Method create

src/server/web/session-manager.ts:137–191

* Spawns a new PTY, registers it in the session store, and wires up all * event plumbing between the PTY and the WebSocket. * * Returns the session token, or null if at capacity or PTY spawn fails. * When `user` is provided the session is associated with that user and * per-user limit

(ws: WebSocket, cols = 80, rows = 24, user?: AuthUser)

   * per-user limits are enforced.
   */
  create(ws: WebSocket, cols = 80, rows = 24, user?: AuthUser): string | null {
    if (this.isFull) return null;

    const userId = user?.id ?? "default";

    if (this.isUserAtConcurrentLimit(userId)) {
      ws.send(
        JSON.stringify({
          type: "error",
          message: `Session limit reached for your account (max ${this.maxSessionsPerUser}).`,
        }),
      );
      ws.close(1013, "Per-user session limit reached");
      return null;
    }

    if (this.isUserRateLimited(userId)) {
      ws.send(
        JSON.stringify({
          type: "error",
          message: "Too many sessions created recently. Please wait before starting a new session.",
        }),
      );
      ws.close(1013, "Rate limited");
      return null;
    }

    let pty: IPty;
    try {
      pty = this.spawnPty(cols, rows, user);
    } catch (err) {
      const message =
        err instanceof Error ? err.message : "Unknown PTY spawn error";
      ws.send(
        JSON.stringify({ type: "error", message: `PTY spawn failed: ${message}` }),
      );
      ws.close(1011, "PTY spawn failure");
      return null;
    }

    // Record the creation only after a successful spawn.
    this.rateLimiter.record(userId);

    const session = this.store.register(pty, userId);
    session.ws = ws;
    const { token } = session;

    this.wirePtyEvents(token, pty);
    this.wireWsEvents(token, ws, pty);

    console.log(
      `[session ${token.slice(0, 8)}] Created for user ${userId} (active: ${this.store.size}/${this.maxSessions})`,
    );
    return token;
  }

  /**
   * Attaches a new WebSocket to an existing session identified by `token`.