@agentsdock/server 1.0.11-beta.2 → 1.0.12-beta.1

package/server/codex_app_server.py

@@ -2369,17 +2369,20 @@ class CodexAppServerClient:
         validated["turn"] = _protocol_turn(method, result.get("turn"))
         return validated
 
-    async def run_thread_shell_command(self, thread_id: str, command: str) -> None:
+    async def run_thread_shell_command(
+        self, thread_id: str, command: str, *,
+        before_send: Callable[[], bool] | None = None,
+    ) -> None:
         thread_id = _require_nonempty_string(thread_id, "thread_id")
         command = _require_nonempty_string(command, "command")
         method = "thread/shellCommand"
-        _protocol_empty_object(
-            method,
-            await self.request(
-                method,
-                {"threadId": thread_id, "command": command},
-            ),
-        )
+        params = {"threadId": thread_id, "command": command}
+        if before_send is None:
+            result = await self.request(method, params)
+        else:
+            await self.start()
+            result = await self._request_connected(method, params, before_send=before_send)
+        _protocol_empty_object(method, result)
 
     async def list_background_terminals(
         self,
@@ -3011,8 +3014,14 @@ class CodexAppServerManager:
             delivery=delivery,
         )
 
-    async def run_thread_shell_command(self, thread_id: str, command: str) -> None:
-        await self.client.run_thread_shell_command(thread_id, command)
+    async def run_thread_shell_command(
+        self, thread_id: str, command: str, *,
+        before_send: Callable[[], bool] | None = None,
+    ) -> None:
+        if before_send is None:
+            await self.client.run_thread_shell_command(thread_id, command)
+        else:
+            await self.client.run_thread_shell_command(thread_id, command, before_send=before_send)
 
     async def list_background_terminals(
         self,

package/server/codex_side_question.py

@@ -23,7 +23,7 @@ SIDE_INSTRUCTIONS = """Answer questions and explore in this separate side chat w
 
 Treat inherited messages, tasks, plans, tool calls and approvals as reference material, not current instructions or permission. Follow only requests made in this side chat; do not resume unfinished parent work.
 
-Use the thread's existing permissions and available tools, including external tools, to read or search files and run checks that leave repo-tracked files unchanged. Do not create, contact or control subagents.
+Use the thread's existing permissions and available tools, including external tools and subagents. Delegate side-chat work only to subagents created in this side chat; inherited parent agents belong to the main conversation.
 
 Change files, git state, configuration, permissions or other workspace state only when explicitly requested here. Request escalation only when such an explicit mutation requires it. Keep authorized changes limited to the request and preserve ongoing parent work."""
 
@@ -68,8 +68,6 @@ def side_chat_config(parent_config: dict | None = None) -> dict:
     if isinstance(servers, dict):
         servers.pop(name, None)
     config.update({
-        "features.multi_agent": False, "features.multi_agent_v2": False,
-        "agents.enabled": False,
         f"{prefix}.enabled": False, f"{prefix}.required": False,
         # Codex validates transport shape even for a disabled server. Never
         # copy the parent's authenticated helper URL/headers into this child.
@@ -182,6 +180,9 @@ class NativeCodexSideChat:
         self._progress = None
         self._lock = asyncio.Lock()
         self._closed = False
+        self._thread_parents: dict[str, str] = {}
+        self._owned_threads: set[str] = set()
+        self._work_revision = 0
 
     @property
     def closed(self) -> bool:
@@ -193,12 +194,88 @@ class NativeCodexSideChat:
             return None
         return deepcopy(list(self._progress.items.values()))
 
