feat(shell): multi-shell per workspace + fix WS disconnect killing bash

BREAKING: every shell operation now requires a shellId. The Manager
previously keyed by workspaceID alone (one bash per workspace). It now
keys by (workspaceID, shellID) where shellID is a UUID returned by
Start.

Fixes the long-standing bug where the WS handler's closeAll called
stdin.Close() and killed bash when a WS client disconnected. The
Session owns the pty file; the WS handler no longer closes it. The
pty is only closed by Manager.Stop (explicit) or by captureOutput
when the process naturally exits (EOF).

- internal/shell/manager.go: Manager interface gains List and every
  method takes shellID; storage becomes
  map[workspaceID]map[shellID]*Session; Start returns (shellID, err)
  via uuid.NewString; Resize/Status/ExitStatus/Subscribe/Stdin/Stop
  route by shellID; new List(workspaceID) returns ShellInfo[] in
  creation order.
- internal/shell/session.go: Session gains ShellID + CreatedAt; Status
  type gains ShellID.
- internal/shell/manager_test.go: updated existing tests for new
  signatures; added TestShellMultiInstance (two shells in one
  workspace, no output cross-talk, independent stop, List behavior).
- internal/service/shell_service.go: wrappers carry shellID; new
  List method.
- internal/service/workspace_service.go: auto-start captures/logs
  shellID; Delete iterates and stops all workspace shells.
- internal/api/shell_handler.go: WS closeAll drops stdin.Close();
  start/restart return 201 with {shellId, pid, ...}; new list handler;
  stop/resize take shellId in body.
- internal/api/router.go: GET /api/workspaces/:id/shell (list).
- internal/model/shell.go: new ShellStartResponse, ShellInfo,
  ShellListResponse, ShellStopRequest, ShellRestartRequest; updated
  ShellStatusResponse + ShellResizeRequest to carry shellId.
- go.mod/go.sum: github.com/google/uuid.

E2E:
- workspace create -> 1 auto shell
- start 2 more -> 3 shells in list
- stop 1 -> 2 shells in list
- WS connect -> send cmd -> disconnect -> WS reconnect -> send cmd ->
  response OK, no [process exited] banner

internal/shell/manager.go

@@ -7,10 +7,12 @@ import (
 	"os/exec"
 	"sync"
 	"syscall"
+	"time"
 
 	"codespace/internal/util"
 
 	"github.com/creack/pty"
+	"github.com/google/uuid"
 )
 
 const (
@@ -20,36 +22,50 @@ const (
 // DefaultShellCommand is the default command used to launch a shell.
 const DefaultShellCommand = "bash"
 
+// ShellInfo describes a shell instance for listing.
+type ShellInfo struct {
+	ShellID     string
+	WorkspaceID string
+	Running     bool
+	PID         int
+	CreatedAt   time.Time
+	ExitCode    int
+	Signal      string
+}
+
 // Manager manages interactive shells per workspace.
 type Manager interface {
-	Start(workspaceID string, workspaceRoot string) error
-	Stop(workspaceID string) error
-	Restart(workspaceID string, workspaceRoot string) error
-	Status(workspaceID string) Status
-	Subscribe(workspaceID string) (Subscription, error)
-	Stdin(workspaceID string) (io.WriteCloser, error)
-	ExitStatus(workspaceID string) (ExitInfo, error)
-	Resize(workspaceID string, cols, rows int) error
+	Start(workspaceID string, workspaceRoot string) (string, error)
+	Stop(workspaceID string, shellID string) error
+	Restart(workspaceID string, shellID string, workspaceRoot string) (string, error)
+	Status(workspaceID string, shellID string) Status
+	Subscribe(workspaceID string, shellID string) (Subscription, error)
+	Stdin(workspaceID string, shellID string) (io.WriteCloser, error)
+	ExitStatus(workspaceID string, shellID string) (ExitInfo, error)
+	Resize(workspaceID string, shellID string, cols, rows int) error
+	List(workspaceID string) []ShellInfo
 }
 
