@codedeck/codedeck 2026.3.1-4.63

package/dist/agent/env-isolation.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * Build a minimal explicit environment for spawning agent tmux sessions.
+ * Only pass through safe, non-secret env vars. Never pass secrets to child processes.
+ *
+ * Agents are spawned with ONLY these env vars — any secrets from the daemon's
+ * environment are explicitly excluded.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildAgentEnv = buildAgentEnv;
+exports.getAgentEnvVars = getAgentEnvVars;
+exports.buildAgentEnvFromProcess = buildAgentEnvFromProcess;
+/** Safe env vars that agents always need */
+const ALWAYS_ALLOWED = [
+    'PATH',
+    'HOME',
+    'TERM',
+    'COLORTERM',
+    'LANG',
+    'LC_ALL',
+    'LC_CTYPE',
+    'USER',
+    'LOGNAME',
+    'SHELL',
+    'TMPDIR',
+    'XDG_RUNTIME_DIR',
+    'DISPLAY',
+    'WAYLAND_DISPLAY',
+];
+/** Env var patterns that are explicitly blocked (secrets/credentials) */
+const BLOCKED_PATTERNS = [
+    /token/i,
+    /secret/i,
+    /password/i,
+    /key/i,
+    /credential/i,
+    /api_/i,
+    /auth/i,
+    /^deck/i,
+    /^jwt/i,
+];
+/**
+ * Build a minimal environment for an agent tmux session.
+ *
+ * @param agentSpecificVars  Agent-specific vars to include (e.g., ANTHROPIC_API_KEY for CC).
+ *   These must be explicitly opted-in — they are NOT automatically inherited.
+ * @returns Environment object safe to pass to `newSession({ env: ... })`.
+ */
+function buildAgentEnv(agentSpecificVars = {}) {
+    const env = {};
+    const source = process.env;
+    // Passthrough only explicitly allowed vars
+    for (const key of ALWAYS_ALLOWED) {
+        const value = source[key];
+        if (value !== undefined) {
+            env[key] = value;
+        }
+    }
+    // Add agent-specific vars (caller is responsible for providing correct keys/values)
+    for (const [k, v] of Object.entries(agentSpecificVars)) {
+        if (isBlocked(k)) {
+            // Log warning and skip — prevents accidental secret leakage via this path
+            console.warn(`[env-isolation] Blocked env var "${k}" — pass via agent config, not env`);
+            continue;
+        }
+        env[k] = v;
+    }
+    return env;
+}
+/**
+ * Get the agent-specific env vars for a given agent type.
+ * Only includes the vars explicitly needed by that agent.
+ */
+function getAgentEnvVars(agentType) {
+    switch (agentType) {
+        case 'claude-code':
+            return ['ANTHROPIC_API_KEY'];
+        case 'codex':
+            return ['OPENAI_API_KEY', 'OPENAI_BASE_URL'];
+        case 'opencode':
+            return ['ANTHROPIC_API_KEY', 'OPENAI_API_KEY'];
+    }
+}
+/**
+ * Build agent env from process.env, extracting only the agent-specific API key vars.
+ * The caller must ensure these vars are set in process.env before calling this.
+ */
+function buildAgentEnvFromProcess(agentType) {
+    const agentVars = {};
+    for (const key of getAgentEnvVars(agentType)) {
+        const val = process.env[key];
+        if (val)
+            agentVars[key] = val;
+    }
+    return buildAgentEnv(agentVars);
+}
+function isBlocked(key) {
+    // Allow explicitly needed keys if they match the ALWAYS_ALLOWED list
+    if (ALWAYS_ALLOWED.includes(key))
+        return false;
+    return BLOCKED_PATTERNS.some((p) => p.test(key));
+}
+//# sourceMappingURL=env-isolation.js.map

