@clawos-dev/clawd 0.2.83 → 0.2.84-beta.156.919c226

package/dist/cli.cjs

@@ -28477,12 +28477,13 @@ function buildSessionHandlers(deps) {
     const { response, broadcast } = await manager.cancelQuestion(args);
     return { response: { type: "session:cancelQuestion", ...response }, broadcast };
   };
-  const ptyInput = async (frame) => {
+  const ptyInput = async (frame, _client, ctx) => {
     const sid = frame.sessionId;
     const dataB64 = frame.data;
     if (!sid || typeof dataB64 !== "string") {
       return { response: { type: "session:pty:input", ok: false } };
     }
+    ensureSessionAccess(ctx, sid, "send");
     const pty = manager.getPtyBySessionId(sid);
     if (!pty) return { response: { type: "session:pty:input", ok: false } };
     try {
@@ -28492,13 +28493,14 @@ function buildSessionHandlers(deps) {
     }
     return { response: { type: "session:pty:input", ok: true } };
   };
-  const ptyResize = async (frame) => {
+  const ptyResize = async (frame, _client, ctx) => {
     const sid = frame.sessionId;
     const cols = frame.cols;
     const rows = frame.rows;
     if (!sid || typeof cols !== "number" || typeof rows !== "number") {
       return { response: { type: "session:pty:resize", ok: false } };
     }
+    ensureSessionAccess(ctx, sid, "send");
     const pty = manager.getPtyBySessionId(sid);
     if (!pty) return { response: { type: "session:pty:resize", ok: false } };
     try {
@@ -28508,11 +28510,12 @@ function buildSessionHandlers(deps) {
     }
     return { response: { type: "session:pty:resize", ok: true } };
   };
-  const ptySnapshot = async (frame) => {
+  const ptySnapshot = async (frame, _client, ctx) => {
     const sid = frame.sessionId;
     if (!sid) {
       return { response: { type: "session:pty:snapshot", ok: false } };
     }
+    ensureSessionAccess(ctx, sid, "read");
     const snap = manager.getPtyReplay(sid);
     if (!snap) {
       return {
@@ -29671,9 +29674,15 @@ var METHOD_GRANT_MAP = {
   "persona:get": CAPABILITY_SCOPED,
   "persona:update": ADMIN_ANY,
   "persona:delete": ADMIN_ANY,
-  "session:pty:input": ADMIN_ANY,
-  "session:pty:resize": ADMIN_ANY,
-  "session:pty:snapshot": ADMIN_ANY,
+  // 2026-05-26 修 clawd people TUI 渲染 mix 串扰回归（参考 f1133ff0 原 owner 路径
+  // snapshot/buffer/flush 修复）：之前三件套 ADMIN_ANY 把 guest 拦在 dispatcher 401，
+  // 导致 XtermPanel 重挂载拉 snapshot 在 guest 路径不生效，老的字节流断裂串扰回来。
+  // 同一个 session 永远只有一个操作者（owner 不进 guest 创建的 session），并发字节流
+  // 冲突不存在；guest 在 chat 模式下已能 session:send/interrupt，PTY 域不开放纯属
+  // 历史遗留的不对称。handler 端通过 ensureSessionAccess 验权对齐其他 session:* RPC。
+  "session:pty:input": CAPABILITY_SCOPED,
+  "session:pty:resize": CAPABILITY_SCOPED,
+  "session:pty:snapshot": CAPABILITY_SCOPED,
   // file-sharing attachment.* RPC：dispatcher 放行；handler 内按 sessionId 反查
   // session.ownerPersonaId + ctx.grants 跑 assertGrant，限制 guest 只能签 / 操作
   // 自己被授权 persona 下的 session 文件。HTTP Bearer 仍然只识别 owner，所以 guest

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawos-dev/clawd",
-  "version": "0.2.83",
+  "version": "0.2.84-beta.156.919c226",
   "description": "Standalone clawd daemon — Claude Code (and future Codex) session server over WebSocket",
   "type": "module",
   "license": "MIT",