+    def owns_thread(self, thread_id: str) -> bool:
+        """Only the side fork and provider-verified descendants own approvals."""
+        return bool(not self._closed and self.thread_id and thread_id != self.parent_thread_id
+                    and (thread_id == self.thread_id or thread_id in self._owned_threads))
+
+    def _remember_thread(self, thread):
+        if not isinstance(thread, dict):
+            return
+        thread_id = thread.get("id")
+        source = thread.get("source")
+        subagent = source.get("subAgent") if isinstance(source, dict) else None
+        spawn = subagent.get("thread_spawn") if isinstance(subagent, dict) else None
+        parent = spawn.get("parent_thread_id") if isinstance(spawn, dict) else None
+        if isinstance(thread_id, str) and isinstance(parent, str) and parent:
+            self._thread_parents[thread_id] = parent
+
+    def _remember_notification(self, notification):
+        if notification.get("method") in {"thread/started", "thread/closed", "thread/status/changed", "turn/started", "turn/completed"}:
+            self._work_revision += 1
+        if notification.get("method") == "thread/started":
+            self._remember_thread((notification.get("params") or {}).get("thread"))
+
+    def background_work_scope(self):
+        client = self._client
+        if self._closed or client is None or not client.ready or not self.thread_id:
+            return None
+        return (self, client, client.generation, self.thread_id, self._work_revision)
+
+    async def has_background_work(self):
+        scope = self.background_work_scope()
+        if scope is None:
+            return False
+        _owner, client, _generation, thread_id, _revision = scope
+        descendants = await client.list_descendant_threads(thread_id)
+        if self.background_work_scope() != scope:
+            raise SideQuestionError(409, "Side chat changed during background inspection")
+        # This native relationship-filtered API sees descendants even when
+        # app-server omitted their thread/started notification.
+        for child in descendants:
+            child_id = child.get("id")
+            status = child.get("status")
+            kind = status.get("type") if isinstance(status, dict) else None
+            if child_id in {thread_id, self.parent_thread_id} or not isinstance(child_id, str):
+                raise SideQuestionError(502, "Codex returned an invalid side descendant")
+            if kind == "active":
+                return True
+            if kind not in {"idle", "notLoaded"}:
+                raise SideQuestionError(502, "Codex side descendant activity is unknown")
+        return False
+
+    async def _verify_owned_thread(self, thread_id: str) -> bool:
+        if self.owns_thread(thread_id):
+            return True
+        if not self.thread_id or self._client is None or self._closed:
+            return False
+        path: set[str] = set()
+        current = thread_id
+        while current and current not in path and current != self.parent_thread_id:
+            if self.owns_thread(current):
+                self._owned_threads.update(path)
+                return True
+            path.add(current)
+            if current not in self._thread_parents:
+                try:
+                    thread = await self._client.read_thread(current, include_turns=False)
+                except CodexAppServerError:
+                    return False
+                if self._closed or not isinstance(thread, dict) or thread.get("id") != current:
+                    return False
+                self._remember_thread(thread)
+            current = self._thread_parents.get(current, "")
+        return False
+
     async def _handle_server_request(self, request_id, method, params):
-        # The callback can present approvals through the existing UI, but only
-        # for this exact child. Never route a parent's inherited tool request.
+        # Provider lineage permits side-chat descendants without granting a
+        # parent's inherited tool request or unrelated thread any authority.
         if (self.server_request_handler is not None and not self._closed
-                and self._active is not None and self.thread_id is not None
-                and params.get("threadId") == self.thread_id):
+                and self.thread_id is not None
+                and isinstance(params.get("threadId"), str)
+                and await self._verify_owned_thread(params["threadId"])
+                and not self._closed
+                and (self._active is not None or params["threadId"] != self.thread_id)):
             return await self.server_request_handler(request_id, method, params)
         return await decline_server_request(request_id, method, params)
 
@@ -241,6 +318,7 @@ class NativeCodexSideChat:
             on_process_started=lambda _pid, _group: self._process_started.set(),
             **client_options,
         )
+        self._client.add_notification_handler(self._remember_notification)
         await self._client.start()
         if self._closed:
             raise SideQuestionError(409, "Side chat was closed; open a new side chat")

package/server/cursor_agent_client.py

@@ -18,6 +18,7 @@ draining; this module deliberately contains no process lifecycle state.
 