 // LocalManager implements Manager using local OS processes.
 type LocalManager struct {
-	command  string
-	args     []string
-	mu       sync.Mutex
-	sessions map[string]*Session
-	exitedMu sync.Mutex
-	exited   map[string]struct{}
+	command    string
+	args       []string
+	mu         sync.Mutex
+	sessions   map[string]map[string]*Session // workspaceID -> shellID -> Session
+	exitedMu   sync.Mutex
+	exited     map[string]map[string]struct{} // workspaceID -> shellID -> exited
+	shellOrder map[string][]string            // workspaceID -> shellIDs in creation order
 }
 
 // NewManager creates a LocalManager with the given command and arguments.
 // If command is empty, it defaults to "bash".
 func NewManager(command string, args []string) *LocalManager {
 	return &LocalManager{
-		command:  normalizeCommand(command),
-		args:     args,
-		sessions: make(map[string]*Session),
-		exited:   make(map[string]struct{}),
+		command:    normalizeCommand(command),
+		args:       args,
+		sessions:   make(map[string]map[string]*Session),
+		exited:     make(map[string]map[string]struct{}),
+		shellOrder: make(map[string][]string),
 	}
 }
 
@@ -60,20 +76,12 @@ func normalizeCommand(command string) string {
 	return command
 }
 
-// Start launches a shell for the given workspace.
-// Returns CodeConflict if a session is already running.
-func (m *LocalManager) Start(workspaceID string, workspaceRoot string) error {
+// Start launches a new shell for the given workspace and returns its shellID.
+func (m *LocalManager) Start(workspaceID string, workspaceRoot string) (string, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	if _, ok := m.sessions[workspaceID]; ok {
-		m.exitedMu.Lock()
-		_, exited := m.exited[workspaceID]
-		m.exitedMu.Unlock()
-		if !exited {
-			return util.New(util.CodeConflict, "shell already running")
-		}
-	}
+	shellID := uuid.NewString()
 
 	cmd := exec.Command(m.command, m.args...)
 	cmd.Dir = workspaceRoot
@@ -84,27 +92,36 @@ func (m *LocalManager) Start(workspaceID string, workspaceRoot string) error {
 
 	ptyF, err := pty.StartWithSize(cmd, &pty.Winsize{Rows: 24, Cols: 80, X: 0, Y: 0})
 	if err != nil {
-		return util.Wrap(util.CodeInternal, "failed to start shell on pty", err)
+		return "", util.Wrap(util.CodeInternal, "failed to start shell on pty", err)
 	}
 
 	sess := &Session{
+		ShellID:     shellID,
 		WorkspaceID: workspaceID,
 		Root:        workspaceRoot,
 		Cmd:         cmd,
 		Stdin:       ptyF,
 		Subscribers: make(map[Subscription]struct{}),
+		CreatedAt:   time.Now().UTC(),
 	}
-	m.sessions[workspaceID] = sess
 
-	m.exitedMu.Lock()
-	delete(m.exited, workspaceID)
-	m.exitedMu.Unlock()
+	if m.sessions[workspaceID] == nil {
+		m.sessions[workspaceID] = make(map[string]*Session)
+	}
+	m.sessions[workspaceID][shellID] = sess
+
+	if m.exited[workspaceID] == nil {
+		m.exited[workspaceID] = make(map[string]struct{})
+	}
+	delete(m.exited[workspaceID], shellID)
+
+	m.shellOrder[workspaceID] = append(m.shellOrder[workspaceID], shellID)
 
 	outputDone := make(chan struct{})
 	go m.captureOutput(sess, ptyF, outputDone)
 	go m.waitExit(sess, outputDone)
 
