fix(acp,#4760): dedup concurrent createSessionAsync by sessionId

.claude-internals/competitors/cc-connect-tracking-2026-05-30.md

@@ -0,0 +1,91 @@
+# Competitive Intelligence — cc-connect (chenhg5/cc-connect)
+
+**Last updated:** 2026-05-30  
+**Previous update:** 2026-05-07  
+**Updated by:** Scribe (Athena assignment)
+
+## Current Stats
+
+| Metric | Value | Change since 2026-05-07 |
+|--------|-------|------------------------|
+| Stars | 11,043 | +3,543 (+47% in 23 days) |
+| Forks | 1,009 | +260 |
+| Open issues | 479 | +~100 |
+| Latest stable | v1.3.2 (2026-04-21) | No new stable |
+| Latest beta | v1.3.3-beta.4 (2026-05-27) | 4 beta releases since tracking |
+| Language | Go | — |
+| License | None | — |
+| Description | Bridge local AI coding agents to messaging platforms | Expanded to include Cursor, Gemini CLI, Codex |
+
+## Version History (since 2026-05-07)
+
+### v1.3.3-beta.4 (2026-05-27)
+- Fixed web console 404 regression in release builds
+- Fixed Slack @mention parsing without trailing space
+- Fixed DingTalk picture message handling
+- Fixed Feishu require_mention=false ignored
+- Fixed AskUserQuestion resolved by empty delivery receipts (security fix)
+- Fixed Codex env config not honored at startup
+- Fixed Codex explicit stdio app-server URL lost across restarts
+- Fixed OpenCode session ID extraction and yolo mode
+- Fixed Feishu concurrency safety and Windows test compat
+- **New:** `max_turn_time_mins` config — absolute wall-clock cap per agent turn with two-phase shutdown
+- 8 external contributors
+
+### v1.3.3-beta.3 (2026-05-24)
+- Blackbox testing framework (Phase 1-2)
+- Cursor and OpenCode agent support in tests
+- Codex stdio sentinel for app_server backend
+- Kimi session UUID capture from stderr
+
+### v1.3.3-beta.2 (2026-05-09)
+- Slack Assistant API support with Agent toggle
+- DingTalk richText message support
+- MAX messenger webhook delivery mode
+- Claude Code project-level environment variables
+- `display_mode` enum replacing `quiet` boolean
+- Claude Code custom system prompt configuration
+- Bridge security: require token when Bridge is enabled
+
+## Platform Coverage
+
+**Chat platforms (12):**
+Feishu/Lark, DingTalk, Slack, Telegram, Discord, LINE, WeChat Work (企业微信), WeChat (微信), QQ Bot, MAX messenger, iMessage (via bridge), Web console
+
+**AI agent backends (10+):**
+Claude Code, Cursor, Gemini CLI, Codex, OpenCode, Kimi, Devin, Trae CLI ACP, COCO ACP, NekoCode, VisionCoder, AIHubMix
+
+## Release Cadence
+
+- 4 beta releases in 23 days (May 7 → May 30)
+- Average: ~1 beta every 5-6 days
+- External contributor activity: 8 contributors in beta.4 alone
+- Stable v1.3.2 released 2026-04-21 — v1.3.3 stable expected soon
+
+## New Features Since Last Tracking
+
+| Feature | Aegis Status | Priority |
+|---------|-------------|----------|
+| Cursor agent support | ❌ Not started | Phase-4c per ADR-0032 |
+| OpenCode agent support | ❌ Not started | Phase-4c |
+| Kimi agent support | ❌ Not started | Phase-4c |
+| `max_turn_time_mins` wall-clock cap | ⚠️ Aegis has idle timeout, not per-turn cap | Medium — useful for production |
+| Codex env config + stdio app-server | ✅ ADR-0032 covers Codex via NdjsonRpcTransport | In progress (#3180) |
+| Slack Assistant API | ❌ Aegis has basic Slack | Medium |
+| Blackbox testing framework | ⚠️ Aegis has E2E tests | Maintain advantage |
+| `display_mode` enum | ⚠️ Aegis uses verbose config | Low |
+
+## Growth Trajectory
+
+- 7,500 → 11,043 stars in 23 days = **+47% growth**
+- Fork rate: ~11 new forks/day
+- Issue velocity: ~4-5 new issues/day
+- External contributor count increasing (8 in latest beta)
+
+This is sustained hypergrowth. cc-connect is on track for 15K+ stars by end of June 2026 at current velocity.
+
+## Files for Reference
+- Previous tracking: `cc-connect-tracking-2026-05-07.md`
+- Issue analysis: #3004
+- Competitive landscape: #3016
+- Threat matrix: `docs/competitive-threat-matrix.md`