 from __future__ import annotations
 
+import hashlib
 import json
 import re
 from typing import Any, Iterator
@@ -31,6 +32,13 @@ CURSOR_SESSION_IDENTIFIER_RE = re.compile(
     r"^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$"
 )
 CURSOR_CALL_ID_MAX_CHARS = 240
+# Cursor 2026.10.22 emits this compound correlation key even for a normal
+# file-read tool. LF is part of the opaque ID, not a second stream event.
+_CURSOR_UUID_PATTERN = r"[0-9a-fA-F]{8}(?:-[0-9a-fA-F]{4}){3}-[0-9a-fA-F]{12}"
+_CURSOR_COMPOSITE_CALL_ID_RE = re.compile(
+    rf"call-{_CURSOR_UUID_PATTERN}-[0-9]+\nfc_{_CURSOR_UUID_PATTERN}_[0-9]+"
+)
+_CURSOR_ENCODED_CALL_ID_PREFIX = "cursor-call-sha256:"
 CURSOR_LIFECYCLE_VALUE_MAX = 2_147_483_647
 CURSOR_ANSI_ESCAPE_RE = re.compile(r"\x1b(?:\[[0-?]*[ -/]*[@-~]|\][^\x07]*(?:\x07|\x1b\\))")
 CURSOR_TOOL_SUCCESS_OUTCOMES = (
@@ -90,7 +98,13 @@ def canonical_cursor_session_id(value: Any) -> str | None:
 
 
 def canonical_cursor_call_id(value: Any) -> str:
-    """Validate the opaque correlation key used by Cursor tool events."""
+    """Bound an opaque tool key and encode the observed compound CLI format.
+
+    Keep the complete key in the digest: stripping LF, keeping only one half,
+    or assigning a fresh ID per event could merge distinct tools or orphan a
+    completion. The encoded namespace is reserved so literal provider IDs
+    cannot collide with it. Arbitrary control characters remain invalid.
+    """
 
     if not isinstance(value, str):
         raise CursorEventParseError("tool_call call_id must be a string")
@@ -98,11 +112,17 @@ def canonical_cursor_call_id(value: Any) -> str:
         not value
         or value != value.strip()
         or len(value) > CURSOR_CALL_ID_MAX_CHARS
-        or any(ord(character) < 32 or ord(character) == 127 for character in value)
     ):
         raise CursorEventParseError(
             "tool_call call_id must be a bounded nonempty identifier"
         )
+    composite = _CURSOR_COMPOSITE_CALL_ID_RE.fullmatch(value) is not None
+    if not composite and any(ord(character) < 32 or ord(character) == 127 for character in value):
+        raise CursorEventParseError(
+            "tool_call call_id must be a bounded nonempty identifier"
+        )
+    if composite or value.startswith(_CURSOR_ENCODED_CALL_ID_PREFIX):
+        return _CURSOR_ENCODED_CALL_ID_PREFIX + hashlib.sha256(value.encode("utf-8", "surrogatepass")).hexdigest()
     return value
 
 

package/server/install.sh

@@ -1387,6 +1387,13 @@ print_token_for_copy() {
   local copy_reply=""
   local clipboard_command=()
   printf '\nAccess token (%s):\n%s\n\n' "$INSTANCE_NAME" "$access_token"
+  # Render locally, only in an interactive terminal. No credentials in argv.
+  local pairing_script="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)/npm/agentsdock/pair.cjs"
+  if [[ -f "$pairing_script" ]] && command -v node >/dev/null 2>&1; then
+    node "$pairing_script" "$INSTANCE_NAME" || true
+  else
+    printf 'Show a connection QR with: agentsdock pair %s\n' "$INSTANCE_NAME"
+  fi
   # A remote clipboard is not the user's local clipboard. Do not emit OSC 52
   # sequences or attempt to modify a remote desktop's clipboard over SSH.
   if [[ -n "${SSH_CONNECTION:-}${SSH_CLIENT:-}${SSH_TTY:-}" ]]; then
@@ -1839,7 +1846,7 @@ if [[ "$TEAM_HUB_MODE" == "host" && "$TEAM_HUB_OPERATION_PENDING" != "true" \
   fi
 fi
 