-	return nil
+	return shellID, nil
 }
 
 // captureOutput reads from the PTY master and fans out each chunk to all
@@ -144,7 +161,10 @@ func (m *LocalManager) waitExit(sess *Session, outputDone <-chan struct{}) {
 	<-outputDone
 
 	m.exitedMu.Lock()
-	m.exited[sess.WorkspaceID] = struct{}{}
+	if m.exited[sess.WorkspaceID] == nil {
+		m.exited[sess.WorkspaceID] = make(map[string]struct{})
+	}
+	m.exited[sess.WorkspaceID][sess.ShellID] = struct{}{}
 	m.exitedMu.Unlock()
 
 	sess.mu.Lock()
@@ -162,56 +182,85 @@ func (m *LocalManager) waitExit(sess *Session, outputDone <-chan struct{}) {
 	}
 }
 
-// Stop kills the shell for the given workspace.
+// Stop kills the shell for the given workspace and shellID.
 // Returns CodeNotFound if no session exists.
-func (m *LocalManager) Stop(workspaceID string) error {
+func (m *LocalManager) Stop(workspaceID string, shellID string) error {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
-	sess, ok := m.sessions[workspaceID]
+	ws, ok := m.sessions[workspaceID]
 	if !ok {
-		return util.New(util.CodeNotFound, "no running shell for workspace")
+		return util.New(util.CodeNotFound, "shell not found")
+	}
+	sess, ok := ws[shellID]
+	if !ok {
+		return util.New(util.CodeNotFound, "shell not found")
 	}
 
 	if sess.Cmd.Process != nil {
 		_ = sess.Cmd.Process.Kill()
 	}
 
-	delete(m.sessions, workspaceID)
+	delete(ws, shellID)
+	if len(ws) == 0 {
+		delete(m.sessions, workspaceID)
+	}
+
 	m.exitedMu.Lock()
-	delete(m.exited, workspaceID)
+	if m.exited[workspaceID] != nil {
+		delete(m.exited[workspaceID], shellID)
+		if len(m.exited[workspaceID]) == 0 {
+			delete(m.exited, workspaceID)
+		}
+	}
 	m.exitedMu.Unlock()
 	return nil
 }
 
-// Restart stops (if running) then starts the shell.
-func (m *LocalManager) Restart(workspaceID string, workspaceRoot string) error {
+// Restart stops the identified shell (if running) then starts a new one.
+func (m *LocalManager) Restart(workspaceID string, shellID string, workspaceRoot string) (string, error) {
 	m.mu.Lock()
-	if sess, ok := m.sessions[workspaceID]; ok {
-		m.exitedMu.Lock()
-		_, exited := m.exited[workspaceID]
-		m.exitedMu.Unlock()
-		if !exited && sess.Cmd.Process != nil {
-			_ = sess.Cmd.Process.Kill()
+	ws, ok := m.sessions[workspaceID]
+	if ok {
+		if sess, ok := ws[shellID]; ok {
+			m.exitedMu.Lock()
+			_, exited := m.exited[workspaceID][shellID]
+			m.exitedMu.Unlock()
+			if !exited && sess.Cmd.Process != nil {
+				_ = sess.Cmd.Process.Kill()
+			}
+			delete(ws, shellID)
+			if len(ws) == 0 {
+				delete(m.sessions, workspaceID)
+			}
+			m.exitedMu.Lock()
+			if m.exited[workspaceID] != nil {
+				delete(m.exited[workspaceID], shellID)
+				if len(m.exited[workspaceID]) == 0 {
+					delete(m.exited, workspaceID)
+				}
+			}
+			m.exitedMu.Unlock()
 		}
-		delete(m.sessions, workspaceID)
-		m.exitedMu.Lock()
-		delete(m.exited, workspaceID)
-		m.exitedMu.Unlock()
 	}
 	m.mu.Unlock()
 
