+    try {
+      const o = JSON.parse(l) as unknown;
+      if (o && typeof o === 'object') out.push(o as Record<string, unknown>);
+    } catch {
+      /* ligne coupée ou malformée : ignorée */
+    }
+  }
+  return out;
+}
+
+interface Meta {
+  sessionId?: string;
+  cwd?: string;
+  gitBranch?: string;
+  version?: string;
+  aiTitle?: string;
+  summary?: string;
+  lastPrompt?: string;
+  firstUserPrompt?: string;
+}
+
+function asString(v: unknown): string | undefined {
+  return typeof v === 'string' && v.length > 0 ? v : undefined;
+}
+
+function extractMeta(objs: Array<Record<string, unknown>>, meta: Meta): void {
+  const setOnce = (key: 'sessionId' | 'cwd' | 'gitBranch' | 'version', v: unknown): void => {
+    if (meta[key] === undefined) {
+      const s = asString(v);
+      if (s) meta[key] = s;
+    }
+  };
+  for (const o of objs) {
+    setOnce('sessionId', o.sessionId);
+    setOnce('cwd', o.cwd);
+    setOnce('gitBranch', o.gitBranch);
+    setOnce('version', o.version);
+    // Titre : on retient la dernière valeur vue (la plus récente) — head puis tail → la queue gagne.
+    const ai = asString(o.aiTitle);
+    if (ai) meta.aiTitle = ai;
+    const sum = asString(o.summary);
+    if (sum) meta.summary = sum;
+    const lp = asString(o.lastPrompt);
+    if (lp) meta.lastPrompt = lp;
+    // Premier prompt utilisateur (depuis la tête) : repli ultime pour le titre.
+    if (meta.firstUserPrompt === undefined && o.type === 'user') {
+      const msg = o.message;
+      if (msg && typeof msg === 'object') {
+        const text = asString((msg as Record<string, unknown>).content);
+        if (text) meta.firstUserPrompt = text;
+      }
+    }
+  }
+}
+
+/** Priorité de titre actée S4 : ai-title > summary > last-prompt > 1er prompt user. */
+function pickTitle(meta: Meta): string | null {
+  const raw = meta.aiTitle ?? meta.summary ?? meta.lastPrompt ?? meta.firstUserPrompt ?? null;
+  if (!raw) return null;
+  const t = raw.replace(/\s+/g, ' ').trim();
+  return t.length > TITLE_MAX ? `${t.slice(0, TITLE_MAX - 1)}…` : t;
+}
+
+/**
+ * Scanne `projectsDir` en lecture partielle tête+queue. Tolérant : un dossier/fichier illisible ou
+ * malformé est ignoré (jamais de throw). Un fichier sans sessionId+cwd exploitables est écarté.
+ */
+export async function scanProjects(projectsDir: string): Promise<DiscoveredJsonl[]> {
+  let dirs: string[];
+  try {
+    dirs = await readdir(projectsDir);
+  } catch {
+    return []; // dossier absent (Claude jamais lancé) : pas une erreur
+  }
+  const out: DiscoveredJsonl[] = [];
+  for (const dir of dirs) {
+    const dirPath = join(projectsDir, dir);
+    let entries;
+    try {
+      entries = await readdir(dirPath, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries) {
+      if (!e.isFile() || !e.name.endsWith('.jsonl')) continue;
+      const fp = join(dirPath, e.name);
+      try {
+        const st = await stat(fp);
+        if (st.size === 0) continue;
+        const meta: Meta = {};
+        const head = await readChunk(fp, 0, Math.min(HEAD_BYTES, st.size));
+        extractMeta(parseLines(head, false, st.size > HEAD_BYTES), meta);
+        if (st.size > HEAD_BYTES + TAIL_BYTES) {
+          const tail = await readChunk(fp, st.size - TAIL_BYTES, TAIL_BYTES);
+          extractMeta(parseLines(tail, true, false), meta);
+        }
+        if (!meta.sessionId || !meta.cwd) continue; // pas une session exploitable
+        out.push({
+          claudeSessionId: meta.sessionId,
+          cwd: meta.cwd,
+          title: pickTitle(meta),
+          gitBranch: meta.gitBranch ?? null,
+          version: meta.version ?? null,
+          mtimeMs: st.mtimeMs,
+          file: fp,
+        });
+      } catch {
+        /* fichier illisible : ignoré */
+      }
+    }
+  }
+  return out;
+}

packages/server/src/core/pty-manager.ts

@@ -1,14 +1,20 @@
 import { EventEmitter } from 'node:events';
 import { existsSync, statSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
 import pty from '@homebridge/node-pty-prebuilt-multiarch';
 import { FLOW, REPLAY_TAIL_BYTES, type SessionSummary } from '@arboretum/shared';
 import { RingBuffer } from './ring-buffer.js';
 import { buildSpawnSpec } from './claude-launcher.js';
+import { findByPid } from './session-registry.js';
 import type { Db } from '../db/index.js';
 
 const RING_CAPACITY = 2 * 1024 * 1024;
 const KILL_GRACE_MS = 5000;
+/** Capture du claudeSessionId après spawn : poll du registre par pid (waitReady validé S1). */
+const CLAUDE_ID_POLL_MS = 400;
+const CLAUDE_ID_TIMEOUT_MS = 60_000;
 
