refactor: consolidate ~70 scattered constants into 6 new config files (phase 6)

Create 6 domain-focused config files in src/config/ to centralize operational
tuning knobs that were scattered across 15+ source files:

- server-timing.ts: SSE batching, state debounce, scheduled runs, error recovery
- auth-config.ts: session TTL, rate limits, hook timeout
- tunnel-config.ts: QR token rotation, tunnel process lifecycle
- terminal-limits.ts: input length, terminal cols/rows, session name
- ai-defaults.ts: AI model string, idle/plan context limits
- team-config.ts: poll interval, cache sizes

Eliminates all cross-file duplicates:
- AI model string: 5 occurrences → 1 (config only)
- STATS_COLLECTION_INTERVAL_MS: 2 → 1
- timeout: 10000 in hooks-config: 6 → 0 (now HOOK_TIMEOUT_MS)
- MAX_TRACKED_AGENTS shadow: removed, imports from map-limits

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/web/middleware/auth.ts

@@ -12,17 +12,15 @@ import { FastifyInstance } from 'fastify';
 import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { StaleExpirationMap } from '../../utils/index.js';
 import type { AuthSessionRecord } from '../ports/auth-port.js';
+import {
+  AUTH_SESSION_TTL_MS,
+  MAX_AUTH_SESSIONS,
+  AUTH_FAILURE_MAX,
+  AUTH_FAILURE_WINDOW_MS,
+} from '../../config/auth-config.js';
 
-// Auth session cookie TTL (24h — matches autonomous run length)
-const AUTH_SESSION_TTL_MS = 24 * 60 * 60 * 1000;
 // Auth session cookie name
 export const AUTH_COOKIE_NAME = 'codeman_session';
-// Max concurrent auth sessions
-const MAX_AUTH_SESSIONS = 100;
-// Max failed auth attempts per IP before rate-limiting
-const AUTH_FAILURE_MAX = 10;
-// Failed auth attempt tracking window (15 minutes)
-const AUTH_FAILURE_WINDOW_MS = 15 * 60 * 1000;
 
 /** State returned from registerAuthMiddleware for cleanup in server stop() */
 export interface AuthState {

src/web/routes/mux-routes.ts

@@ -5,9 +5,7 @@
 
 import { FastifyInstance } from 'fastify';
 import type { InfraPort } from '../ports/index.js';
-
-// Stats collection interval (2 seconds) — matches server.ts constant
-const STATS_COLLECTION_INTERVAL_MS = 2000;
+import { STATS_COLLECTION_INTERVAL_MS } from '../../config/server-timing.js';
 
 export function registerMuxRoutes(app: FastifyInstance, ctx: InfraPort): void {
   app.get('/api/mux-sessions', async () => {

src/web/routes/respawn-routes.ts

@@ -10,6 +10,7 @@ import { RespawnConfigSchema, InteractiveRespawnSchema, RespawnEnableSchema } fr
 import { findSessionOrFail, autoConfigureRalph } from '../route-helpers.js';
 import type { SessionPort, EventPort, RespawnPort, ConfigPort, InfraPort } from '../ports/index.js';
 import { getLifecycleLog } from '../../session-lifecycle-log.js';
+import { AI_CHECK_MODEL, AI_IDLE_CHECK_MAX_CONTEXT, AI_PLAN_CHECK_MAX_CONTEXT } from '../../config/ai-defaults.js';
 
 /** No-op EventPort used to suppress broadcasts during pre-start ralph configuration. */
 const noopEventPort: EventPort = {
@@ -170,13 +171,15 @@ export function registerRespawnRoutes(
       autoAcceptPrompts: config.autoAcceptPrompts ?? currentConfig?.autoAcceptPrompts ?? true,
       autoAcceptDelayMs: config.autoAcceptDelayMs ?? currentConfig?.autoAcceptDelayMs ?? 8000,
       aiIdleCheckEnabled: config.aiIdleCheckEnabled ?? currentConfig?.aiIdleCheckEnabled ?? true,
-      aiIdleCheckModel: config.aiIdleCheckModel ?? currentConfig?.aiIdleCheckModel ?? 'claude-opus-4-5-20251101',
-      aiIdleCheckMaxContext: config.aiIdleCheckMaxContext ?? currentConfig?.aiIdleCheckMaxContext ?? 16000,
+      aiIdleCheckModel: config.aiIdleCheckModel ?? currentConfig?.aiIdleCheckModel ?? AI_CHECK_MODEL,
+      aiIdleCheckMaxContext:
+        config.aiIdleCheckMaxContext ?? currentConfig?.aiIdleCheckMaxContext ?? AI_IDLE_CHECK_MAX_CONTEXT,
       aiIdleCheckTimeoutMs: config.aiIdleCheckTimeoutMs ?? currentConfig?.aiIdleCheckTimeoutMs ?? 90000,
       aiIdleCheckCooldownMs: config.aiIdleCheckCooldownMs ?? currentConfig?.aiIdleCheckCooldownMs ?? 180000,
       aiPlanCheckEnabled: config.aiPlanCheckEnabled ?? currentConfig?.aiPlanCheckEnabled ?? true,
-      aiPlanCheckModel: config.aiPlanCheckModel ?? currentConfig?.aiPlanCheckModel ?? 'claude-opus-4-5-20251101',
-      aiPlanCheckMaxContext: config.aiPlanCheckMaxContext ?? currentConfig?.aiPlanCheckMaxContext ?? 8000,
+      aiPlanCheckModel: config.aiPlanCheckModel ?? currentConfig?.aiPlanCheckModel ?? AI_CHECK_MODEL,
+      aiPlanCheckMaxContext:
+        config.aiPlanCheckMaxContext ?? currentConfig?.aiPlanCheckMaxContext ?? AI_PLAN_CHECK_MAX_CONTEXT,
       aiPlanCheckTimeoutMs: config.aiPlanCheckTimeoutMs ?? currentConfig?.aiPlanCheckTimeoutMs ?? 60000,
       aiPlanCheckCooldownMs: config.aiPlanCheckCooldownMs ?? currentConfig?.aiPlanCheckCooldownMs ?? 30000,
       durationMinutes: currentConfig?.durationMinutes,