 	return m.Start(workspaceID, workspaceRoot)
 }
 
-// Resize resizes the PTY for the given workspace.
+// Resize resizes the PTY for the given shell.
 // Returns CodeNotFound if no session exists, or CodeBadRequest for invalid dimensions.
-func (m *LocalManager) Resize(workspaceID string, cols, rows int) error {
+func (m *LocalManager) Resize(workspaceID string, shellID string, cols, rows int) error {
 	m.mu.Lock()
-	sess, ok := m.sessions[workspaceID]
-	m.mu.Unlock()
+	defer m.mu.Unlock()
+
+	ws, ok := m.sessions[workspaceID]
 	if !ok {
-		return util.New(util.CodeNotFound, "no running shell for workspace")
+		return util.New(util.CodeNotFound, "shell not found")
+	}
+	sess, ok := ws[shellID]
+	if !ok {
+		return util.New(util.CodeNotFound, "shell not found")
 	}
 	if cols <= 0 || rows <= 0 || cols > 10000 || rows > 10000 {
 		return util.New(util.CodeBadRequest, "invalid cols/rows")
@@ -224,38 +273,47 @@ func (m *LocalManager) Resize(workspaceID string, cols, rows int) error {
 }
 
 // Status returns the current shell status for the workspace.
-func (m *LocalManager) Status(workspaceID string) Status {
+func (m *LocalManager) Status(workspaceID string, shellID string) Status {
 	m.mu.Lock()
-	sess, ok := m.sessions[workspaceID]
-	m.mu.Unlock()
+	defer m.mu.Unlock()
 
+	ws, ok := m.sessions[workspaceID]
 	if !ok {
-		return Status{WorkspaceID: workspaceID, Running: false}
+		return Status{WorkspaceID: workspaceID, ShellID: shellID, Running: false}
+	}
+	sess, ok := ws[shellID]
+	if !ok {
+		return Status{WorkspaceID: workspaceID, ShellID: shellID, Running: false}
 	}
 
 	m.exitedMu.Lock()
-	_, exited := m.exited[workspaceID]
+	_, exited := m.exited[workspaceID][shellID]
 	m.exitedMu.Unlock()
 	if exited {
-		return Status{WorkspaceID: workspaceID, Running: false}
+		return Status{WorkspaceID: workspaceID, ShellID: shellID, Running: false}
 	}
 
 	return Status{
 		WorkspaceID: workspaceID,
+		ShellID:     shellID,
 		Running:     true,
 		PID:         sess.Cmd.Process.Pid,
 	}
 }
 
-// Subscribe creates a new output subscription for the workspace.
-// Returns CodeNotFound if the workspace has no session.
-func (m *LocalManager) Subscribe(workspaceID string) (Subscription, error) {
+// Subscribe creates a new output subscription for the identified shell.
+// Returns CodeNotFound if the shell has no session.
+func (m *LocalManager) Subscribe(workspaceID string, shellID string) (Subscription, error) {
 	m.mu.Lock()
-	sess, ok := m.sessions[workspaceID]
-	m.mu.Unlock()
+	defer m.mu.Unlock()
 
+	ws, ok := m.sessions[workspaceID]
 	if !ok {
-		return nil, util.New(util.CodeNotFound, "no running shell")
+		return nil, util.New(util.CodeNotFound, "shell not found")
+	}
+	sess, ok := ws[shellID]
+	if !ok {
+		return nil, util.New(util.CodeNotFound, "shell not found")
 	}
 
 	sess.mu.Lock()
@@ -264,7 +322,7 @@ func (m *LocalManager) Subscribe(workspaceID string) (Subscription, error) {
 	sess.mu.Unlock()
 
 	m.exitedMu.Lock()
-	_, exited := m.exited[workspaceID]
+	_, exited := m.exited[workspaceID][shellID]
 	m.exitedMu.Unlock()
 	if exited {
 		sub.closeChan()
@@ -273,34 +331,85 @@ func (m *LocalManager) Subscribe(workspaceID string) (Subscription, error) {
 	return sub, nil
 }
 
-// Stdin returns the stdin writer for the workspace shell.
-func (m *LocalManager) Stdin(workspaceID string) (io.WriteCloser, error) {
-	return m.stdinOf(workspaceID)
+// Stdin returns the stdin writer for the identified shell.
+func (m *LocalManager) Stdin(workspaceID string, shellID string) (io.WriteCloser, error) {
+	return m.stdinOf(workspaceID, shellID)
 }
 
