feat(service): emit resume-on-restart wrapper alongside service unit

[JD2005L]

What

/agent:service install now writes a small bash shim at ~/.clawcode/service/<slug>-resume-wrapper.sh and points the unit's ExecStart (or plist ProgramArguments) at it. The wrapper runs claude --continue so the service rehydrates the prior session on restart, preserving conversation history instead of starting fresh.

Why

Pairs naturally with the new opt-in watchdog from v1.3.0: when an external probe detects a silent failure and triggers a restart, the replacement process resumes the prior conversation instead of losing all context. Previously, every restart — whether from a crash, a deploy, or a watchdog-initiated recovery — meant a clean slate. For agents running long conversations on messaging channels (Telegram, WhatsApp, etc.), context loss across restarts is the kind of papercut that accumulates fast.

The motivating case for me: on my fork, a stalled inference → watchdog kills the process → service restarts → user's next message lands in a brand-new session that has no idea what they were just talking about. With this wrapper the user barely notices the restart happened.

Wrapper behavior

• Runs claude --continue by default.
• Falls back to a plain start when there is no prior session jsonl (first boot — --continue would otherwise error).
• Falls back to a plain start when the last session jsonl is more than 7 days old. Long-stale resumes can behave oddly and in practice the user usually wants a fresh start after a week-off anyway.

All three paths exec the same underlying claude --dangerously-skip-permissions <extraArgs> — the wrapper only decides whether --continue is on the command line.

Opt out

service_plan({ action: "install", resumeOnRestart: false })

Returns the pre-change plan: unit/plist invokes claude directly, no wrapper is written, no extraFiles in the plan. Intended for users who explicitly want a fresh session on every restart.

Changes

lib/service-generator.ts

• New ExtraFile type + ServicePlan.extraFiles — lets the plan request auxiliary files be written before install commands run. Used here for the wrapper; general enough for future auxiliary files (e.g. a loader, a pre-flight probe) without needing to extend ServicePlan again.
• generateResumeWrapper() — pure generator for the bash shim. Takes claudeBin + workspace + extraArgs, bakes them into a self-contained script.
• resumeWrapperPath(slug) — canonical per-slug install path under ~/.clawcode/service/.
• generateSystemdUnit + generatePlist: new skipDefaultArgs flag. When the wrapper is in use it already embeds --dangerously-skip-permissions + extraArgs, so the unit/plist point at the wrapper bare without any args.
• ServiceOptions.resumeOnRestart (default true).
• uninstall action appends a best-effort rm -f for the wrapper so teardown leaves no stragglers.

skills/service/SKILL.md

• Install flow writes each plan.extraFiles entry (mkdir parent, Write content, chmod to declared mode) after the settings.json pre-check from v1.3.0 and before writing the unit/plist.

docs/service.md

• New "Resume-on-restart wrapper" section explaining the default behavior, fallbacks, and the opt-out.

Verification

Sanity-tested the generator directly via bun -e:

Case	Result
install / linux	wrapper emitted at ~/.clawcode/service/<slug>-resume-wrapper.sh, unit ExecStart points at it
install / darwin	wrapper emitted, plist ProgramArguments points at it
install / resumeOnRestart: false	stock claude invocation, no extraFiles
uninstall	wrapper-cleanup rm -f appended to commands

Also verified end-to-end on my agent: killed the service while mid-conversation, waited for auto-restart, observed that the new process picked up with full prior context.

Interactions with the watchdog recipe

No code coupling — they are orthogonal features. The watchdog detects "service is up but silently broken" and issues a restart; the wrapper controls what happens on restart regardless of who triggered it. Running both gives the best recovery experience but neither requires the other.

Not changed

• generatePlist on macOS still relies on launchd's ProcessType=Interactive to provide a TTY — no systemd-style script(1) wrapping here.
• pkill ExecStartPre from v1.3.0 left alone; remains the right answer for the multi-instance race.
• Existing installs are unaffected until the user re-runs /agent:service install.

Alternative considered

Embedding the --continue logic directly in generateSystemdUnit via ExecStartPre + conditional ExecStart. Rejected because launchd has no ExecStartPre equivalent and we'd end up with two different code paths. A wrapper script generalizes cleanly across both platforms.

[JD2005L]

Heads-up: this PR should land together with or after #9. #7 alone emits a resume-wrapper whose exec "$CLAUDE_BIN" ... runs claude in daemon stdio without a PTY. On systemd, that combination reproduces a permanent restart loop after Claude Code's in-process auto-updater regenerates files mid-run (graceful exit returns 1, Restart=on-failure fires forever). #9 wraps ExecStart in /usr/bin/script -q -c '...' /dev/null and pins DISABLE_AUTOUPDATER=1, which fixes the loop and makes the wrapper safe to emit. Reproduced and patched live on my fork tonight.