Stop a shell, or stop all idle ones, from your account and through MCP #10630

You can now stop one of your shells, or all your idle ones, from the account page and through the sessions MCP tool. The new shell tests, test/mcp-size.test.ts (the MCP size ceilings), tsc, scripts/gate.ts and scripts/design-lint.ts pass. I also ran the MCP, settings, palette and terminal-screen suites (1428 pass, 4 skipped, 0 fail). I did not run the full bun test; the forge runs that on push. I did not start the app and click through it.

What changed

• Stop: POST /settings/shells/:id/stop ends one of your live shells. A session id that isn't yours or isn't live gets a 404, the same as an unknown one. A cross-origin post is refused with a 403.
• Stop all idle: POST /settings/shells/stop-idle ends every shell of yours with nobody attached and past half the idle limit. A shell with a peer attached is left alone.
• Receipt: each route redirects back to /settings/shells with a one-line receipt ("Shell stopped.", or "Stopped N idle shells." / "No idle shell to stop.").
• Account page: each live line has a Stop button, and Stop all idle appears above the list whenever you have a live shell.
• End record: stopping records end_reason = 'stopped' and hangs up the pty in the cell, as the idle path already does. The logic is stopShell and stopIdleShells in src/machines/shell.ts.
• MCP: sessions with kind: "shells" takes action: "end" with an id, and action: "end_idle". They say the same words as the page. No new tool and no ceiling raised.
• Tests: test/my-shells.test.ts covers stop recording stopped, a stranger's id getting a 404, a cross-origin post getting a 403, an attached peer surviving stop-all-idle, and the MCP end and end_idle receipts. docs/features/my-shells.md is updated.

Chosen not to do

• Stop uses a plain inline form, not the /-/confirm page, because stopping a shell loses nothing the forge keeps.
• No new Settings sidebar row, for the same first-view budget reason the previous issue gave.

Try it Open a machine shell, go to /settings/shells, and press Stop or Stop all idle. Over MCP, call sessions with {kind: "shells", action: "end", id} or {kind: "shells", action: "end_idle"}.

The first push was rejected by the repository's pre-push hook, which wants a "Try:" line in a commit message. I added an empty commit with one.

🤖 Generated with Claude Code

Closes #10545

You can now stop one of your shells, or all your idle ones, from the account page and through the sessions MCP tool. The new shell tests, test/mcp-size.test.ts (the MCP size ceilings), tsc, scripts/gate.ts and scripts/design-lint.ts pass. I also ran the MCP, settings, palette and terminal-screen suites (1428 pass, 4 skipped, 0 fail). I did not run the full bun test; the forge runs that on push. I did not start the app and click through it.

What changed

• Stop: POST /settings/shells/:id/stop ends one of your live shells. A session id that isn't yours or isn't live gets a 404, the same as an unknown one. A cross-origin post is refused with a 403.
• Stop all idle: POST /settings/shells/stop-idle ends every shell of yours with nobody attached and past half the idle limit. A shell with a peer attached is left alone.
• Receipt: each route redirects back to /settings/shells with a one-line receipt ("Shell stopped.", or "Stopped N idle shells." / "No idle shell to stop.").
• Account page: each live line has a Stop button, and Stop all idle appears above the list whenever you have a live shell.
• End record: stopping records end_reason = 'stopped' and hangs up the pty in the cell, as the idle path already does. The logic is stopShell and stopIdleShells in src/machines/shell.ts.
• MCP: sessions with kind: "shells" takes action: "end" with an id, and action: "end_idle". They say the same words as the page. No new tool and no ceiling raised.
• Tests: test/my-shells.test.ts covers stop recording stopped, a stranger's id getting a 404, a cross-origin post getting a 403, an attached peer surviving stop-all-idle, and the MCP end and end_idle receipts. docs/features/my-shells.md is updated.

Chosen not to do

• Stop uses a plain inline form, not the /-/confirm page, because stopping a shell loses nothing the forge keeps.
• No new Settings sidebar row, for the same first-view budget reason the previous issue gave.

Try it Open a machine shell, go to /settings/shells, and press Stop or Stop all idle. Over MCP, call sessions with {kind: "shells", action: "end", id} or {kind: "shells", action: "end_idle"}.

The first push was rejected by the repository's pre-push hook, which wants a "Try:" line in a commit message. I added an empty commit with one.

🤖 Generated with Claude Code

You can now stop a shell, or stop all idle ones, from your account page, the terminal and MCP, and each door gives the same receipt. tsc, scripts/gate.ts and test/my-shells.test.ts plus test/tui-my-shells.test.ts pass (9 tests). I did not run the full suite; the forge's check does that on push.

Terminal screen (src/tui/screens/shells.ts):

• j/k (or the arrow keys) pick a line.
• s calls stopShell on the picked live shell.
• i calls stopIdleShells.
• The receipts come from the shared STOPPED_ONE, NO_SUCH_SHELL and stoppedIdleSays and show as a toast.
• s on an ended line answers "No such shell."
• The key hints list the new keys.
• docs/features/my-shells.md now says how to reach Stop and Stop all idle in the terminal.

Tests (test/my-shells.test.ts):

• POST /settings/shells/stop-idle gives a 303 with the receipt on the page, and a cross-origin post gets 403.
• A shell with a peer attached is left alone.
• The page renders the Stop all idle button when a live shell exists.
• Over MCP, another person's token gets not_found for your shell id, and the shell stays live.
• In the terminal, i on a live shell with a peer attached says "No idle shell to stop."; s says "Shell stopped." and the shell ends.
• test/tui-my-shells.test.ts covers s and i on an ended line.

Not covered: the route test cannot show stop-idle ending a shell. The route reads the admin idle limit, which has a 5-minute floor, so no shell qualifies as idle in a test. The route test checks a shell with a peer attached survives and the zero-stopped receipt. The "stops idle ones and says how many" path is covered only by the existing function-level test, which passes the limit in.