refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

Create 6 domain-focused config files in src/config/ to centralize operational
tuning knobs that were scattered across 15+ source files:

- server-timing.ts: SSE batching, state debounce, scheduled runs, error recovery
- auth-config.ts: session TTL, rate limits, hook timeout
- tunnel-config.ts: QR token rotation, tunnel process lifecycle
- terminal-limits.ts: input length, terminal cols/rows, session name
- ai-defaults.ts: AI model string, idle/plan context limits
- team-config.ts: poll interval, cache sizes

Eliminates all cross-file duplicates:
- AI model string: 5 occurrences → 1 (config only)
- STATS_COLLECTION_INTERVAL_MS: 2 → 1
- timeout: 10000 in hooks-config: 6 → 0 (now HOOK_TIMEOUT_MS)
- MAX_TRACKED_AGENTS shadow: removed, imports from map-limits

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/config/ai-defaults.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Default model and context limits for AI-powered checkers.
+ *
+ * Centralizes the AI model identifier and context window sizes used by
+ * the idle checker, plan checker, respawn controller defaults, and
+ * respawn route fallbacks. Change the model here when upgrading.
+ *
+ * @module config/ai-defaults
+ */
+
+/** Default model for AI idle and plan checkers */
+export const AI_CHECK_MODEL = 'claude-opus-4-5-20251101';
+
+/** Max context chars for idle checker (~4k tokens) */
+export const AI_IDLE_CHECK_MAX_CONTEXT = 16000;
+
+/** Max context chars for plan checker (~2k tokens, plan mode UI is compact) */
+export const AI_PLAN_CHECK_MAX_CONTEXT = 8000;

src/config/auth-config.ts

@@ -0,0 +1,35 @@
+/**
+ * @fileoverview Authentication, rate limiting, and hook security constants.
+ *
+ * Controls auth session lifecycle, brute-force protection,
+ * and Claude Code hook timeouts.
+ *
+ * @module config/auth-config
+ */
+
+// ============================================================================
+// Session Cookies
+// ============================================================================
+
+/** Auth session cookie TTL — matches autonomous run length (ms) */
+export const AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
+
+/** Max concurrent auth sessions per server */
+export const MAX_AUTH_SESSIONS = 100;
+
+// ============================================================================
+// Rate Limiting
+// ============================================================================
+
+/** Max failed auth attempts per IP before 429 rejection */
+export const AUTH_FAILURE_MAX = 10;
+
+/** Failed auth attempt tracking window (ms) */
+export const AUTH_FAILURE_WINDOW_MS = 15 * 60 * 1000;
+
+// ============================================================================
+// Hooks
+// ============================================================================
+
+/** Timeout for Claude Code hook curl commands (ms) */
+export const HOOK_TIMEOUT_MS = 10000;

src/config/map-limits.ts

@@ -47,6 +47,15 @@ export const MAX_TODOS_PER_SESSION = 500;
 // Pending Tool Calls Limits
 // ============================================================================
 
+// ============================================================================
+// Agent Tracking Limits
+// ============================================================================
+
+/**
+ * Maximum agents to track across all sessions (LRU eviction when exceeded).
+ */
+export const MAX_TRACKED_AGENTS = 500;
+
 /**
  * Maximum pending tool calls to track per subagent.
  * Entries should be cleaned up on tool_result, but this prevents leaks.