 /** Lien entre un client WS attaché et une session. La gateway fournit les callbacks d'envoi. */
 export interface ClientBinding {
@@ -36,6 +42,8 @@ interface ManagedSession {
   paused: boolean;
   exited: { exitCode: number | null; signal: number | null } | null;
   killTimer: NodeJS.Timeout | null;
+  /** ID interne du CLI claude, résolu via le registre après spawn (null pour bash / pas encore prêt). */
+  claudeSessionId: string | null;
 }
 
 export interface PtyManagerEvents {
@@ -46,17 +54,21 @@ export interface PtyManagerEvents {
 export class PtyManager extends EventEmitter<PtyManagerEvents> {
   private readonly live = new Map<string, ManagedSession>();
 
-  constructor(private readonly db: Db) {
+  constructor(
+    private readonly db: Db,
+    private readonly sessionsDir: string = join(homedir(), '.claude', 'sessions'),
+  ) {
     super();
   }
 
-  spawn(opts: { cwd: string; command?: 'claude' | 'bash' }): SessionSummary {
+  spawn(opts: { cwd: string; command?: 'claude' | 'bash'; resume?: { claudeSessionId: string; fork?: boolean } }): SessionSummary {
     const cwd = opts.cwd;
     if (!existsSync(cwd) || !statSync(cwd).isDirectory()) {
       throw Object.assign(new Error(`Not a directory: ${cwd}`), { statusCode: 400 });
     }
-    const command = opts.command ?? 'claude';
-    const spec = buildSpawnSpec(command);
+    // Un resume/fork est toujours une session claude (le cwd d'origine est garanti par l'appelant — S1).
+    const command = opts.resume ? 'claude' : (opts.command ?? 'claude');
+    const spec = buildSpawnSpec({ command, ...(opts.resume ? { resume: opts.resume } : {}) });
     const id = randomUUID();
     const proc = pty.spawn(spec.file, spec.args, {
       name: 'xterm-256color',
@@ -77,26 +89,66 @@ export class PtyManager extends EventEmitter<PtyManagerEvents> {
       paused: false,
       exited: null,
       killTimer: null,
+      claudeSessionId: null,
     };
     this.live.set(id, session);
     this.db
-      .prepare('INSERT INTO sessions (id, cwd, command, created_at) VALUES (?, ?, ?, ?)')
-      .run(id, cwd, command, session.createdAt);
+      .prepare('INSERT INTO sessions (id, cwd, command, created_at, resumed_from) VALUES (?, ?, ?, ?, ?)')
+      .run(id, cwd, command, session.createdAt, opts.resume?.claudeSessionId ?? null);
 
     proc.onData((data) => this.handleOutput(session, Buffer.from(data, 'utf8')));
     proc.onExit(({ exitCode, signal }) => this.handleExit(session, exitCode, signal ?? null));
+    if (command === 'claude') this.captureClaudeSessionId(session);
 
     const summary = this.summarize(session);
     this.emit('session_update', summary);
     return summary;
   }
 
+  /** Résout le claudeSessionId du CLI en pollant le registre par pid, puis le persiste (waitReady — S1). */
+  private captureClaudeSessionId(s: ManagedSession): void {
+    const deadline = Date.now() + CLAUDE_ID_TIMEOUT_MS;
+    const tick = (): void => {
+      if (s.exited || s.claudeSessionId) return;
+      const entry = findByPid(this.sessionsDir, s.proc.pid);
+      if (entry?.claudeSessionId) {
+        s.claudeSessionId = entry.claudeSessionId;
+        this.db.prepare('UPDATE sessions SET claude_session_id = ? WHERE id = ?').run(entry.claudeSessionId, s.id);
+        this.emit('session_update', this.summarize(s));
+        return;
+      }
+      if (Date.now() < deadline) setTimeout(tick, CLAUDE_ID_POLL_MS).unref();
+    };
+    setTimeout(tick, CLAUDE_ID_POLL_MS).unref();
+  }
+
+  /** Session managée VIVANTE portant ce claudeSessionId (garde-fou anti-resume d'une session vivante). */
+  findLiveByClaudeSessionId(claudeSessionId: string): SessionSummary | null {
+    for (const s of this.live.values()) {
+      if (s.claudeSessionId === claudeSessionId) return this.summarize(s);
+    }
+    return null;
+  }
+
+  /**
+   * Ensemble des claudeSessionId déjà connus d'Arboretum (sessions managées vivantes + historique DB).
+   * Sert au DiscoveryService à exclure les doublons (une managée ne doit pas réapparaître en découverte).
+   */
+  knownClaudeSessionIds(): Set<string> {
+    const rows = this.db
+      .prepare('SELECT claude_session_id FROM sessions WHERE claude_session_id IS NOT NULL')
+      .all() as Array<{ claude_session_id: string }>;
+    const set = new Set(rows.map((r) => r.claude_session_id));
+    for (const s of this.live.values()) if (s.claudeSessionId) set.add(s.claudeSessionId);
+    return set;
+  }
+
   list(): SessionSummary[] {
     const liveSummaries = [...this.live.values()].map((s) => this.summarize(s));
     const liveIds = new Set(this.live.keys());
     const rows = this.db
-      .prepare('SELECT id, cwd, command, title, created_at, ended_at, exit_code FROM sessions ORDER BY created_at DESC LIMIT 100')
-      .all() as Array<{ id: string; cwd: string; command: string; title: string | null; created_at: string; ended_at: string | null; exit_code: number | null }>;
+      .prepare('SELECT id, cwd, command, title, created_at, ended_at, exit_code, claude_session_id FROM sessions ORDER BY created_at DESC LIMIT 100')
+      .all() as Array<{ id: string; cwd: string; command: string; title: string | null; created_at: string; ended_at: string | null; exit_code: number | null; claude_session_id: string | null }>;
     const historical: SessionSummary[] = rows
       .filter((r) => !liveIds.has(r.id))
       .map((r) => ({
@@ -110,6 +162,13 @@ export class PtyManager extends EventEmitter<PtyManagerEvents> {
         endedAt: r.ended_at,
         exitCode: r.exit_code,
         clients: 0,
+        source: 'managed',
+        claudeSessionId: r.claude_session_id,
+        pid: null,
+        // une session claude morte avec un claudeSessionId connu est reprenable (--resume direct).
+        resumable: r.command === 'claude' && r.claude_session_id != null,
+        attachable: false,
+        registryStatus: null,
       }));
     return [...liveSummaries, ...historical];
   }
@@ -265,6 +324,13 @@ export class PtyManager extends EventEmitter<PtyManagerEvents> {
       endedAt: null,
       exitCode: s.exited?.exitCode ?? null,
       clients: s.clients.size,
+      source: 'managed',
+      claudeSessionId: s.claudeSessionId,
+      pid: s.exited ? null : s.proc.pid,
+      // une managée vivante ne se resume pas (corruption) ; une managée claude morte oui.
+      resumable: !!s.exited && s.command === 'claude' && s.claudeSessionId != null,
+      attachable: !s.exited,
+      registryStatus: null, // P2 : statut fin des managées via claude-adapter (P3-B)
     };
   }
 }