-// ExitStatus returns the exit status for the workspace shell.
-func (m *LocalManager) ExitStatus(workspaceID string) (ExitInfo, error) {
-	return m.exitOf(workspaceID)
+// ExitStatus returns the exit status for the identified shell.
+func (m *LocalManager) ExitStatus(workspaceID string, shellID string) (ExitInfo, error) {
+	return m.exitOf(workspaceID, shellID)
+}
+
+// List returns all shells for the workspace in creation order.
+func (m *LocalManager) List(workspaceID string) []ShellInfo {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	var infos []ShellInfo
+	for _, shellID := range m.shellOrder[workspaceID] {
+		ws, ok := m.sessions[workspaceID]
+		if !ok {
+			continue
+		}
+		sess, ok := ws[shellID]
+		if !ok {
+			continue
+		}
+
+		info := ShellInfo{
+			ShellID:     shellID,
+			WorkspaceID: workspaceID,
+			CreatedAt:   sess.CreatedAt,
+		}
+
+		m.exitedMu.Lock()
+		_, exited := m.exited[workspaceID][shellID]
+		m.exitedMu.Unlock()
+
+		if !exited && sess.Cmd.Process != nil {
+			info.Running = true
+			info.PID = sess.Cmd.Process.Pid
+		}
+
+		sess.mu.Lock()
+		info.ExitCode = sess.Exit.Code
+		info.Signal = sess.Exit.Signal
+		sess.mu.Unlock()
+
+		infos = append(infos, info)
+	}
+	return infos
 }
 
 // stdinOf returns the session's stdin writer or CodeNotFound.
-func (m *LocalManager) stdinOf(workspaceID string) (io.WriteCloser, error) {
+func (m *LocalManager) stdinOf(workspaceID string, shellID string) (io.WriteCloser, error) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
-	sess, ok := m.sessions[workspaceID]
+
+	ws, ok := m.sessions[workspaceID]
 	if !ok {
-		return nil, util.New(util.CodeNotFound, "no running shell")
+		return nil, util.New(util.CodeNotFound, "shell not found")
+	}
+	sess, ok := ws[shellID]
+	if !ok {
+		return nil, util.New(util.CodeNotFound, "shell not found")
 	}
 	return sess.Stdin, nil
 }
 
 // exitOf returns the session's recorded exit info or CodeNotFound.
-func (m *LocalManager) exitOf(workspaceID string) (ExitInfo, error) {
+func (m *LocalManager) exitOf(workspaceID string, shellID string) (ExitInfo, error) {
 	m.mu.Lock()
-	sess, ok := m.sessions[workspaceID]
-	m.mu.Unlock()
+	defer m.mu.Unlock()
+
+	ws, ok := m.sessions[workspaceID]
 	if !ok {
-		return ExitInfo{}, util.New(util.CodeNotFound, "no running shell")
+		return ExitInfo{}, util.New(util.CodeNotFound, "shell not found")
+	}
+	sess, ok := ws[shellID]
+	if !ok {
+		return ExitInfo{}, util.New(util.CodeNotFound, "shell not found")
 	}
 
 	sess.mu.Lock()

internal/shell/manager_test.go

@@ -10,37 +10,34 @@ import (
 )
 
 import (
-	"os"
-
 	"codespace/internal/util"
-
-	"github.com/creack/pty"
 )
 
-func startTestShell(t *testing.T) (*LocalManager, io.WriteCloser, Subscription) {
+func startTestShell(t *testing.T) (*LocalManager, string, io.WriteCloser, Subscription) {
 	t.Helper()
 	mgr := NewManager("bash", []string{"-i"})
 	root := t.TempDir()
-	if err := mgr.Start("test-ws", root); err != nil {
+	shellID, err := mgr.Start("test-ws", root)
+	if err != nil {
 		t.Fatalf("Start failed: %v", err)
 	}
 
-	stdin, err := mgr.Stdin("test-ws")
+	stdin, err := mgr.Stdin("test-ws", shellID)
 	if err != nil {
 		t.Fatalf("Stdin failed: %v", err)
 	}
 
