v0.50.269 — Bootstrap supervisor fix + #1473 follow-ups

3-PR batch shipped through the full pipeline. 1 self-built PR with nesquena APPROVED + Opus pre-merge follow-ups, 2 contributor follow-ups to v0.50.267's #1473.

Highlights

bootstrap.py --foreground mode for process supervisors (#1478, closes #1458 Bug #1) — fixes a real production crash loop. The pre-fix subprocess.Popen([python, "server.py"], start_new_session=True) + exit 0 pattern broke every process supervisor (launchd, systemd, supervisord, runit, s6) — they saw the parent exit, marked the program "completed," and respawned it while the orphaned server still owned port 8787. The new --foreground flag (auto-detected via supervisor-environment vars) replaces the bootstrap process image with server.py via os.execv so KeepAlive / Restart=always work correctly. Includes runnable docs/supervisor.md: launchd plist + systemd .service + supervisord conf + diagnostic recipe.

The Opus pre-merge MUST-FIX caught a near-regression: macOS launchd sets XPC_SERVICE_NAME in every Terminal-spawned shell with values like "0" (truthy in Python!) and "application.com.apple.Terminal.<UUID>". Without the new _is_real_supervisor_value() filter, every Mac dev running ./start.sh would silently auto-promote to foreground mode — losing the /health probe, browser open, and log file redirect. Two SHOULD-FIX items also folded in: test env-var leakage cleanup, and a pre-execv os.access(python_exe, os.X_OK) guard so a broken launcher path raises a clear RuntimeError instead of OSError-then-respawn-loop.

Bugs #2 (state.db FD leak) and #3 (HTTP-unhealthy wedge) under #1458 remain open awaiting diagnostic data — explicit scope discipline.

Session.compact() now includes pending_user_message (#1479 by @Thanatos-Z) — surgical 6-line completeness fix for the v0.50.267 #1473 sidebar filter. The filter was already checking both active_stream_id AND pending_user_message to keep mid-restore sessions visible, but only the former was in the API payload. Not user-visible (the two are set/cleared atomically) but prevents future drift.

bfcache pageshow restores active session (#1480 by @dso2ng) — when a browser restores the WebUI from bfcache (back/forward navigation), the v0.50.267 in-flight reattach logic only ran on fresh page loads. The pageshow handler now refreshes through loadSession() + checkInflightOnBoot() so active streams reattach correctly.

Constituents

• #1478 — bootstrap.py --foreground mode (self-built, nesquena APPROVED + Opus follow-ups)
• #1479 — pending_user_message in Session.compact() (@Thanatos-Z)
• #1480 — bfcache pageshow inflight restore (@dso2ng)

Plus: #1477 by @dutchaiagency closed during sweep as superseded by #1478 (independent identification of the same bug, contributor credit preserved in the close comment).

Test results

• pytest tests/ — 3847 passed (was 3800; +47 net: +44 from #1478, +2 from #1479, +1 from #1480)
• QA harness — 20/20 passed, all browser API sanity checks green on isolated port 8789
• CI on stage-269 — green across Python 3.11 / 3.12 / 3.13
• Opus advisor — no blockers, all 5 verification questions checked out

Contributors

Thanks to @Thanatos-Z and @dso2ng for the contributions, and to @dutchaiagency for independently identifying the bootstrap supervisor bug (#1477).