packages/server/src/core/session-registry.ts

@@ -0,0 +1,92 @@
+// Lecture du registre ~/.claude/sessions (un fichier <pid>.json par session CLI vive).
+// Module partagé : P2 l'utilise pour la vivacité + le lookup par pid ; P3-B (claude-adapter)
+// s'en sert comme source primaire d'état fin (busy/idle/waiting + waitingFor).
+import { readdirSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import type { SessionRegistryStatus } from '@arboretum/shared';
+
+export interface RegistryEntry {
+  claudeSessionId: string | null;
+  cwd: string | null;
+  pid: number;
+  procStart: string | null;
+  status: SessionRegistryStatus | null;
+  waitingFor: string | null;
+  /** vivacité réelle = pid + procStart concordants (jamais la simple présence du fichier). */
+  live: boolean;
+}
+
+/** starttime (champ 22 de /proc/<pid>/stat) ou null si le process n'existe pas. Linux-only. */
+export function readProcStart(pid: number): string | null {
+  try {
+    const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
+    // Le nom du process (champ 2) peut contenir espaces/parenthèses → parser après le dernier ')'.
+    const after = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
+    return after[19] ?? null; // champ 22 global = index 19 après le champ 3
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Vivacité par pid + procStart (spike S1/S4) : jamais la présence d'un fichier registre (stale possible).
+ * "Incertain → vivant" : si le process existe mais que le registre n'a pas de procStart, on traite vivant.
+ */
+export function isLive(pid: number, procStart: string | number | null | undefined): boolean {
+  const actual = readProcStart(pid);
+  if (actual === null) return false; // process absent → mort
+  if (procStart === null || procStart === undefined) return true; // incertain → vivant
+  return String(procStart) === actual; // procStart discordant → pid recyclé → stale → mort
+}
+
+function normalizeStatus(v: unknown): SessionRegistryStatus | null {
+  return v === 'busy' || v === 'idle' || v === 'waiting' ? v : null;
+}
+
+function toEntry(r: Record<string, unknown>): RegistryEntry | null {
+  const pid = typeof r.pid === 'number' ? r.pid : Number(r.pid);
+  if (!Number.isInteger(pid)) return null;
+  const procStart = r.procStart === undefined || r.procStart === null ? null : String(r.procStart);
+  return {
+    claudeSessionId: typeof r.sessionId === 'string' ? r.sessionId : null,
+    cwd: typeof r.cwd === 'string' ? r.cwd : null,
+    pid,
+    procStart,
+    status: normalizeStatus(r.status),
+    waitingFor: typeof r.waitingFor === 'string' ? r.waitingFor : null,
+    live: isLive(pid, procStart),
+  };
+}
+
+/**
+ * Lit toutes les entrées de `sessionsDir`. Tolérant aux fichiers en cours d'écriture / JSON invalide
+ * (ignorés). Dossier absent → tableau vide (pas une erreur).
+ */
+export function readRegistry(sessionsDir: string): RegistryEntry[] {
+  let files: string[];
+  try {
+    files = readdirSync(sessionsDir);
+  } catch {
+    return [];
+  }
+  const out: RegistryEntry[] = [];
+  for (const f of files) {
+    if (!f.endsWith('.json')) continue;
+    try {
+      const r = JSON.parse(readFileSync(join(sessionsDir, f), 'utf8')) as Record<string, unknown>;
+      const entry = toEntry(r);
+      if (entry) out.push(entry);
+    } catch {
+      /* fichier en cours d'écriture / JSON invalide : ignoré */
+    }
+  }
+  return out;
+}
+
+/**
+ * Entrée registre correspondant à un pid donné (le CLI nomme son fichier <pid>.json, mais on
+ * matche sur le champ `pid` pour ne pas dépendre du nommage). null si absente/illisible.
+ */
+export function findByPid(sessionsDir: string, pid: number): RegistryEntry | null {
+  return readRegistry(sessionsDir).find((e) => e.pid === pid) ?? null;
+}

packages/server/src/db/index.ts

@@ -27,6 +27,15 @@ const MIGRATIONS: Array<{ id: number; sql: string }> = [
       );
     `,
   },
+  {
+    // P2 — découverte & reprise : corrélation avec les sessions Claude sur disque.
+    id: 2,
+    sql: `
+      ALTER TABLE sessions ADD COLUMN claude_session_id TEXT;
+      ALTER TABLE sessions ADD COLUMN resumed_from TEXT;
+      CREATE INDEX idx_sessions_claude_session_id ON sessions(claude_session_id);
+    `,
+  },
 ];
 