-	sub, err := mgr.Subscribe("test-ws")
+	sub, err := mgr.Subscribe("test-ws", shellID)
 	if err != nil {
 		t.Fatalf("Subscribe failed: %v", err)
 	}
 
 	t.Cleanup(func() {
 		sub.Close()
-		_ = mgr.Stop("test-ws")
+		_ = mgr.Stop("test-ws", shellID)
 	})
 
-	return mgr, stdin, sub
+	return mgr, shellID, stdin, sub
 }
 
 func waitForMarker(t *testing.T, sub Subscription, stdin io.Writer, input, marker string) string {
@@ -71,8 +68,9 @@ func waitForMarker(t *testing.T, sub Subscription, stdin io.Writer, input, marke
 }
 
 func TestShellPTYIsRealTerminal(t *testing.T) {
-	mgr, stdin, sub := startTestShell(t)
+	mgr, shellID, stdin, sub := startTestShell(t)
 	_ = mgr
+	_ = shellID
 
 	out := waitForMarker(t, sub, stdin, "echo HELLO_PTY_TEST\n", "HELLO_PTY_TEST")
 
@@ -85,7 +83,7 @@ func TestShellPTYIsRealTerminal(t *testing.T) {
 }
 
 func TestShellPTYTermEnv(t *testing.T) {
-	_, stdin, sub := startTestShell(t)
+	_, _, stdin, sub := startTestShell(t)
 
 	out := waitForMarker(t, sub, stdin, "echo \"$TERM\"\n", "xterm-256color")
 	if !strings.Contains(out, "xterm-256color") {
@@ -94,31 +92,23 @@ func TestShellPTYTermEnv(t *testing.T) {
 }
 
 func TestShellResizeUpdatesPTYSize(t *testing.T) {
-	mgr, stdin, sub := startTestShell(t)
+	mgr, shellID, stdin, sub := startTestShell(t)
 	_ = sub
 
-	f, ok := stdin.(*os.File)
-	if !ok {
-		t.Fatal("stdin is not a pty file")
-	}
-
-	if err := mgr.Resize("test-ws", 120, 40); err != nil {
+	if err := mgr.Resize("test-ws", shellID, 120, 40); err != nil {
 		t.Fatalf("Resize failed: %v", err)
 	}
 
-	rows, cols, err := pty.Getsize(f)
-	if err != nil {
-		t.Fatalf("Getsize failed: %v", err)
-	}
-	if cols != 120 || rows != 40 {
-		t.Errorf("expected cols=120 rows=40, got cols=%d rows=%d", cols, rows)
+	out := waitForMarker(t, sub, stdin, "stty size\n", "40 120")
+	if !strings.Contains(out, "40 120") {
+		t.Errorf("expected stty size to report 40 120, got:\n%s", out)
 	}
 }
 
 func TestShellResizeRejectsInvalidSize(t *testing.T) {
-	mgr, _, _ := startTestShell(t)
+	mgr, shellID, _, _ := startTestShell(t)
 
-	if err := mgr.Resize("test-ws", 0, 40); err == nil {
+	if err := mgr.Resize("test-ws", shellID, 0, 40); err == nil {
 		t.Fatal("expected error for invalid size")
 	} else if util.CodeOf(err) != util.CodeBadRequest {
 		t.Errorf("expected CodeBadRequest, got %v", util.CodeOf(err))
@@ -128,9 +118,86 @@ func TestShellResizeRejectsInvalidSize(t *testing.T) {
 func TestShellResizeRejectsMissingSession(t *testing.T) {
 	mgr := NewManager("bash", []string{"-i"})
 
