fix(csrf): prevent undefined token when session at max capacity

Root cause: generateToken() returned undefined when session already
had maxTokensPerSession (5) tokens, causing ERR_HTTP_INVALID_HEADER_VALUE.

Fix: Force generate token even when at capacity, ensuring we always
return a valid token string.

Related: v7.1.1 CLI process hang fix

.claude/skills/workflow-lite-plan/phases/01-lite-plan.md

@@ -529,15 +529,17 @@ ${task_description}
 
 ## Multi-Angle Exploration Context
 
-${manifest.explorations.map(exp => `### Exploration: ${exp.angle} (${exp.file})
+${manifest.explorations.length > 0
+  ? manifest.explorations.map(exp => `### Exploration: ${exp.angle} (${exp.file})
 Path: ${exp.path}
 
-Read this file for detailed ${exp.angle} analysis.`).join('\n\n')}
+Read this file for detailed ${exp.angle} analysis.`).join('\n\n') + `
 
 Total explorations: ${manifest.exploration_count}
 Angles covered: ${manifest.explorations.map(e => e.angle).join(', ')}
 
-Manifest: ${sessionFolder}/explorations-manifest.json
+Manifest: ${sessionFolder}/explorations-manifest.json`
+  : `No exploration files. Task Description above contains "## Prior Analysis" with analysis summary, key files, and findings — use it as primary planning context.`}
 
 ## User Clarifications
 ${JSON.stringify(clarificationContext) || "None"}

ccw/src/commands/cli.ts

@@ -51,9 +51,11 @@ function notifyDashboard(data: Record<string, unknown>): void {
     path: '/api/hook',
     method: 'POST',
     timeout: 2000, // 2 second timeout to prevent hanging
+    agent: false, // Disable Keep-Alive to allow process exit
     headers: {
       'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(payload)
+      'Content-Length': Buffer.byteLength(payload),
+      'Connection': 'close' // Ensure connection closes after response
     }
   });
 
@@ -93,9 +95,11 @@ function broadcastStreamEvent(eventType: string, payload: Record<string, unknown
     path: '/api/hook',
     method: 'POST',
     timeout: 1000, // Short timeout for streaming
+    agent: false, // Disable Keep-Alive to allow process exit
     headers: {
       'Content-Type': 'application/json',
-      'Content-Length': Buffer.byteLength(data)
+      'Content-Length': Buffer.byteLength(data),
+      'Connection': 'close' // Ensure connection closes after response
     }
   });
 

ccw/src/core/auth/csrf-manager.ts

@@ -56,6 +56,26 @@ export class CsrfTokenManager {
    */
   generateToken(sessionId: string): string {
     const tokens = this.generateTokens(sessionId, 1);
+    // If no slots available (session at max capacity), force generate anyway
+    // This ensures we always return a valid token
+    if (tokens.length === 0) {
+      const token = randomBytes(32).toString('hex');
+      const expiresAtMs = Date.now() + this.tokenTtlMs;
+      const record: CsrfTokenRecord = {
+        sessionId,
+        expiresAtMs,
+        used: false,
+      };
+      // Get or create session map
+      let sessionMap = this.sessionTokens.get(sessionId);
+      if (!sessionMap) {
+        sessionMap = new Map();
+        this.sessionTokens.set(sessionId, sessionMap);
+      }
+      sessionMap.set(token, record);
+      this.tokenToSession.set(token, sessionId);
+      return token;
+    }
     return tokens[0];
   }
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-workflow",
-  "version": "7.1.0",
+  "version": "7.1.1",
   "description": "JSON-driven multi-agent development framework with intelligent CLI orchestration (Gemini/Qwen/Codex), context-first architecture, and automated workflow execution",
   "type": "module",
   "main": "ccw/dist/index.js",