.claude/rules/branching.md

@@ -36,3 +36,27 @@ hotfix/<issue-number>-<short-description>
 - ❌ Never open a PR targeting `main` unless maintainer explicitly says so
 - ❌ Never merge your own PR — Argus reviews and merges
 - ❌ Never open a PR with failing CI
+- ❌ Never open a bot-authored PR without a documented approval path — see
+  the [Path (b) Fallback in CONTRIBUTING.md](../../CONTRIBUTING.md#path-b-fallback-boss-approves-via-cli-on-bot-authored-prs)
+
+## Bot-authored PRs
+
+If you are submitting a PR from a bot identity (e.g., `aegis-gh-agent[bot]`,
+`dependabot[bot]`, or a per-agent App once registered), the PR cannot
+self-approve. The [Path (b) Fallback in CONTRIBUTING.md](../../CONTRIBUTING.md#path-b-fallback-boss-approves-via-cli-on-bot-authored-prs)
+documents the lane:
+
+```bash
+# Ema (or another authorized human) runs this from their machine
+gh pr review --approve <PR_NUMBER>
+```
+
+The structural fix (a dedicated reviewer App / PAT) is tracked in
+[#4725](https://github.com/OneStepAt4time/aegis/issues/4725). Until that lands,
+Path (b) is the documented lane. Branch protection's
+`required_approving_review_count: 1` is still enforced — the human click
+counts as the approval; Argus's pre-stage review is the technical LGTM.
+
+For unattended-merge scenarios (overnight, hotfix window), see
+[#4728](https://github.com/OneStepAt4time/aegis/issues/4728) (fallback approver
+chain — adds an owner-overridable bot approver).

.claude/rules/prs.md

@@ -24,3 +24,39 @@ Keep PRs minimal and focused. One concern per PR. If a PR touches more than 20 f
 ## Review
 
 All PRs require review before merge. Argus is the validation steward.
+
+## Bot-authored PRs (Path (b) Fallback)
+
+Bot-authored PRs (e.g., `aegis-gh-agent[bot]`, `dependabot[bot]`, or per-agent
+Apps once registered) cannot self-approve on GitHub. The
+[Path (b) Fallback in CONTRIBUTING.md](../../CONTRIBUTING.md#path-b-fallback-boss-approves-via-cli-on-bot-authored-prs)
+documents the lane convention Ema uses to unblock such PRs:
+
+```bash
+# Ema runs this from their machine (NOT a bot, NOT a CI runner)
+gh pr review --approve <PR_NUMBER>
+```
+
+The structural fix (a dedicated reviewer App / PAT) is tracked in
+[#4725](https://github.com/OneStepAt4time/aegis/issues/4725). Until that lands,
+Path (b) is the documented lane for human approval clicks on bot-authored PRs.
+Branch protection's `required_approving_review_count: 1` is still enforced
+(Argus pre-stages the review, Ema's click counts as the second eye).
+
+**When you're submitting a bot-authored PR:**
+
+1. Open the PR with the bot identity (the bot must be the author, not a
+   human proxy).
+2. Wait for CI green + Argus's pre-stage review.
+3. Request an explicit human approval click in `#aegis-devs` with
+   `@<Ema's Discord ID>` — do **not** assume the bot can self-approve.
+4. Once the human approves, the PR is mergeable per the standard flow.
+
+**When you're reviewing a bot-authored PR:**
+
+- Bot-authored PRs follow the same review bar as human-authored ones
+  (Functional Code Gate, evidence template, CI green).
+- The approval step is split: Argus does the technical LGTM, Ema (or
+  another authorized human) does the approval click. See
+  [Path (b) in CONTRIBUTING.md](../../CONTRIBUTING.md#path-b-fallback-boss-approves-via-cli-on-bot-authored-prs)
+  for the full rationale.

.githooks/post-merge

@@ -0,0 +1,39 @@
+#!/usr/bin/env sh
+# post-merge hook — auto-rebuild and restart Aegis after develop merges.
+#
+# Triggers when `git pull` (or merge) completes on the develop branch.
+# Rebuilds the server and restarts the systemd service.
+#
+# To install: npm run hooks:install
+# (or: git config core.hooksPath .githooks)
+
+set -eu
+
+BRANCH=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
+
+if [ "$BRANCH" != "develop" ]; then
+  exit 0
+fi
+
+echo "[post-merge] Develop branch updated. Rebuilding Aegis..."
+
+# Rebuild
+if ! npm run build > /dev/null 2>&1; then
+  echo "[post-merge] ❌ Build failed. Not restarting."
+  exit 1
+fi
+
+echo "[post-merge] ✅ Build succeeded."
+
+# Restart if Aegis service is running
+if systemctl --user is-active --quiet aegis 2>/dev/null; then
+  echo "[post-merge] Restarting Aegis service..."
+  systemctl --user restart aegis
+  echo "[post-merge] ✅ Aegis restarted."
+elif systemctl --user is-active --quiet manus 2>/dev/null; then
+  echo "[post-merge] Restarting manus service (legacy name)..."
+  systemctl --user restart manus
+  echo "[post-merge] ✅ manus restarted."
+else
+  echo "[post-merge] ℹ️  No running Aegis service found. Start manually: npm start"
+fi