 export type Db = DatabaseSync;

packages/server/src/index.ts

@@ -13,10 +13,11 @@ const pkg = JSON.parse(
 async function main(): Promise<void> {
   const config = loadConfig();
   const db = openDb(config.dbPath);
-  const { app, auth, manager } = buildApp(config, db, pkg.version);
+  const { app, auth, manager, discovery } = buildApp(config, db, pkg.version);
 
   const bootstrapToken = auth.ensureBootstrapToken();
   await app.listen({ port: config.port, host: config.bind });
+  discovery.start(); // scan initial + rafraîchissement périodique des sessions découvertes
 
   const url = `http://${config.bind === '0.0.0.0' ? '127.0.0.1' : config.bind}:${config.port}`;
   app.log.info(`Arboretum v${pkg.version} — ${url}`);
@@ -36,6 +37,7 @@ async function main(): Promise<void> {
     if (shuttingDown) return;
     shuttingDown = true;
     app.log.info(`${signal} received — draining sessions then exiting`);
+    discovery.stop();
     manager.shutdown();
     setTimeout(() => {
       void app.close().then(() => process.exit(0));

packages/server/src/routes/sessions.ts

@@ -1,10 +1,11 @@
 import type { FastifyInstance } from 'fastify';
 import type { CreateSessionRequest, SessionResponse, SessionsListResponse } from '@arboretum/shared';
 import type { PtyManager } from '../core/pty-manager.js';
+import { mergeSessions, type DiscoveryService } from '../core/discovery-service.js';
 
-export function registerSessionRoutes(app: FastifyInstance, manager: PtyManager): void {
+export function registerSessionRoutes(app: FastifyInstance, manager: PtyManager, discovery: DiscoveryService): void {
   app.get('/api/v1/sessions', async (): Promise<SessionsListResponse> => {
-    return { sessions: manager.list() };
+    return { sessions: mergeSessions(manager.list(), discovery.list()) };
   });
 
   app.post('/api/v1/sessions', async (req, reply) => {
@@ -25,6 +26,45 @@ export function registerSessionRoutes(app: FastifyInstance, manager: PtyManager)
     }
   });
 
+  // Reprise d'une session morte : nouveau PTY managé `--resume <id>` DANS SON CWD D'ORIGINE (spike S1).
+  // Le cwd n'est jamais fourni par le client : il est lu sur disque via la découverte.
+  app.post('/api/v1/sessions/:id/resume', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    const discovered = discovery.getDiscovered(id);
+    if (!discovered) {
+      return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No resumable session with this id' } });
+    }
+    // Garde-fou anti-corruption : jamais de resume direct d'une session vivante (vérif FRAÎCHE).
+    if (discovery.isClaudeSessionLive(id) || manager.findLiveByClaudeSessionId(id)) {
+      return reply.status(409).send({ error: { code: 'SESSION_LIVE', message: 'Session is live — fork it instead' } });
+    }
+    try {
+      const session = manager.spawn({ cwd: discovered.cwd, resume: { claudeSessionId: id } });
+      const res: SessionResponse = { session };
+      return reply.status(201).send(res);
+    } catch (err) {
+      const statusCode = (err as { statusCode?: number }).statusCode ?? 500;
+      return reply.status(statusCode).send({ error: { code: 'SPAWN_FAILED', message: (err as Error).message } });
+    }
+  });
+
+  // Fork : duplique une session (vivante ou morte) sans la corrompre (`--resume <id> --fork-session`).
+  app.post('/api/v1/sessions/:id/fork', async (req, reply) => {
+    const { id } = req.params as { id: string };
+    const discovered = discovery.getDiscovered(id);
+    if (!discovered) {
+      return reply.status(404).send({ error: { code: 'NOT_FOUND', message: 'No session with this id to fork' } });
+    }
+    try {
+      const session = manager.spawn({ cwd: discovered.cwd, resume: { claudeSessionId: id, fork: true } });
+      const res: SessionResponse = { session };
+      return reply.status(201).send(res);
+    } catch (err) {
+      const statusCode = (err as { statusCode?: number }).statusCode ?? 500;
+      return reply.status(statusCode).send({ error: { code: 'SPAWN_FAILED', message: (err as Error).message } });
+    }
+  });
+
   app.delete('/api/v1/sessions/:id', async (req, reply) => {
     const { id } = req.params as { id: string };
     if (!manager.kill(id)) {

packages/server/src/ws/gateway.ts

@@ -9,6 +9,7 @@ import {
   type SessionSummary,
 } from '@arboretum/shared';
 import type { ClientBinding, PtyManager } from '../core/pty-manager.js';
+import type { DiscoveryService } from '../core/discovery-service.js';
 
 const HEARTBEAT_MS = 30_000;
 
