@cluesmith/codev 3.3.3 → 3.3.5

package/dist/agent-farm/servers/tower-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tower-routes.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/servers/tower-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAKxE,OAAO,KAAK,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAkCtE,OAAO,EAAgC,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAwD3F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAqChD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAChD,qBAAqB,EAAE,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjH,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7C,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAkED,wBAAsB,aAAa,CACjC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,IAAI,CAAC,CA8Hf;AAisCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,eAAe,CAAC,EACzD,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,GAC3D,OAAO,CAAC,kBAAkB,CAAC,CA4C7B;AAiqBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAgCpG"}
+{"version":3,"file":"tower-routes.d.ts","sourceRoot":"","sources":["../../../src/agent-farm/servers/tower-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,IAAI,MAAM,WAAW,CAAC;AAc7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AAMxE,OAAO,KAAK,EAAE,SAAS,EAAsB,MAAM,kBAAkB,CAAC;AAwCtE,OAAO,EAAgC,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAyD3F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAsChD,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,mGAAmG;IACnG,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,kBAAkB,EAAE,MAAM,cAAc,GAAG,IAAI,CAAC;IAChD,qBAAqB,EAAE,CAAC,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IACjH,YAAY,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7C,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CACvC;AAkED,wBAAsB,aAAa,CACjC,GAAG,EAAE,IAAI,CAAC,eAAe,EACzB,GAAG,EAAE,IAAI,CAAC,cAAc,EACxB,GAAG,EAAE,YAAY,GAChB,OAAO,CAAC,IAAI,CAAC,CA+If;AAwsCD;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,eAAe,CAAC,EACzD,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI,GAC3D,OAAO,CAAC,kBAAkB,CAAC,CA4C7B;AAguBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAKH,wBAAgB,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,cAAc,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAgCpG"}

package/dist/agent-farm/servers/tower-routes.js

@@ -21,23 +21,29 @@ import { decodeWorkspacePath } from '../lib/tower-client.js';
 import { readCloudConfig } from '../lib/cloud-config.js';
 import { fileURLToPath } from 'node:url';
 import { version } from '../../version.js';
+import { sanitizeAgentEnv } from '../../lib/agent-env.js';
 const execAsync = promisify(exec);
-import { getBuilders, setArchitectByName } from '../state.js';
+import { getArchitectByName, getBuilders, setArchitectByName } from '../state.js';
+import { DEFAULT_ARCHITECT_NAME } from '../utils/architect-name.js';
 import { DEFAULT_COLS, defaultSessionOptions } from '../../terminal/index.js';
 import { parseJsonBody, isRequestAllowed, isAllowedOrigin, isAllowedHost, getExpectedKey, escapeHtml } from '../utils/server-utils.js';
-import { TOWER_KEY_HEADER, LEGACY_WEB_KEY_HEADER, VSCODE_USER_SENDER } from '@cluesmith/codev-types';
+import { TOWER_KEY_HEADER, LEGACY_WEB_KEY_HEADER, VSCODE_USER_SENDER, DECISIONS_TAB_SENDER } from '@cluesmith/codev-types';
 import { isRateLimited, normalizeWorkspacePath, getLanguageForExt, getMimeTypeForFile, serveStaticFile, persistableCommand, logSessionIdentity, } from './tower-utils.js';
 import { handleTunnelEndpoint } from './tower-tunnel.js';
+import { handleIdeApi } from './ide-server.js';
+import { matchIdePrefix, forwardIdeHttp } from './ide-forward.js';
 import { getWorktreeConfig, getActivityHooks } from '../utils/config.js';
 import { ensureCodevConfigWatcher } from './codev-config-watcher.js';
+import { handleDecisionsGet, handleDecisionsRule } from './decisions/routes.js';