-RELEASE_FILES=(activation_transaction.py execution_activation.py execution_legacy_runner.py execution_preparation.py update_preparation.py update_handoff.py update_recovery.py execution_update_status.py execution_uninstall.py execution_recovery.py execution_recovery_status.py execution_http.py execution_durability.py execution_control.py execution_install.py execution_maintenance.py execution_manage.py execution_ownership.py execution_service.py execution_transport.py agent_server.py local_session_ownership.py cursor_history.py workspace_git.py team_hub_host.py secure_peer_runtime.py team_mail_runtime.py team_mail_websocket.py team_mail_grants.py secure_peer_delivery.py agentsdock_jobs.py agentsdock_chats.py chat_mailbox.py agentsdock_emergency.py agentsdock_publish.py agentsdock_mail.py agentsdock_team.py provider_commands.py provider_usage.py claude_sdk_client.py claude_model_catalog.py claude_goals.py claude_background_reconciliation.py codex_app_server.py codex_auth.py codex_provider.py codex_response_stream.py provider_connections.py cursor_api_key.py side_questions.py title_generation.py codex_side_question.py codex_side_chat_progress.py claude_side_question.py cursor_agent_client.py cursor_provider_mcp.py opencode_agent_client.py gemini_acp_client.py gemini_history.py gemini_content.py gemini_import.py gemini_runtime.py gemini_runner.py gemini_permissions.py gemini_api.py cursor_process_guard.py transcript_reader.py claude_history_repair.py claude_history_provenance.py codex_history_repair.py public_chat_shares.py public_chat_transcript.py public_chat_share_routes.py interactive_chat_shares.py interactive_chat_share_routes.py interactive_chat_share_web.py interactive_chat_projection.py interactive_chat_runtime.py interactive_chat_native.py shared_chat_videos.py shared_chat_video_stream.py interactive_chat_controls.py install.sh uninstall.sh instances.sh server_instances.py update_runner.py pyproject.toml uv.lock VERSION release-public-key.pem LICENSE NOTICE)
+RELEASE_FILES=(activation_transaction.py execution_activation.py execution_legacy_runner.py execution_preparation.py update_preparation.py update_handoff.py update_recovery.py execution_update_status.py execution_uninstall.py execution_recovery.py execution_recovery_status.py execution_http.py execution_durability.py execution_control.py execution_install.py execution_maintenance.py execution_manage.py execution_ownership.py execution_service.py execution_transport.py agent_server.py local_session_ownership.py cursor_history.py workspace_git.py team_hub_host.py secure_peer_runtime.py team_mail_runtime.py team_mail_websocket.py team_mail_grants.py secure_peer_delivery.py agentsdock_jobs.py agentsdock_chats.py chat_mailbox.py agentsdock_emergency.py agentsdock_notify.py agentsdock_publish.py agentsdock_mail.py agentsdock_team.py provider_commands.py provider_usage.py session_unread.py claude_sdk_client.py claude_model_catalog.py claude_goals.py claude_background_reconciliation.py codex_app_server.py codex_auth.py codex_provider.py codex_response_stream.py provider_connections.py cursor_api_key.py side_questions.py title_generation.py codex_side_question.py codex_side_chat_progress.py claude_side_question.py cursor_agent_client.py cursor_provider_mcp.py opencode_agent_client.py gemini_acp_client.py gemini_history.py gemini_content.py gemini_import.py gemini_runtime.py gemini_runner.py gemini_permissions.py gemini_api.py cursor_process_guard.py transcript_reader.py claude_history_repair.py claude_history_provenance.py codex_history_repair.py public_chat_shares.py public_chat_transcript.py public_chat_share_routes.py interactive_chat_shares.py interactive_chat_share_routes.py interactive_chat_share_web.py interactive_chat_projection.py interactive_chat_runtime.py interactive_chat_native.py shared_chat_videos.py shared_chat_analytics_web.py shared_chat_video_stream.py interactive_chat_controls.py install.sh uninstall.sh instances.sh server_instances.py npm/agentsdock/pair.cjs npm/agentsdock/qr-renderer.cjs npm/agentsdock/QR-NOTICES.txt update_runner.py pyproject.toml uv.lock VERSION release-public-key.pem LICENSE NOTICE)
 RELEASE_DIRECTORIES=(agentsdock_team_hub)
 TEAM_HUB_RELEASE_FILES=(
   __init__.py
@@ -1880,6 +1887,12 @@ TEAM_HUB_RELEASE_FILES=(
   migrations/0023_team_message_search.sql
 )
 
