v1.1 batch 2: sidebar restructure — chats under projects, max 5 + view-all, live updates

Schema (idempotent):
  ALTER TABLE sessions ADD COLUMN IF NOT EXISTS updated_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp();
The column already exists from v1 (DEFAULT NOW()); ALTER is a no-op kept for
self-documentation. Explicit clock_timestamp() bumps now run wherever the
column actually matters — see services/inference.ts and routes/sessions.ts.

Backend updated_at maintenance:
- services/inference.ts: after each terminal status UPDATE on the assistant
  message (failure / tool-call complete / clean complete), also bump
  sessions.updated_at = clock_timestamp() so the parent session jumps to
  the top of recency ordering on every assistant turn.
- routes/sessions.ts PATCH: NOW() → clock_timestamp() for consistency.

New endpoint GET /api/sidebar (routes/sidebar.ts):
  { projects: [{ id, name, recent_sessions[≤6], total_sessions }] }
One outer query for projects ordered added_at DESC; per-project Promise.all
over (recent_sessions LIMIT 6 ORDER BY updated_at DESC) and COUNT(*)::int.
Outer Promise.all parallelizes across projects. Two queries per project; the
composite idx_sessions_project(project_id, updated_at DESC) serves the inner
query. Auth via the global Remote-User hook. types/api.ts gains
SidebarSession / SidebarProject / SidebarResponse; index.ts wires the route.

Frontend foundations:
- api/types.ts mirrors the three sidebar interfaces.
- api/client.ts: api.sidebar.get() → Promise<SidebarResponse>.
- hooks/sessionEvents.ts: five-variant union — added project_created,
  project_deleted, session_created, session_deleted. session_renamed
  unchanged from Batch 1. Bus internals untouched (still a dumb
  Set<Listener>, no validation).

New hooks/useSidebar.ts (module-singleton):
- Module-scope sharedData/sharedError/sharedLoading/initialized/fetchInFlight/
  subscribers; a single sessionEvents.subscribe at module-top-level mutates
  sharedData via an exhaustive switch over the five events. load() dedupes
  parallel calls via fetchInFlight. Hook is a thin subscription layer: any
  number of mount points share state and the very first one triggers the
  single GET /api/sidebar. Subsequent mounts read cached state synchronously
  (no skeleton flash). Public shape: { data, error, loading, retry }.
- Lift to module-scope was driven by the "ONE sidebar request on mount"
  spec promise — both ProjectSidebar AND Home consume the hook now, and
  they share the singleton.

Frontend UI:
- components/ProjectSidebar.tsx (rewrite, 234 lines): per-project chevron +
  folder + name; chevron toggles expand, name navigates /project/:id.
  Expanded → ≤5 sessions with MessageSquare + name + muted relTime()
  timestamp. "View all (N)" link when total_sessions > 5, routing to
  /project/:id. Active session row uses bg-sidebar-accent. Active project
  always renders expanded (URL-derived: direct /project/:id or scan of
  recent_sessions for /session/:id). Expanded ids persisted in
  localStorage['boocode.sidebar.expanded'] with try/catch on both read and
  write. Loading shows 4 muted-pulse skeleton blocks; empty + error +
  retry button; error toast guarded by ref so it fires once per distinct
  message and resets on recovery. Remove path calls api.projects.remove
  directly + explicit project_deleted emit (replaced the prior
  useProjects() dependency which fired a redundant /api/projects on
  mount, violating the one-fetch promise).
- components/AddProjectModal.tsx: captures returned Project and emits
  project_created before onAdded() / onOpenChange(false).
- pages/Project.tsx: emits session_created after create(); trash button is
  now async with try/catch — emits session_deleted on success,
  toast.error on failure.
- pages/Home.tsx: switched from useProjects to useSidebar so loading /
  fires exactly one /api/sidebar, with no parallel /api/projects.
- pages/Session.tsx: manual inline rename now emits session_renamed on
  the success path so the sidebar updates live without a refresh (also
  fixes the regression made visible by Batch 2 — the sidebar caches
  session names where the project page used to re-fetch on every visit).

useProjects.ts retains a project_deleted emit inside remove for any future
caller; no live consumer uses it (ProjectSidebar calls api.projects.remove
directly). Acknowledged dead code, to be removed in the next cleanup pass
along with three remaining NOW() → clock_timestamp() consistency flips at
routes/messages.ts:70, routes/messages.ts:127, and services/auto_name.ts:144.

Cross-tab parity for session_created/session_deleted/project_created/
project_deleted is deferred — those events are tab-local in Batch 2 per
spec. session_renamed continues to propagate cross-tab via the existing
WS frame from Batch 1.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/pages/Home.tsx

@@ -1,13 +1,13 @@
 import { useState } from 'react';
 import { Button } from '@/components/ui/button';
 import { AddProjectModal } from '@/components/AddProjectModal';
-import { useProjects } from '@/hooks/useProjects';
+import { useSidebar } from '@/hooks/useSidebar';
 
 export function Home() {
-  const { projects, refresh } = useProjects();
+  const { data } = useSidebar();
   const [open, setOpen] = useState(false);
 
-  const empty = projects && projects.length === 0;
+  const empty = data ? data.projects.length === 0 : false;
 
   return (
     <div className="flex-1 flex items-center justify-center px-6">
@@ -29,7 +29,7 @@ export function Home() {
           </>
         )}
       </div>
-      <AddProjectModal open={open} onOpenChange={setOpen} onAdded={refresh} />
+      <AddProjectModal open={open} onOpenChange={setOpen} onAdded={() => {}} />
     </div>
   );
 }

apps/web/src/pages/Project.tsx

@@ -1,9 +1,11 @@
 import { useEffect, useState } from 'react';
 import { Link, useNavigate, useParams } from 'react-router-dom';
 import { Plus, MessageSquare, Trash2 } from 'lucide-react';
+import { toast } from 'sonner';
 import { api } from '@/api/client';
 import type { Project as ProjectType } from '@/api/types';
 import { Button } from '@/components/ui/button';
+import { sessionEvents } from '@/hooks/sessionEvents';
 import { useSessions } from '@/hooks/useSessions';
 
 export function Project() {
@@ -26,6 +28,7 @@ export function Project() {
     setCreating(true);
     try {
       const s = await create({});
+      sessionEvents.emit({ type: 'session_created', session: s, project_id: id });
       navigate(`/session/${s.id}`);
     } finally {
       setCreating(false);
@@ -73,7 +76,20 @@ export function Project() {
                   variant="ghost"
                   size="icon-sm"
                   aria-label="Delete session"
-                  onClick={() => void remove(s.id)}
+                  onClick={async () => {
+                    try {
+                      await remove(s.id);
+                      sessionEvents.emit({
+                        type: 'session_deleted',
+                        session_id: s.id,
+                        project_id: id!,
+                      });
+                    } catch (err) {
+                      toast.error(
+                        err instanceof Error ? err.message : 'failed to delete session'
+                      );
+                    }
+                  }}
                 >
                   <Trash2 />
                 </Button>

apps/web/src/pages/Session.tsx

@@ -60,6 +60,11 @@ export function Session() {
     }
     const updated = await api.sessions.update(id, { name: trimmed });
     setSession(updated);
+    sessionEvents.emit({
+      type: 'session_renamed',
+      session_id: id,
+      name: trimmed,
+    });
     setEditingName(false);
   }