-	if err := mgr.Resize("missing-ws", 80, 24); err == nil {
+	if err := mgr.Resize("missing-ws", "missing-shell", 80, 24); err == nil {
 		t.Fatal("expected error for missing session")
 	} else if util.CodeOf(err) != util.CodeNotFound {
 		t.Errorf("expected CodeNotFound, got %v", util.CodeOf(err))
 	}
 }
+
+func TestShellMultiInstance(t *testing.T) {
+	mgr := NewManager("bash", []string{"-i"})
+	root := t.TempDir()
+
+	shellID1, err := mgr.Start("test-ws", root)
+	if err != nil {
+		t.Fatalf("Start shell1 failed: %v", err)
+	}
+	shellID2, err := mgr.Start("test-ws", root)
+	if err != nil {
+		t.Fatalf("Start shell2 failed: %v", err)
+	}
+
+	if shellID1 == shellID2 {
+		t.Fatalf("expected distinct shell IDs, got %q and %q", shellID1, shellID2)
+	}
+
+	stdin1, err := mgr.Stdin("test-ws", shellID1)
+	if err != nil {
+		t.Fatalf("Stdin shell1 failed: %v", err)
+	}
+	stdin2, err := mgr.Stdin("test-ws", shellID2)
+	if err != nil {
+		t.Fatalf("Stdin shell2 failed: %v", err)
+	}
+
+	sub1, err := mgr.Subscribe("test-ws", shellID1)
+	if err != nil {
+		t.Fatalf("Subscribe shell1 failed: %v", err)
+	}
+	sub2, err := mgr.Subscribe("test-ws", shellID2)
+	if err != nil {
+		t.Fatalf("Subscribe shell2 failed: %v", err)
+	}
+
+	t.Cleanup(func() {
+		sub1.Close()
+		sub2.Close()
+		_ = mgr.Stop("test-ws", shellID1)
+		_ = mgr.Stop("test-ws", shellID2)
+	})
+
+	list := mgr.List("test-ws")
+	if len(list) != 2 {
+		t.Fatalf("List returned %d shells, want 2", len(list))
+	}
+
+	out1 := waitForMarker(t, sub1, stdin1, "echo SHELL_ONE\n", "SHELL_ONE")
+	if strings.Contains(out1, "SHELL_TWO") {
+		t.Errorf("shell1 output leaked shell2 output: %s", out1)
+	}
+
+	out2 := waitForMarker(t, sub2, stdin2, "echo SHELL_TWO\n", "SHELL_TWO")
+	if strings.Contains(out2, "SHELL_ONE") {
+		t.Errorf("shell2 output leaked shell1 output: %s", out2)
+	}
+
+	if err := mgr.Stop("test-ws", shellID1); err != nil {
+		t.Fatalf("Stop shell1 failed: %v", err)
+	}
+
+	if _, err := mgr.Stdin("test-ws", shellID1); err == nil {
+		t.Fatal("expected shell1 stdin to be unavailable after stop")
+	}
+
+	// shell2 should still work.
+	_ = waitForMarker(t, sub2, stdin2, "echo STILL_ALIVE\n", "STILL_ALIVE")
+
+	list = mgr.List("test-ws")
+	if len(list) != 1 {
+		t.Fatalf("List returned %d shells after stop, want 1", len(list))
+	}
+	if list[0].ShellID != shellID2 {
+		t.Fatalf("List returned shell %q, want %q", list[0].ShellID, shellID2)
+	}
+}

internal/shell/session.go

@@ -4,11 +4,13 @@ import (
 	"io"
 	"os/exec"
 	"sync"
+	"time"
 )
 
 // Status represents the status of a shell for a workspace.
 type Status struct {
 	WorkspaceID string `json:"workspaceId"`
+	ShellID     string `json:"shellId,omitempty"`
 	Running     bool   `json:"running"`
 	PID         int    `json:"pid,omitempty"`
 }
@@ -21,12 +23,14 @@ type ExitInfo struct {
 
 // Session holds the runtime state of a started shell.
 type Session struct {
+	ShellID     string
 	WorkspaceID string
 	Root        string
 	Cmd         *exec.Cmd
 	Stdin       io.WriteCloser
 	Subscribers map[Subscription]struct{}
 	Exit        ExitInfo
+	CreatedAt   time.Time
 	mu          sync.Mutex
 }