@@ -17,7 +18,12 @@ interface ChannelState {
   binding: ClientBinding;
 }
 
-export function registerWsGateway(app: FastifyInstance, manager: PtyManager, serverVersion: string): void {
+export function registerWsGateway(
+  app: FastifyInstance,
+  manager: PtyManager,
+  discovery: DiscoveryService,
+  serverVersion: string,
+): void {
   app.get('/ws', { websocket: true }, (socket: WebSocket, req) => {
     // L'auth + le check Origin ont eu lieu dans le preValidation global (app.ts).
     const channels = new Map<number, ChannelState>();
@@ -39,8 +45,13 @@ export function registerWsGateway(app: FastifyInstance, manager: PtyManager, ser
     const onSessionExit = (e: { sessionId: string; exitCode: number | null; signal: number | null }): void => {
       if (subscribedSessions) send({ type: 'session_exit', ...e });
     };
+    // Les sessions découvertes (DiscoveryService) sont relayées sur le même flux que les managées.
+    const onDiscoveryUpdate = (session: SessionSummary): void => {
+      if (subscribedSessions) send({ type: 'session_update', session });
+    };
     manager.on('session_update', onSessionUpdate);
     manager.on('session_exit', onSessionExit);
+    discovery.on('discovery_update', onDiscoveryUpdate);
 
     const heartbeat = setInterval(() => {
       if (!alive) {
@@ -148,6 +159,7 @@ export function registerWsGateway(app: FastifyInstance, manager: PtyManager, ser
       clearInterval(heartbeat);
       manager.off('session_update', onSessionUpdate);
       manager.off('session_exit', onSessionExit);
+      discovery.off('discovery_update', onDiscoveryUpdate);
       for (const [, st] of channels) manager.detach(st.sessionId, st.binding);
       channels.clear();
     });

packages/server/test/app.e2e.test.ts

@@ -1,11 +1,16 @@
-import { mkdtempSync, rmSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
 import { buildApp, type AppBundle } from '../src/app.js';
 import { openDb, type Db } from '../src/db/index.js';
+import { munge } from '../src/core/jsonl-discovery.js';
+import { readProcStart } from '../src/core/session-registry.js';
 import type { Config } from '../src/config.js';
 
+// resolveClaudeBin() fait `which claude` : on le stub pour ne pas dépendre d'un claude réel en PATH.
+vi.mock('node:child_process', () => ({ execFileSync: () => '/usr/bin/claude\n' }));
+
 // Aucun vrai PTY en CI : le module node-pty est remplacé par un faux inerte.
 vi.mock('@homebridge/node-pty-prebuilt-multiarch', () => {
   class FakePty {
@@ -49,6 +54,9 @@ function makeApp(name: string): TestApp {
     dataDir: dir,
     allowedOrigins: [ALLOWED_ORIGIN],
     printToken: false,
+    // ~/.claude jetable, propre à chaque app (jamais le vrai HOME).
+    claudeProjectsDir: join(dir, `${name}-claude`, 'projects'),
+    claudeSessionsDir: join(dir, `${name}-claude`, 'sessions'),
   };
   const bundle = buildApp(config, db, '0.0.0-test');
   const token = bundle.auth.ensureBootstrapToken();
@@ -268,3 +276,64 @@ describe('app e2e — rate limit du login', () => {
     expect(blocked.json()).toMatchObject({ error: { code: 'RATE_LIMITED' } });
   });
 });
+
+describe('app e2e — découverte, resume & fork (P2)', () => {
+  let t: TestApp;
+  let projectsDir: string;
+  let sessionsDir: string;
+
+  const bearer = (): Record<string, string> => ({ authorization: `Bearer ${t.token}` });
+
+  function writeDiscoveredJsonl(cwd: string, sid: string): void {
+    const d = join(projectsDir, munge(cwd));
+    mkdirSync(d, { recursive: true });
+    writeFileSync(join(d, `${sid}.jsonl`), `${JSON.stringify({ type: 'user', sessionId: sid, cwd, message: { content: `prompt ${sid}` } })}\n`);
+  }
+
+  beforeAll(() => {
+    t = makeApp('resume');
+    projectsDir = join(dir, 'resume-claude', 'projects');
+    sessionsDir = join(dir, 'resume-claude', 'sessions');
+    mkdirSync(sessionsDir, { recursive: true });
+  });
+
+  it('resume / fork d’un id inconnu → 404', async () => {
+    const r = await t.bundle.app.inject({ method: 'POST', url: '/api/v1/sessions/nope/resume', headers: bearer() });
+    expect(r.statusCode).toBe(404);
+    const f = await t.bundle.app.inject({ method: 'POST', url: '/api/v1/sessions/nope/fork', headers: bearer() });
+    expect(f.statusCode).toBe(404);
+  });
+
+  it('session morte découverte → listée puis resume 201 (PTY claude dans son cwd)', async () => {
+    writeDiscoveredJsonl(dir, 'dead-e2e'); // cwd = dir (existe), donc le spawn de resume réussit
+    await t.bundle.discovery.refresh();
+
+    const list = await t.bundle.app.inject({ method: 'GET', url: '/api/v1/sessions', headers: bearer() });
+    const found = (list.json() as { sessions: Array<{ id: string; source: string; resumable: boolean }> }).sessions.find(
+      (s) => s.id === 'dead-e2e',
+    );
+    expect(found).toMatchObject({ source: 'discovered', resumable: true });
+
+    const res = await t.bundle.app.inject({ method: 'POST', url: '/api/v1/sessions/dead-e2e/resume', headers: bearer() });
+    expect(res.statusCode).toBe(201);
+    expect((res.json() as { session: { command: string; source: string } }).session).toMatchObject({ command: 'claude', source: 'managed' });
+  });
+
+  it('session vivante découverte → resume refusé (409), fork autorisé (201)', async () => {
+    const sid = 'live-e2e';
+    writeDiscoveredJsonl(dir, sid);
+    const ps = readProcStart(process.pid) as string;
+    writeFileSync(
+      join(sessionsDir, `${process.pid}.json`),
+      JSON.stringify({ pid: process.pid, procStart: ps, sessionId: sid, cwd: dir, status: 'busy' }),
+    );
+    await t.bundle.discovery.refresh();
+
+    const resume = await t.bundle.app.inject({ method: 'POST', url: `/api/v1/sessions/${sid}/resume`, headers: bearer() });
+    expect(resume.statusCode).toBe(409);
+    expect(resume.json()).toMatchObject({ error: { code: 'SESSION_LIVE' } });
+
+    const fork = await t.bundle.app.inject({ method: 'POST', url: `/api/v1/sessions/${sid}/fork`, headers: bearer() });
+    expect(fork.statusCode).toBe(201);
+  });
+});