src/config/server-timing.ts

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Web server performance and scheduling constants.
+ *
+ * Controls terminal batching throughput, SSE health checking,
+ * state persistence debouncing, and scheduled run timing.
+ *
+ * @module config/server-timing
+ */
+
+// ============================================================================
+// Terminal & SSE Performance
+// ============================================================================
+
+/** Terminal data batching interval — targets 60fps (ms) */
+export const TERMINAL_BATCH_INTERVAL = 16;
+
+/** Immediate flush threshold for terminal batches (bytes).
+ * Set high (32KB) to allow effective batching; avg Ink events are ~14KB. */
+export const BATCH_FLUSH_THRESHOLD = 32 * 1024;
+
+/** Task event batching interval (ms) */
+export const TASK_UPDATE_BATCH_INTERVAL = 100;
+
+/** SSE client health check interval (ms) */
+export const SSE_HEALTH_CHECK_INTERVAL = 30 * 1000;
+
+// ============================================================================
+// State Persistence
+// ============================================================================
+
+/** State update debounce — batches expensive toDetailedState() calls (ms) */
+export const STATE_UPDATE_DEBOUNCE_INTERVAL = 500;
+
+/** Sessions list cache TTL — avoids re-serializing on every SSE init (ms) */
+export const SESSIONS_LIST_CACHE_TTL = 1000;
+
+// ============================================================================
+// Scheduled Runs
+// ============================================================================
+
+/** Scheduled runs cleanup check interval (ms) */
+export const SCHEDULED_CLEANUP_INTERVAL = 5 * 60 * 1000;
+
+/** Completed scheduled run max age before cleanup (ms) */
+export const SCHEDULED_RUN_MAX_AGE = 60 * 60 * 1000;
+
+/** Session limit retry wait before retrying (ms) */
+export const SESSION_LIMIT_WAIT_MS = 5000;
+
+/** Pause between scheduled run iterations (ms) */
+export const ITERATION_PAUSE_MS = 2000;
+
+// ============================================================================
+// Mux Stats
+// ============================================================================
+
+/** Mux stats collection interval (ms) */
+export const STATS_COLLECTION_INTERVAL_MS = 2000;
+
+// ============================================================================
+// Process Error Recovery
+// ============================================================================
+
+/** Max consecutive unhandled errors before auto-restart */
+export const MAX_CONSECUTIVE_ERRORS = 5;
+
+/** Error counter reset interval — forgives errors after quiet period (ms) */
+export const ERROR_RESET_MS = 60_000;

src/config/team-config.ts

@@ -0,0 +1,18 @@
+/**
+ * @fileoverview Agent Teams polling and cache configuration.
+ *
+ * Controls how frequently TeamWatcher polls ~/.claude/teams/
+ * and how many teams/tasks are cached in memory.
+ *
+ * @module config/team-config
+ */
+
+/** Team directory poll interval (ms) */
+export const TEAM_POLL_INTERVAL_MS = 30_000;
+
+/** Max cached team configs (LRU eviction) */
+export const MAX_CACHED_TEAMS = 50;
+
+/** Max cached team tasks and inbox messages (LRU eviction).
+ * Used for both teamTasks and inboxCache maps. */
+export const MAX_CACHED_TASKS = 200;

src/config/terminal-limits.ts

@@ -0,0 +1,21 @@
+/**
+ * @fileoverview Terminal dimension and input validation limits.
+ *
+ * Used by API routes to validate resize, input, and session
+ * creation requests. Separate from buffer-limits.ts which
+ * controls memory buffer sizes.
+ *
+ * @module config/terminal-limits
+ */
+
+/** Max input length per API request (bytes) */
+export const MAX_INPUT_LENGTH = 64 * 1024;
+
+/** Max terminal columns for resize requests */
+export const MAX_TERMINAL_COLS = 500;
+
+/** Max terminal rows for resize requests */
+export const MAX_TERMINAL_ROWS = 200;
+
+/** Max session name length (chars) */
+export const MAX_SESSION_NAME_LENGTH = 128;

src/config/tunnel-config.ts

@@ -0,0 +1,44 @@
+/**
+ * @fileoverview Cloudflare tunnel and QR authentication constants.
+ *
+ * Controls QR token rotation timing, rate limiting,
+ * and tunnel process lifecycle.
+ *
+ * @module config/tunnel-config
+ */
+
+// ============================================================================
+// QR Token Rotation
+// ============================================================================
+
+/** QR token auto-rotation interval (ms) */
+export const QR_TOKEN_TTL_MS = 60_000;
+
+/** Grace period — previous token still valid during rotation (ms) */
+export const QR_TOKEN_GRACE_MS = 90_000;
+
+/** Length of the short code in QR URL path (chars) */
+export const SHORT_CODE_LENGTH = 6;
+
+// ============================================================================
+// QR Rate Limiting
+// ============================================================================
+
+/** Global rate limit for QR auth attempts across all IPs */
+export const QR_RATE_LIMIT_MAX = 30;
+
+/** QR rate limit reset window (ms) */
+export const QR_RATE_LIMIT_WINDOW_MS = 60_000;
+
+// ============================================================================
+// Tunnel Process Lifecycle
+// ============================================================================
+
+/** Max time to wait for cloudflared URL before timeout (ms) */
+export const URL_TIMEOUT_MS = 30_000;
+
+/** Restart delay after unexpected tunnel exit (ms) */
+export const RESTART_DELAY_MS = 5_000;
+
+/** SIGTERM → SIGKILL escalation timeout (ms) */
+export const FORCE_KILL_MS = 5_000;