src/web/routes/session-routes.ts

@@ -41,11 +41,12 @@ import type { SessionPort, EventPort, ConfigPort, InfraPort, AuthPort } from '..
 import { MAX_CONCURRENT_SESSIONS } from '../../config/map-limits.js';
 import { RunSummaryTracker } from '../../run-summary.js';
 
-// Constants
-const MAX_INPUT_LENGTH = 64 * 1024;
-const MAX_TERMINAL_COLS = 500;
-const MAX_TERMINAL_ROWS = 200;
-const MAX_SESSION_NAME_LENGTH = 128;
+import {
+  MAX_INPUT_LENGTH,
+  MAX_TERMINAL_COLS,
+  MAX_TERMINAL_ROWS,
+  MAX_SESSION_NAME_LENGTH,
+} from '../../config/terminal-limits.js';
 
 // Pre-compiled regex for terminal buffer cleaning (avoids per-request compilation)
 // eslint-disable-next-line no-control-regex

src/web/server.ts

@@ -89,10 +89,19 @@ import {
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 
-// Batch terminal data for performance - collect for 16ms (60fps) before sending
-const TERMINAL_BATCH_INTERVAL = 16;
-// Batch task:updated events for 100ms
-const TASK_UPDATE_BATCH_INTERVAL = 100;
+import {
+  TERMINAL_BATCH_INTERVAL,
+  TASK_UPDATE_BATCH_INTERVAL,
+  STATE_UPDATE_DEBOUNCE_INTERVAL,
+  SESSIONS_LIST_CACHE_TTL,
+  SCHEDULED_CLEANUP_INTERVAL,
+  SCHEDULED_RUN_MAX_AGE,
+  SSE_HEALTH_CHECK_INTERVAL,
+  SESSION_LIMIT_WAIT_MS,
+  ITERATION_PAUSE_MS,
+  BATCH_FLUSH_THRESHOLD,
+  STATS_COLLECTION_INTERVAL_MS,
+} from '../config/server-timing.js';
 
 // DEC mode 2026 - Synchronized Output
 // When terminal supports this, it buffers all output between start/end markers
@@ -100,25 +109,6 @@ const TASK_UPDATE_BATCH_INTERVAL = 100;
 // Supported by: WezTerm, Kitty, Ghostty, iTerm2 3.5+, Windows Terminal, VSCode terminal
 const DEC_SYNC_START = '\x1b[?2026h'; // Begin synchronized update
 const DEC_SYNC_END = '\x1b[?2026l'; // End synchronized update (flush to screen)
-// State update debounce interval (batch expensive toDetailedState() calls)
-const STATE_UPDATE_DEBOUNCE_INTERVAL = 500;
-// Cache TTL for getLightSessionsState() — avoids re-serializing all sessions on every SSE init / /api/sessions call
-const SESSIONS_LIST_CACHE_TTL = 1000;
-// Scheduled runs cleanup interval (check every 5 minutes)
-const SCHEDULED_CLEANUP_INTERVAL = 5 * 60 * 1000;
-// Completed scheduled runs max age (1 hour)
-const SCHEDULED_RUN_MAX_AGE = 60 * 60 * 1000;
-// SSE client health check interval (every 30 seconds)
-const SSE_HEALTH_CHECK_INTERVAL = 30 * 1000;
-// Session limit wait time before retrying (5 seconds)
-const SESSION_LIMIT_WAIT_MS = 5000;
-// Pause between scheduled run iterations (2 seconds)
-const ITERATION_PAUSE_MS = 2000;
-// Terminal batch flush threshold - flush immediately if batch exceeds this size
-// Set high (32KB) to allow effective batching; avg Ink events are ~14KB
-const BATCH_FLUSH_THRESHOLD = 32 * 1024;
-// Stats collection interval (2 seconds)
-const STATS_COLLECTION_INTERVAL_MS = 2000;
 
 /**
  * Get or generate a self-signed TLS certificate for HTTPS.