packages/server/test/discovery-service.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import type { SessionSummary } from '@arboretum/shared';
+import { DiscoveryService, mergeSessions } from '../src/core/discovery-service.js';
+import { munge } from '../src/core/jsonl-discovery.js';
+import { readProcStart } from '../src/core/session-registry.js';
+import { PtyManager } from '../src/core/pty-manager.js';
+import { openDb, type Db } from '../src/db/index.js';
+
+function writeJsonl(projectsDir: string, cwd: string, sid: string): void {
+  const dir = join(projectsDir, munge(cwd));
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(
+    join(dir, `${sid}.jsonl`),
+    `${JSON.stringify({ type: 'user', sessionId: sid, cwd, message: { content: `prompt ${sid}` } })}\n`,
+  );
+}
+
+describe('DiscoveryService', () => {
+  let projectsDir: string;
+  let sessionsDir: string;
+  let db: Db;
+  let manager: PtyManager;
+  let svc: DiscoveryService;
+
+  beforeEach(() => {
+    projectsDir = mkdtempSync(join(tmpdir(), 'arb-proj-'));
+    sessionsDir = mkdtempSync(join(tmpdir(), 'arb-sess-'));
+    db = openDb(':memory:');
+    manager = new PtyManager(db, sessionsDir);
+    svc = new DiscoveryService({ ptyManager: manager, projectsDir, sessionsDir });
+  });
+  afterEach(() => {
+    svc.stop();
+    rmSync(projectsDir, { recursive: true, force: true });
+    rmSync(sessionsDir, { recursive: true, force: true });
+  });
+
+  it('session morte (pas d’entrée registre) → resumable, non attachable', async () => {
+    writeJsonl(projectsDir, '/home/u/dead', 'dead-sid');
+    await svc.refresh();
+    const s = svc.list().find((x) => x.id === 'dead-sid');
+    expect(s).toMatchObject({ source: 'discovered', live: false, resumable: true, attachable: false, cwd: '/home/u/dead' });
+    expect(svc.getDiscovered('dead-sid')?.cwd).toBe('/home/u/dead');
+  });
+
+  it('session vivante (registre + pid vivant) → live, non resumable, registryStatus exposé', async () => {
+    writeJsonl(projectsDir, '/home/u/live', 'live-sid');
+    const ps = readProcStart(process.pid) as string;
+    writeFileSync(
+      join(sessionsDir, `${process.pid}.json`),
+      JSON.stringify({ pid: process.pid, procStart: ps, sessionId: 'live-sid', cwd: '/home/u/live', status: 'waiting', waitingFor: 'permission prompt' }),
+    );
+    await svc.refresh();
+    const s = svc.list().find((x) => x.id === 'live-sid');
+    expect(s).toMatchObject({ live: true, resumable: false, attachable: false, registryStatus: 'waiting', pid: process.pid });
+  });
+
+  it('exclut une session déjà connue d’Arboretum (managée / historique)', async () => {
+    writeJsonl(projectsDir, '/home/u/managed', 'managed-sid');
+    db.prepare('INSERT INTO sessions (id, cwd, command, created_at, claude_session_id) VALUES (?, ?, ?, ?, ?)').run(
+      'uuid-1',
+      '/home/u/managed',
+      'claude',
+      new Date().toISOString(),
+      'managed-sid',
+    );
+    await svc.refresh();
+    expect(svc.list().find((x) => x.id === 'managed-sid')).toBeUndefined();
+  });
+
+  it('émet discovery_update sur changement uniquement', async () => {
+    writeJsonl(projectsDir, '/home/u/x', 'sid-x');
+    const seen: SessionSummary[] = [];
+    svc.on('discovery_update', (s) => seen.push(s));
+    await svc.refresh();
+    expect(seen.map((s) => s.id)).toContain('sid-x');
+    seen.length = 0;
+    await svc.refresh(); // rien n'a changé → aucune ré-émission
+    expect(seen).toHaveLength(0);
+  });
+});
+
+describe('mergeSessions', () => {
+  const mk = (id: string, claudeSessionId: string | null, source: 'managed' | 'discovered'): SessionSummary => ({
+    id,
+    cwd: '/x',
+    command: 'claude',
+    title: null,
+    status: 'exited',
+    live: false,
+    createdAt: '',
+    endedAt: null,
+    exitCode: null,
+    clients: 0,
+    source,
+    claudeSessionId,
+    pid: null,
+    resumable: false,
+    attachable: false,
+    registryStatus: null,
+  });
+
+  it('dédoublonne par claudeSessionId, managé prioritaire', () => {
+    const managed = [mk('uuid', 'sid-1', 'managed')];
+    const discovered = [mk('sid-1', 'sid-1', 'discovered'), mk('sid-2', 'sid-2', 'discovered')];
+    expect(mergeSessions(managed, discovered).map((s) => s.id)).toEqual(['uuid', 'sid-2']);
+  });
+});