+import { decisionsFilePresent } from './decisions/file.js';
 import { hasTeam, loadTeamMembers, loadMessages } from '../../lib/team.js';
 import { fetchTeamGitHubData } from '../../lib/team-github.js';
 import { resolveTarget, resolveAgentInRegistry, broadcastMessage, isResolveError } from './tower-messages.js';
 import { handleCommandRoute, COMMAND_ROUTE } from './command-relay.js';
 import { handleCanvasRoute, CANVAS_ROUTE_PREFIX } from './canvas-relay.js';
-import { formatArchitectMessage, formatArchitectToBuilderMessage, formatBuilderMessage, formatUserViaVsCodeMessage, isSafeSenderId, messageTooLargeError, MAX_MESSAGE_BYTES, } from '../utils/message-format.js';
-import { writeMessageToSession, writeEscapeToSession } from './message-write.js';
-import { makeDeliveryPorts, getMailboxDrainer } from './mailbox-wiring.js';
+import { formatArchitectMessage, formatArchitectToBuilderMessage, formatBuilderMessage, formatUserViaVsCodeMessage, formatUserViaDecisionsTabMessage, isSafeSenderId, messageLimitError, messageTooLargeError, MAX_MESSAGE_BYTES, } from '../utils/message-format.js';
+import { writeMessageToSession, writeEscapeToSession, writeStrategyForApp } from './message-write.js';
+import { makeDeliveryPorts, getMailboxDrainer, resolveProfileForSession } from './mailbox-wiring.js';
 import { deliverAgentMailSerialized } from './mailbox-delivery.js';
 import { deliverCronMail, CRON_SENDER } from './cron-delivery.js';
 import { enqueue as enqueueMailbox, getById as getMailboxById, markDelivered as markMailboxDelivered, listHeld as listHeldMailbox, dismiss as dismissMailbox, } from '../db/mailbox.js';
@@ -55,7 +61,7 @@ import { submitToSession, OPERATOR_SUBMIT_WAIT_CEILING_MS } from './session-subm
 import { scheduleDelayedSend, validateDelaySeconds } from './delayed-send.js';
 import { getKnownWorkspacePaths, getInstances, getDirectorySuggestions, launchInstance, killTerminalWithShellper, instancesReady, stopInstance, addArchitect, removeArchitect, } from './tower-instances.js';
 import { OverviewCache } from './overview.js';
-import { fetchIssue, fetchPR, searchIssues, fetchPRList, fetchCurrentUser, parseLinkedIssue, parseArea, } from '../../lib/github.js';
+import { fetchIssue, fetchPR, searchIssues, fetchPRList, fetchCurrentUser, probeGhGraphqlRateLimit, parseLinkedIssue, parseArea, } from '../../lib/github.js';
 import { computeAnalytics } from './analytics.js';
 import { getAllTasks, executeTask, getTaskId } from './tower-cron.js';
 import { getGlobalDb } from '../db/index.js';
@@ -66,7 +72,8 @@ import { getWorkspaceTerminals, getTerminalManager, getWorkspaceTerminalsEntry,
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 // Singleton cache for overview endpoint (Spec 0126 Phase 4)
-const overviewCache = new OverviewCache();
+// #1645: the gh reset probe is enabled here, in Tower, and nowhere else.
+const overviewCache = new OverviewCache({ probe: probeGhGraphqlRateLimit });
 const ROUTES = {
     'GET /health': (_req, res, _url, ctx) => handleHealthCheck(res, ctx),
     'GET /api/shellpers/husks': (_req, res, _url, ctx) => handleHuskPreview(res, ctx),
@@ -159,6 +166,18 @@ export async function handleRequest(req, res, ctx) {
             return await handler(req, res, url, ctx);
         }
         // Pattern-based routes (require regex or prefix matching)
+        // IDE management endpoint: /api/ide (Issue #1668). Local-only — blocked from
+        // the tunnel in tunnel-client (like /api/tunnel/*) — and reached only after
+        // the isRequestAllowed key check above. Drives the IDE server lifecycle.
+        if (url.pathname === '/api/ide') {
+            return await handleIdeApi(req, res, ctx.log);
+        }
+        // IDE prefix forward: /ide/* → local IDE server (Issue #1668). A post-auth
+        // handler: isRequestAllowed above is the whole trust boundary (the forward
+        // adds no per-folder authorization). Path + query forwarded unchanged.