+for directory in npm npm/agentsdock; do
+  if [[ ! -d "$SOURCE_DIR/$directory" || -L "$SOURCE_DIR/$directory" ]]; then
+    echo "$directory is missing beside install.sh or is not a real directory." >&2
+    exit 1
+  fi
+done
 for name in "${RELEASE_FILES[@]}"; do
   if [[ ! -f "$SOURCE_DIR/$name" || -L "$SOURCE_DIR/$name" ]]; then
     echo "$name is missing beside install.sh or is not a regular release file." >&2
@@ -3740,11 +3753,13 @@ validate_staged_release_runtime() (
     "$STAGE_DIR/agentsdock_chats.py" \
     "$STAGE_DIR/chat_mailbox.py" \
     "$STAGE_DIR/agentsdock_emergency.py" \
+    "$STAGE_DIR/agentsdock_notify.py" \
     "$STAGE_DIR/agentsdock_publish.py" \
     "$STAGE_DIR/agentsdock_mail.py" \
     "$STAGE_DIR/agentsdock_team.py" \
     "$STAGE_DIR/provider_commands.py" \
     "$STAGE_DIR/provider_usage.py" \
+    "$STAGE_DIR/session_unread.py" \
     "$STAGE_DIR/claude_sdk_client.py" \
     "$STAGE_DIR/claude_model_catalog.py" \
     "$STAGE_DIR/claude_goals.py" \
@@ -3785,12 +3800,13 @@ validate_staged_release_runtime() (
     "$STAGE_DIR/interactive_chat_runtime.py" \
     "$STAGE_DIR/interactive_chat_native.py" \
     "$STAGE_DIR/shared_chat_videos.py" \
+    "$STAGE_DIR/shared_chat_analytics_web.py" \
     "$STAGE_DIR/shared_chat_video_stream.py" \
     "$STAGE_DIR/interactive_chat_controls.py" \
     "$STAGE_DIR/update_runner.py"
   "$STAGE_DIR/.venv/bin/python" -m py_compile "$STAGE_DIR/server_instances.py"
   "$STAGE_DIR/.venv/bin/python" -m compileall -q "$STAGE_DIR/agentsdock_team_hub"
-  PYTHONPATH="$STAGE_DIR" "$STAGE_DIR/.venv/bin/python" -c 'import execution_activation, execution_preparation, update_preparation, update_handoff, update_recovery, execution_update_status, execution_uninstall, execution_recovery, execution_recovery_status, execution_http, execution_durability, execution_control, execution_install, execution_maintenance, execution_manage, execution_ownership, execution_service, execution_transport; import workspace_git, claude_model_catalog, server_instances, local_session_ownership, cursor_history; import codex_auth, codex_provider, codex_response_stream, provider_connections, cursor_api_key, side_questions, title_generation, codex_side_question, codex_side_chat_progress, claude_side_question, agentsdock_team_hub, cursor_agent_client, cursor_provider_mcp, opencode_agent_client, gemini_acp_client, gemini_history, gemini_content, gemini_import, gemini_runtime, gemini_runner, gemini_permissions, gemini_api, cursor_process_guard, secure_peer_delivery, secure_peer_runtime, team_mail_runtime, team_mail_websocket, team_mail_grants, team_hub_host, agentsdock_mail, agentsdock_team, transcript_reader, claude_history_repair, claude_history_provenance, claude_goals, claude_background_reconciliation, codex_history_repair, public_chat_shares, public_chat_transcript, public_chat_share_routes, interactive_chat_shares, interactive_chat_share_routes, interactive_chat_share_web, interactive_chat_projection, interactive_chat_runtime, interactive_chat_native, shared_chat_videos, shared_chat_video_stream, interactive_chat_controls, chat_mailbox, provider_commands, provider_usage; from agentsdock_team_hub import secure_peer, secure_peer_hub' >/dev/null
+  PYTHONPATH="$STAGE_DIR" "$STAGE_DIR/.venv/bin/python" -c 'import execution_activation, execution_preparation, update_preparation, update_handoff, update_recovery, execution_update_status, execution_uninstall, execution_recovery, execution_recovery_status, execution_http, execution_durability, execution_control, execution_install, execution_maintenance, execution_manage, execution_ownership, execution_service, execution_transport; import workspace_git, claude_model_catalog, server_instances, local_session_ownership, cursor_history; import codex_auth, codex_provider, codex_response_stream, provider_connections, cursor_api_key, side_questions, title_generation, codex_side_question, codex_side_chat_progress, claude_side_question, agentsdock_team_hub, cursor_agent_client, cursor_provider_mcp, opencode_agent_client, gemini_acp_client, gemini_history, gemini_content, gemini_import, gemini_runtime, gemini_runner, gemini_permissions, gemini_api, cursor_process_guard, secure_peer_delivery, secure_peer_runtime, team_mail_runtime, team_mail_websocket, team_mail_grants, team_hub_host, agentsdock_mail, agentsdock_team, transcript_reader, claude_history_repair, claude_history_provenance, claude_goals, claude_background_reconciliation, codex_history_repair, public_chat_shares, public_chat_transcript, public_chat_share_routes, interactive_chat_shares, interactive_chat_share_routes, interactive_chat_share_web, interactive_chat_projection, interactive_chat_runtime, interactive_chat_native, shared_chat_videos, shared_chat_analytics_web, shared_chat_video_stream, interactive_chat_controls, chat_mailbox, provider_commands, provider_usage; from agentsdock_team_hub import secure_peer, secure_peer_hub' >/dev/null
 )
 