packages/server/test/jsonl-discovery.test.ts

@@ -0,0 +1,93 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, mkdirSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { munge, parseLines, scanProjects } from '../src/core/jsonl-discovery.js';
+
+function writeJsonl(projectsDir: string, cwd: string, sid: string, lines: object[]): void {
+  const dir = join(projectsDir, munge(cwd));
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, `${sid}.jsonl`), `${lines.map((l) => JSON.stringify(l)).join('\n')}\n`);
+}
+
+describe('munge', () => {
+  it('reproduit le nom de dossier ~/.claude/projects', () => {
+    expect(munge('/home/x/My Project!')).toBe('-home-x-My-Project-');
+    expect(munge('/home/johan/WebstormProjects/arboretum')).toBe('-home-johan-WebstormProjects-arboretum');
+  });
+});
+
+describe('parseLines (tolérance)', () => {
+  it('ignore les lignes vides, coupées ou malformées sans throw', () => {
+    const text = '{"a":1}\n\n{not json}\n{"b":2}\n{"c":';
+    expect(parseLines(text)).toEqual([{ a: 1 }, { b: 2 }]);
+  });
+  it('shift/pop les lignes partielles en bord de chunk', () => {
+    const text = 'partial}\n{"ok":1}\n{also partial';
+    expect(parseLines(text, true, true)).toEqual([{ ok: 1 }]);
+  });
+});
+
+describe('scanProjects', () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'arb-jsonl-'));
+  });
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('dossier absent → tableau vide', async () => {
+    expect(await scanProjects(join(dir, 'nope'))).toEqual([]);
+  });
+
+  it('extrait claudeSessionId + cwd + branche + version', async () => {
+    writeJsonl(dir, '/home/u/proj', 'sid-1', [
+      { type: 'user', sessionId: 'sid-1', cwd: '/home/u/proj', gitBranch: 'main', version: '2.1.170', message: { content: 'hello world' } },
+    ]);
+    const res = await scanProjects(dir);
+    expect(res).toHaveLength(1);
+    expect(res[0]).toMatchObject({ claudeSessionId: 'sid-1', cwd: '/home/u/proj', gitBranch: 'main', version: '2.1.170' });
+  });
+
+  it('écarte un fichier sans cwd (queue-operation only)', async () => {
+    writeJsonl(dir, '/x', 'sid-q', [{ type: 'queue-operation', sessionId: 'sid-q' }]);
+    expect(await scanProjects(dir)).toEqual([]);
+  });
+
+  it('survit à une ligne malformée et reste exploitable', async () => {
+    const d = join(dir, munge('/home/u/p2'));
+    mkdirSync(d, { recursive: true });
+    writeFileSync(
+      join(d, 'sid-2.jsonl'),
+      `{bad json\n${JSON.stringify({ type: 'user', sessionId: 'sid-2', cwd: '/home/u/p2', message: { content: 'ok' } })}\n`,
+    );
+    const res = await scanProjects(dir);
+    expect(res).toHaveLength(1);
+    expect(res[0].claudeSessionId).toBe('sid-2');
+  });
+
+  describe('priorité de titre (ai-title > summary > last-prompt > 1er user)', () => {
+    it('ai-title gagne sur tout', async () => {
+      writeJsonl(dir, '/t/1', 's', [
+        { type: 'user', sessionId: 's', cwd: '/t/1', message: { content: 'premier prompt' } },
+        { type: 'summary', sessionId: 's', summary: 'un résumé' },
+        { type: 'last-prompt', sessionId: 's', lastPrompt: 'dernier prompt' },
+        { type: 'ai-title', sessionId: 's', aiTitle: 'Titre IA' },
+      ]);
+      expect((await scanProjects(dir))[0].title).toBe('Titre IA');
+    });
+    it('summary gagne sur last-prompt et user', async () => {
+      writeJsonl(dir, '/t/2', 's', [
+        { type: 'user', sessionId: 's', cwd: '/t/2', message: { content: 'premier prompt' } },
+        { type: 'last-prompt', sessionId: 's', lastPrompt: 'dernier prompt' },
+        { type: 'summary', sessionId: 's', summary: 'un résumé' },
+      ]);
+      expect((await scanProjects(dir))[0].title).toBe('un résumé');
+    });
+    it('repli ultime sur le premier prompt user', async () => {
+      writeJsonl(dir, '/t/3', 's', [{ type: 'user', sessionId: 's', cwd: '/t/3', message: { content: 'premier prompt' } }]);
+      expect((await scanProjects(dir))[0].title).toBe('premier prompt');
+    });
+  });
+});

packages/server/test/pty-manager.test.ts

@@ -1,9 +1,14 @@
 import { tmpdir } from 'node:os';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
 import { beforeEach, describe, expect, it, vi, type Mock } from 'vitest';
 import { FLOW, REPLAY_TAIL_BYTES, type SessionSummary } from '@arboretum/shared';
 import { PtyManager, type ClientBinding } from '../src/core/pty-manager.js';
 import { openDb, type Db } from '../src/db/index.js';
 