package/dist/agent/env-isolation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-isolation.js","sourceRoot":"","sources":["../../src/agent/env-isolation.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;AAwCH,sCAuBC;AAMD,0CASC;AAMD,4DASC;AA3FD,4CAA4C;AAC5C,MAAM,cAAc,GAAG;IACrB,MAAM;IACN,MAAM;IACN,MAAM;IACN,WAAW;IACX,MAAM;IACN,QAAQ;IACR,UAAU;IACV,MAAM;IACN,SAAS;IACT,OAAO;IACP,QAAQ;IACR,iBAAiB;IACjB,SAAS;IACT,iBAAiB;CAClB,CAAC;AAEF,yEAAyE;AACzE,MAAM,gBAAgB,GAAG;IACvB,QAAQ;IACR,SAAS;IACT,WAAW;IACX,MAAM;IACN,aAAa;IACb,OAAO;IACP,OAAO;IACP,QAAQ;IACR,OAAO;CACR,CAAC;AAEF;;;;;;GAMG;AACH,SAAgB,aAAa,CAAC,oBAA4C,EAAE;IAC1E,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAE3B,2CAA2C;IAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IAED,oFAAoF;IACpF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACvD,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACjB,0EAA0E;YAC1E,OAAO,CAAC,IAAI,CAAC,oCAAoC,CAAC,oCAAoC,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACb,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,SAAgB,eAAe,CAAC,SAA+C;IAC7E,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC/B,KAAK,OAAO;YACV,OAAO,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;QAC/C,KAAK,UAAU;YACb,OAAO,CAAC,mBAAmB,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CACtC,SAA+C;IAE/C,MAAM,SAAS,GAA2B,EAAE,CAAC;IAC7C,KAAK,MAAM,GAAG,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,GAAG;YAAE,SAAS,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAChC,CAAC;IACD,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAAC,GAAW;IAC5B,qEAAqE;IACrE,IAAI,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/agent/notify-setup.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Setup idle notify hooks for Codex and OpenCode agents.
+ * Both POST directly to the daemon hook server (127.0.0.1:51913/notify).
+ *
+ * - Codex:    config.toml [notify] "agent-turn-complete" = curl script
+ * - OpenCode: .opencode/plugin/idle-notify.ts  session.idle → fetch
+ */
+/**
+ * Append Codex notify config to <projectDir>/config.toml.
+ * The session name is baked in at setup time (each session has its own config).
+ */
+export declare function setupCodexNotify(projectDir: string, sessionName: string): Promise<void>;
+/**
+ * Write .opencode/plugin/idle-notify.ts to <projectDir>.
+ * OpenCode loads plugins from this directory automatically.
+ */
+export declare function setupOpenCodePlugin(projectDir: string, sessionName: string): Promise<void>;
+//# sourceMappingURL=notify-setup.d.ts.map

package/dist/agent/notify-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-setup.d.ts","sourceRoot":"","sources":["../../src/agent/notify-setup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAQH;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAkBf;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAoBf"}

package/dist/agent/notify-setup.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * Setup idle notify hooks for Codex and OpenCode agents.
+ * Both POST directly to the daemon hook server (127.0.0.1:51913/notify).
+ *
+ * - Codex:    config.toml [notify] "agent-turn-complete" = curl script
+ * - OpenCode: .opencode/plugin/idle-notify.ts  session.idle → fetch
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setupCodexNotify = setupCodexNotify;
+exports.setupOpenCodePlugin = setupOpenCodePlugin;
+const fs_1 = require("fs");
+const path_1 = __importDefault(require("path"));
+const hook_server_js_1 = require("../daemon/hook-server.js");
+// ─── Codex ────────────────────────────────────────────────────────────────────
+/**
+ * Append Codex notify config to <projectDir>/config.toml.
+ * The session name is baked in at setup time (each session has its own config).
+ */
+async function setupCodexNotify(projectDir, sessionName) {
+    const configPath = path_1.default.join(projectDir, 'config.toml');
+    let existing = '';
+    try {
+        existing = await fs_1.promises.readFile(configPath, 'utf-8');
+    }
+    catch { /* ok */ }
+    if (existing.includes('agent-turn-complete'))
+        return; // already set up
+    const notifyBlock = `
+[notify]
+"agent-turn-complete" = """
+curl -s -X POST "http://127.0.0.1:${hook_server_js_1.activeHookPort}/notify" \\
+  -H "Content-Type: application/json" \\
+  -d '{"event":"idle","session":"${sessionName}","agentType":"codex"}' \\
+  --max-time 2 &>/dev/null || true
+"""
+`;
+    await fs_1.promises.appendFile(configPath, notifyBlock);
+}
+// ─── OpenCode ─────────────────────────────────────────────────────────────────
+/**
+ * Write .opencode/plugin/idle-notify.ts to <projectDir>.
+ * OpenCode loads plugins from this directory automatically.
+ */
+async function setupOpenCodePlugin(projectDir, sessionName) {
+    const pluginDir = path_1.default.join(projectDir, '.opencode', 'plugin');
+    await fs_1.promises.mkdir(pluginDir, { recursive: true });
+    const pluginPath = path_1.default.join(pluginDir, 'idle-notify.ts');
+    const pluginContent = `// Codedeck idle notify plugin for OpenCode
+export default {
+  name: 'idle-notify',
+  events: {
+    'session.idle': async () => {
+      await fetch('http://127.0.0.1:${hook_server_js_1.activeHookPort}/notify', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ event: 'idle', session: '${sessionName}', agentType: 'opencode' }),
+      }).catch(() => { /* daemon may not be running */ });
+    },
+  },
+};
+`;
+    await fs_1.promises.writeFile(pluginPath, pluginContent);
+}
+//# sourceMappingURL=notify-setup.js.map