+        if (matchIdePrefix(url.pathname)) {
+            return await forwardIdeHttp(req, res, ctx.log);
+        }
         // Tunnel endpoints: /api/tunnel/* (Spec 0097 Phase 4)
         if (url.pathname.startsWith('/api/tunnel/')) {
             const tunnelSub = url.pathname.slice('/api/tunnel/'.length);
@@ -224,6 +243,10 @@ export async function handleRequest(req, res, ctx) {
     }
     catch (err) {
         ctx.log('ERROR', `Request error: ${err.message}`);
+        // A handler may fail after it has answered (the Decisions route keeps working past its
+        // `res.end()`); a second writeHead would throw ERR_HTTP_HEADERS_SENT out of here.
+        if (res.headersSent)
+            return;
         res.writeHead(500, { 'Content-Type': 'application/json' });
         res.end(JSON.stringify({ error: err.message }));
     }
@@ -610,9 +633,11 @@ async function handleTerminalCreate(req, res, ctx) {
         if (requestPersistence && shellperManager && command && cwd) {
             try {
                 const sessionId = crypto.randomUUID();
-                // Strip CLAUDECODE so spawned Claude processes don't detect nesting
-                const sessionEnv = { ...(env || process.env) };
-                delete sessionEnv['CLAUDECODE'];
+                // Strip Claude Code session markers so spawned Claude processes don't
+                // detect nesting and disable transcript saving (#1219). `env` is normally
+                // absent — `createPtySession` sends no env — so this is the path by which
+                // Tower's own environment becomes every builder's environment.
+                const sessionEnv = sanitizeAgentEnv(env || process.env);
                 const client = await shellperManager.createSession({
                     sessionId,
                     command,
@@ -667,7 +692,7 @@ async function handleTerminalCreate(req, res, ctx) {
         // Fallback: non-persistent session (graceful degradation per plan)
         // Shellper is the only persistence backend for new sessions.
         if (!info) {
-            info = await manager.createSession({ command, args, cols, rows, cwd, env, label });
+            info = await manager.createSession({ command, args, cols, rows, cwd, env: env && sanitizeAgentEnv(env), label });
             persistent = false;
             if (workspacePath && termType && roleId) {
                 const entry = getWorkspaceTerminalsEntry(normalizeWorkspacePath(workspacePath));
@@ -750,6 +775,9 @@ async function handleTerminalRoutes(req, res, url, match) {
                 res.end(JSON.stringify({ error: 'NOT_FOUND', message: `Session ${terminalId} not found` }));
                 return;
             }
+            // Deliberately the default `'external'` origin (Issue #1473): this is a foreign writer, so
+            // its bytes count as input at the delivery gate and are reply-filtered on the way — both
+            // for free, because the recording lives inside `write()` rather than at each call site.
             session.write(body.data);
             res.writeHead(200, { 'Content-Type': 'application/json' });
             res.end(JSON.stringify({ ok: true }));
@@ -1311,6 +1339,9 @@ function formatMessageForTarget(isArchitectTarget, from, toAgent, message, raw)
     // header, so the architect can tell it from a peer-architect instruction.
     if (isArchitectTarget && from === VSCODE_USER_SENDER)
         return formatUserViaVsCodeMessage(toAgent, message, undefined, raw);
+    // #1828: likewise the owner's ruling relayed by the Decisions tab — never a builder frame.
+    if (isArchitectTarget && from === DECISIONS_TAB_SENDER)
+        return formatUserViaDecisionsTabMessage(toAgent, message, raw);
     if (isArchitectTarget && from)
         return formatBuilderMessage(from, toAgent, message, undefined, raw); // builder → architect
     // any → builder: thread the sender so an `architect:<name>` origin is named in the
@@ -1376,6 +1407,45 @@ export async function deliverCronMessage(task, message, log) {
     log('WARN', `Cron '${task.name}': target '${task.target}' not found — message not delivered`);
     return { outcome: 'unresolved', reason: null, detail: null, mailboxId: null };
 }
+/**
+ * Tell a workspace's hub architect about a ruling the owner just wrote from the
+ * Decisions tab (#1828). The hub is the architect registered as `main` and no other:
+ * the registry's "first registered" order is by name (#1633), so a workspace without
+ * `main` gets no notice rather than a guess, and a `main` that is offline holds it
+ * (`no-live-pty`). One mailbox row is persisted, then offered to the same gated delivery
+ * `handleSend` uses; a busy line holds it for the backstop. Throws, persisting nothing,
+ * when `main` is not registered or the notice is over the send limit.