+// resolveClaudeBin() fait `which claude` : on le stub pour ne pas dépendre d'un claude réel en PATH.
+vi.mock('node:child_process', () => ({ execFileSync: () => '/usr/bin/claude\n' }));
+
 interface FakePty {
   pid: number;
   file: string;
@@ -135,6 +140,68 @@ describe('PtyManager (pty mocké)', () => {
       const row = db.prepare('SELECT COUNT(*) AS n FROM sessions').get() as { n: number };
       expect(row.n).toBe(0);
     });
+
+    it('summarize expose les champs P2 (source/attachable/resumable/pid)', () => {
+      const { summary } = spawnBash();
+      expect(summary).toMatchObject({
+        source: 'managed',
+        attachable: true,
+        resumable: false,
+        registryStatus: null,
+        claudeSessionId: null,
+      });
+      expect(summary.pid).toBeGreaterThan(0);
+    });
+  });
+
+  describe('resume / fork (P2)', () => {
+    it('resume → pty claude avec --resume, command forcé à claude, resumed_from persisté', () => {
+      const summary = manager.spawn({ cwd, resume: { claudeSessionId: 'abc-123' } });
+      const p = lastPty();
+      expect(summary.command).toBe('claude');
+      expect(summary.source).toBe('managed');
+      expect(summary.attachable).toBe(true);
+      expect(p.file).toBe('/usr/bin/claude');
+      expect(p.args).toEqual(['--resume', 'abc-123']);
+      const row = db.prepare('SELECT resumed_from, command FROM sessions WHERE id = ?').get(summary.id) as {
+        resumed_from: string | null;
+        command: string;
+      };
+      expect(row).toEqual({ resumed_from: 'abc-123', command: 'claude' });
+    });
+
+    it('fork → --resume <id> --fork-session', () => {
+      manager.spawn({ cwd, resume: { claudeSessionId: 'xyz', fork: true } });
+      expect(lastPty().args).toEqual(['--resume', 'xyz', '--fork-session']);
+    });
+
+    it('session claude morte avec claudeSessionId connu → resumable dans list()', () => {
+      const summary = manager.spawn({ cwd, resume: { claudeSessionId: 'sid-known' } });
+      // simule la capture du claudeSessionId (normalement résolue via le registre)
+      db.prepare('UPDATE sessions SET claude_session_id = ? WHERE id = ?').run('sid-known', summary.id);
+      lastPty().emitExit(0);
+      const listed = manager.list().find((s) => s.id === summary.id);
+      expect(listed).toMatchObject({ live: false, resumable: true, claudeSessionId: 'sid-known' });
+    });
+
+    it('capture le claudeSessionId via le registre (poll par pid) → findLiveByClaudeSessionId', () => {
+      vi.useFakeTimers();
+      const sessDir = mkdtempSync(join(tmpdir(), 'arb-sess-'));
+      try {
+        const m = new PtyManager(db, sessDir);
+        const summary = m.spawn({ cwd, command: 'claude' });
+        const p = lastPty();
+        writeFileSync(join(sessDir, `${p.pid}.json`), JSON.stringify({ pid: p.pid, sessionId: 'captured-sid', status: 'idle' }));
+        expect(m.findLiveByClaudeSessionId('captured-sid')).toBeNull(); // pas encore capturé
+        vi.advanceTimersByTime(400);
+        const found = m.findLiveByClaudeSessionId('captured-sid');
+        expect(found?.id).toBe(summary.id);
+        expect(found?.claudeSessionId).toBe('captured-sid');
+      } finally {
+        vi.useRealTimers();
+        rmSync(sessDir, { recursive: true, force: true });
+      }
+    });
   });
 
   describe('attach', () => {

packages/server/test/session-registry.test.ts

@@ -0,0 +1,67 @@
+import { describe, expect, it, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { readProcStart, isLive, readRegistry, findByPid } from '../src/core/session-registry.js';
+
+const DEAD_PID = 2 ** 31 - 1; // pid quasi impossible à attribuer
+
+describe('readProcStart / isLive', () => {
+  it('lit le procStart du process courant et le valide', () => {
+    const ps = readProcStart(process.pid);
+    expect(ps).not.toBeNull();
+    expect(isLive(process.pid, ps as string)).toBe(true);
+  });
+  it('process absent → mort', () => {
+    expect(readProcStart(DEAD_PID)).toBeNull();
+    expect(isLive(DEAD_PID, '123')).toBe(false);
+  });
+  it('procStart discordant (pid recyclé) → stale → mort', () => {
+    expect(isLive(process.pid, 'definitely-not-the-real-starttime')).toBe(false);
+  });
+  it('procStart inconnu mais process vivant → incertain → vivant', () => {
+    expect(isLive(process.pid, null)).toBe(true);
+  });
+});
+
+describe('readRegistry', () => {
+  let dir: string;
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), 'arb-reg-'));
+  });
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it('dossier absent → vide', () => {
+    expect(readRegistry(join(dir, 'nope'))).toEqual([]);
+  });
+
+  it('calcule live par pid+procStart et ignore les fichiers malformés', () => {
+    const ps = readProcStart(process.pid) as string;
+    writeFileSync(
+      join(dir, `${process.pid}.json`),
+      JSON.stringify({ pid: process.pid, procStart: ps, sessionId: 'live-sid', cwd: '/x', status: 'busy' }),
+    );
+    writeFileSync(
+      join(dir, `${DEAD_PID}.json`),
+      JSON.stringify({ pid: DEAD_PID, procStart: '999', sessionId: 'dead-sid', cwd: '/y', status: 'idle' }),
+    );
+    writeFileSync(join(dir, 'broken.json'), '{ not json');
+
+    const entries = readRegistry(dir);
+    expect(entries).toHaveLength(2);
+    const live = entries.find((e) => e.pid === process.pid);
+    expect(live?.live).toBe(true);
+    expect(live?.status).toBe('busy');
+    expect(live?.claudeSessionId).toBe('live-sid');
+    const dead = entries.find((e) => e.pid === DEAD_PID);
+    expect(dead?.live).toBe(false);
+    expect(findByPid(dir, process.pid)?.claudeSessionId).toBe('live-sid');
+  });
+
+  it('normalise un status inconnu en null', () => {
+    writeFileSync(join(dir, `${DEAD_PID}.json`), JSON.stringify({ pid: DEAD_PID, status: 'weird' }));
+    expect(readRegistry(dir)[0].status).toBeNull();
+  });
+});