 abort_unclaimed_team_hub_reactivation() {
@@ -4108,6 +4124,7 @@ if [[ "$stage_identity" != *$'\n'* \
   exit 1
 fi
 for name in "${RELEASE_FILES[@]}"; do
+  mkdir -p "$(dirname -- "$STAGE_DIR/$name")"
   install -m 644 "$SOURCE_DIR/$name" "$STAGE_DIR/$name"
 done
 mkdir -p "$STAGE_DIR/agentsdock_team_hub/migrations"
@@ -4117,7 +4134,7 @@ for name in "${TEAM_HUB_RELEASE_FILES[@]}"; do
     "$SOURCE_DIR/agentsdock_team_hub/$name" \
     "$STAGE_DIR/agentsdock_team_hub/$name"
 done
-chmod 755 "$STAGE_DIR/agent_server.py" "$STAGE_DIR/agentsdock_jobs.py" "$STAGE_DIR/agentsdock_chats.py" "$STAGE_DIR/agentsdock_emergency.py" "$STAGE_DIR/agentsdock_publish.py" "$STAGE_DIR/agentsdock_mail.py" "$STAGE_DIR/agentsdock_team.py" "$STAGE_DIR/install.sh" "$STAGE_DIR/uninstall.sh" "$STAGE_DIR/update_runner.py"
+chmod 755 "$STAGE_DIR/agent_server.py" "$STAGE_DIR/agentsdock_jobs.py" "$STAGE_DIR/agentsdock_chats.py" "$STAGE_DIR/agentsdock_emergency.py" "$STAGE_DIR/agentsdock_notify.py" "$STAGE_DIR/agentsdock_publish.py" "$STAGE_DIR/agentsdock_mail.py" "$STAGE_DIR/agentsdock_team.py" "$STAGE_DIR/install.sh" "$STAGE_DIR/uninstall.sh" "$STAGE_DIR/update_runner.py"
 chmod 755 "$STAGE_DIR/instances.sh"
 
 if [[ "$PREPARE_ONLY" == "true" ]]; then

package/server/interactive_chat_share_routes.py

@@ -47,7 +47,7 @@ HTTP_COOKIE = "AgentsDock-Chat"
 HEADERS = {
     "Cache-Control": "no-store", "Referrer-Policy": "no-referrer", "X-Content-Type-Options": "nosniff",
     "X-Robots-Tag": "noindex, nofollow, noarchive", "Cross-Origin-Resource-Policy": "same-origin",
-    "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
+    "Content-Security-Policy": "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https://api.mixpanel.com; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; base-uri 'none'; form-action 'none'; frame-ancestors 'none'",
 }