Shared/co-owned broker orphaned when an owning session exits without SessionEnd

Context

PR #381 keys broker cleanup on the owning session(s): broker.json records sessionIds, a reused broker adds the reusing session as a co-owner, and teardownBrokersForSession shuts a broker down only once no owner remains. This correctly stops a single session from tearing down a broker its siblings are still using.

Gap

If a co-owning session disappears without running its SessionEnd hook (SIGKILL, OOM, crash, host reboot), its sessionId stays in broker.json forever. When the other owners later exit gracefully, teardownBrokersForSession sees a remaining owner and preserves the broker — but no future hook will ever fire for the dead owner. The shared/worktree broker is orphaned indefinitely.

This is the same class as the original single-owner leak in #108, but surfaced by the new co-ownership model. Codex flagged it on the PR: https://github.com/openai/codex-plugin-cc/pull/381#discussion_r3535561589

Why not fix it in the SessionEnd hook

PR #381 briefly recorded a per-owner session pid (process.ppid captured at SessionStart) and pruned owners whose pid was gone. That was reverted because:

• The packaged hooks.json runs SessionStart in shell form (no args), so node's process.ppid is the ephemeral sh wrapper, not the Claude session. The recorded pid is dead almost immediately, which made every shared-broker co-owner look dead and tore down brokers still in use (regression flagged in https://github.com/openai/codex-plugin-cc/pull/381#discussion_r3535328451).
• Even with a correct anchor, process.kill(pid, 0) is unsound across PID reuse, and there is no cross-platform way to map a sessionId to a live process (macOS has no /proc; exec-form hooks aren't available in the hook schema).

A hook-side liveness signal is therefore not a reliable fix.

Proposed resolution

Solve it broker-side with the idle timeout already proposed in #108: app-server-broker.mjs self-terminates after N minutes with no active client connection. This is platform-independent, needs no PID/liveness signal, and covers both the abnormal-exit orphan and the dead-co-owner orphan in one mechanism.

This issue tracks the co-owner facet specifically; it can be closed as covered once #108's idle timeout lands (they likely share one implementation).

Related

• #108 — umbrella idle-timeout issue
• #380 / PR #381 — graceful cwd-mismatch teardown (the in-scope part, fixed)

Start with app-server-broker.mjs and read umbrella issue #108, which proposes the idle-timeout solution for this orphaned-broker case. Verify the existing broker lifecycle and determine how to confirm that a broker with no active client connection terminates, covering both abnormal exits and dead co-owners.