+ */
+async function notifyHubOfRuling(workspacePath, message, log) {
+    const tooLarge = messageLimitError(message);
+    if (tooLarge)
+        throw new Error(tooLarge);
+    const toAgent = DEFAULT_ARCHITECT_NAME;
+    if (!getArchitectByName(workspacePath, toAgent)) {
+        throw new Error(`no architect named '${toAgent}' is registered in workspace ${workspacePath}`);
+    }
+    const db = getGlobalDb();
+    const row = enqueueMailbox(db, {
+        workspacePath,
+        toAgent,
+        body: message,
+        formattedMessage: formatMessageForTarget(true, DECISIONS_TAB_SENDER, toAgent, message, false),
+        fromAgent: DECISIONS_TAB_SENDER,
+        fromWorkspace: workspacePath,
+    });
+    const ports = makeDeliveryPorts(log);
+    ports.onHeldStateChange();
+    try {
+        const outcome = await deliverAgentMailSerialized(ports, db, workspacePath, toAgent);
+        getMailboxDrainer().noteOutcome(workspacePath, toAgent, outcome);
+    }
+    catch (err) {
+        log('ERROR', `Decisions notice delivery errored for ${toAgent} (row ${row.id.slice(0, 8)}... stays held): ${err.message}`);
+    }
+    const stored = getMailboxById(db, row.id);
+    const fate = stored?.status === 'delivered' ? 'delivered' : `held (${stored?.reason ?? 'unknown'})`;
+    log('INFO', `Decisions notice ${fate} → ${toAgent} @ ${path.basename(workspacePath)} (mailbox ${row.id.slice(0, 8)}...)`);
+}
 /**
  * Persist a `held` mailbox row and write the Spec 1313 `held` send response. Used
  * for both dead-session cases (no live PTY, held `no-live-pty`). The row exists
@@ -1837,7 +1907,10 @@ async function handleSend(req, res, ctx) {
         let degraded = false;
         await submitToSession(result.terminalId, () => {
             session.write('\x03'); // Ctrl+C
-            return writeMessageToSession(session, formattedMessage, noEnter, 100);
+            // Issue #1567: the same per-harness write strategy the gated path uses — an
+            // interrupt to an opted-out harness must not be bracketed just because it bypassed
+            // the gate.
+            return writeMessageToSession(session, formattedMessage, noEnter, 100, writeStrategyForApp(resolveProfileForSession(session)?.app));
         }, undefined, {
             waitCeilingMs: OPERATOR_SUBMIT_WAIT_CEILING_MS,
             onCeilingExpired: (waitedMs) => {
@@ -1905,6 +1978,13 @@ async function handleSend(req, res, ctx) {
         // completed write); the backstop drainer will retry. Report held, not a 500.
         ctx.log('ERROR', `Delivery attempt errored for ${toAgent} (row ${row.id.slice(0, 8)}... stays held): ${err.message}`);
     }
+    // Issue #1473: this pass ran OUTSIDE the drainer, so hand it the outcome — otherwise a hold
+    // on recent terminal input arms no re-drain here, and the send an operator is watching falls
+    // through to the quiescence trigger or the backstop instead of clearing after one settle.
+    // That is exactly the latency the re-drain exists to remove, in the case where somebody is
+    // waiting for it. A no-op for every other outcome.
+    if (outcome)
+        getMailboxDrainer().noteOutcome(result.workspacePath, toAgent, outcome);
     const stored = getMailboxById(db, row.id);
     if (stored?.status === 'delivered') {
         ctx.log('INFO', `Message delivered: ${from ?? 'unknown'} → ${toAgent} (terminal ${result.terminalId.slice(0, 8)}...)`);
@@ -1927,6 +2007,15 @@ async function handleSend(req, res, ctx) {
             ...(outcome?.delivered.includes(row.id) && outcome.verified !== undefined
                 ? { verified: outcome.verified }
                 : {}),
+            // Issue #1473. `verified` alone was not enough for the SENDER — the case that motivated
+            // it is a human's Enter submitting our half-written body, where the header landed, so
+            // `verified` is `true` (or absent) and this human read a plain "Message delivered". The
+            // cause says which flag it is: `input-raced` (may be truncated or submitted early) or
+            // `no-echo` (header never appeared). Same id guard as `verified` — reported only when
+            // THIS pass is the one that delivered THIS row.
+            ...(outcome?.delivered.includes(row.id) && outcome.unverifiedCause !== undefined
+                ? { unverifiedCause: outcome.unverifiedCause }
+                : {}),
         });
         return;
     }
@@ -2357,7 +2446,7 @@ async function handleWorkspaceRoutes(req, res, ctx, url) {
         const apiPath = subPath.replace(/^api\/?/, '');
         // GET /api/state - Return workspace state (architect, builders, shells)
         if (req.method === 'GET' && (apiPath === 'state' || apiPath === '')) {
-            return handleWorkspaceState(res, workspacePath);
+            return handleWorkspaceState(res, ctx, workspacePath);
         }
         // POST /api/tabs/shell - Create a new shell terminal
         if (req.method === 'POST' && apiPath === 'tabs/shell') {
@@ -2437,6 +2526,14 @@ async function handleWorkspaceRoutes(req, res, ctx, url) {
         if (req.method === 'GET' && apiPath === 'team') {
             return handleWorkspaceTeam(res, workspacePath);
         }
+        // GET /api/decisions, POST /api/decisions/rule — the Decisions tab (Spec 1819).
+        // The file is the configured one; neither route takes a path from the request.
+        if (req.method === 'GET' && apiPath === 'decisions') {
+            return handleDecisionsGet(res, workspacePath);
+        }
+        if (req.method === 'POST' && apiPath === 'decisions/rule') {
+            return handleDecisionsRule(req, res, workspacePath, ctx.log, message => notifyHubOfRuling(workspacePath, message, ctx.log));
+        }
         // GET /api/annotate/:tabId/* — Serve rich annotator template and sub-APIs
         const annotateMatch = apiPath.match(/^annotate\/([^/]+)(\/(.*))?$/);
         if (annotateMatch) {
@@ -2547,7 +2644,7 @@ async function handleWorkspaceRoutes(req, res, ctx, url) {
 // ============================================================================
 // Workspace API sub-handlers
 // ============================================================================
-async function handleWorkspaceState(res, workspacePath) {
+async function handleWorkspaceState(res, ctx, workspacePath) {
     // Rehydrate wsTerminals (SQLite sync + shellper reconnect) before reading.
     // Shared with /api/overview so both endpoints always see a freshly-reconciled
     // entry — see getRehydratedTerminalsEntry doc.
@@ -2570,6 +2667,7 @@ async function handleWorkspaceState(res, workspacePath) {
             return undefined;
         } })(),
         teamEnabled: await hasTeam(path.join(workspacePath, 'codev', 'team')),
+        decisionsEnabled: await decisionsFilePresent(workspacePath, ctx.log),
     };
     // Spec 761: build the architects collection from entry.architects (skip dead
     // sessions, main-first). Shared with /api/overview via `liveArchitects`
@@ -2694,9 +2792,9 @@ async function handleWorkspaceShellCreate(res, ctx, workspacePath) {
         if (shellperManager) {
             try {
                 const sessionId = crypto.randomUUID();
-                // Strip CLAUDECODE so spawned Claude processes don't detect nesting
-                const shellEnv = { ...process.env };
-                delete shellEnv['CLAUDECODE'];
+                // Strip Claude Code session markers so spawned Claude processes don't
+                // detect nesting and disable transcript saving (#1219).
+                const shellEnv = sanitizeAgentEnv(process.env);
                 // Inject session identity for afx rename (Spec 468)
                 shellEnv['SHELLPER_SESSION_ID'] = sessionId;
                 shellEnv['TOWER_PORT'] = String(ctx.port);
@@ -2757,7 +2855,7 @@ async function handleWorkspaceShellCreate(res, ctx, workspacePath) {
                 args: shellArgs,
                 cwd: workspacePath,
                 label: `Shell ${shellId.replace('shell-', '')}`,
-                env: process.env,
+                env: sanitizeAgentEnv(process.env),
             });
             const entry = getWorkspaceTerminalsEntry(workspacePath);
             entry.shells.set(shellId, session.id);