package/dist/agent/notify-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notify-setup.js","sourceRoot":"","sources":["../../src/agent/notify-setup.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;;;AAYH,4CAqBC;AAQD,kDAuBC;AA9DD,2BAAoC;AACpC,gDAAwB;AACxB,6DAA0D;AAE1D,iFAAiF;AAEjF;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,WAAmB;IAEnB,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IAExD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QAAC,QAAQ,GAAG,MAAM,aAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE7E,IAAI,QAAQ,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,CAAC,iBAAiB;IAEvE,MAAM,WAAW,GAAG;;;oCAGc,+BAAc;;mCAEf,WAAW;;;CAG7C,CAAC;IACA,MAAM,aAAE,CAAC,UAAU,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CACvC,UAAkB,EAClB,WAAmB;IAEnB,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,aAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,cAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG;;;;;sCAKc,+BAAc;;;0DAGM,WAAW;;;;;CAKpE,CAAC;IACA,MAAM,aAAE,CAAC,SAAS,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAChD,CAAC"}

package/dist/agent/session-manager.d.ts

@@ -0,0 +1,75 @@
+import type { AgentDriver } from './drivers/base.js';
+import type { AgentType } from './detect.js';
+import { type SessionRecord } from '../store/session-store.js';
+type SessionEventCallback = (event: 'started' | 'stopped' | 'error', session: string, state: string) => void;
+export declare function setSessionEventCallback(cb: SessionEventCallback): void;
+/** Called after upsert (record provided) or remove (record=null, name provided). */
+type SessionPersistCallback = (record: SessionRecord | null, name: string) => Promise<void>;
+export declare function setSessionPersistCallback(cb: SessionPersistCallback): void;
+export interface ProjectConfig {
+    name: string;
+    dir: string;
+    brainType: AgentType;
+    workerTypes: AgentType[];
+    /** When true, start fresh sessions without resuming last conversation. */
+    fresh?: boolean;
+}
+export declare function getDriver(type: AgentType): AgentDriver;
+export declare function sessionName(project: string, role: 'brain' | `w${number}`): string;
+/** Start all sessions for a project (brain + workers). */
+export declare function startProject(config: ProjectConfig): Promise<void>;
+/** Stop all sessions for a project. */
+export declare function stopProject(projectName: string): Promise<void>;
+/** Clean up orphan FIFOs from previous daemon runs and reconcile session store on startup. */
+export declare function initOnStartup(): Promise<void>;
+/** Reconcile store with actual tmux on daemon start — restart missing sessions and discover orphans. */
+export declare function restoreFromStore(): Promise<void>;
+/**
+ * Auto-restart a crashed session.
+ * Enforces max 3 restarts within 5 minutes; marks as error if exceeded.
+ */
+export declare function restartSession(record: SessionRecord): Promise<boolean>;
+interface LaunchOpts {
+    name: string;
+    projectName: string;
+    role: 'brain' | `w${number}`;
+    agentType: AgentType;
+    projectDir: string;
+    skipStore?: boolean;
+    extraEnv?: Record<string, string>;
+    /** When true, start fresh without resuming last conversation. */
+    fresh?: boolean;
+    /** CC session UUID for --session-id / --resume. Generated if absent for CC sessions. */
+    ccSessionId?: string;
+    /** Codex session UUID for `codex resume <UUID>`. */
+    codexSessionId?: string;
+    /** Gemini session UUID for `gemini --resume <UUID>`. */
+    geminiSessionId?: string;
+}
+export declare function launchSession(opts: LaunchOpts): Promise<void>;
+/** Bound ops for a session (used by status poller / response collector). */
+export declare function getSessionOps(name: string): {
+    capturePane: () => Promise<string[]>;
+    sendKeys: (keys: string) => Promise<void>;
+    showBuffer: () => Promise<string>;
+};
+export interface AutoFixProjectConfig {
+    projectName: string;
+    projectDir: string;
+    coderType: AgentType;
+    auditorType: AgentType;
+    /** Feature branch already checked out in projectDir. */
+    featureBranch: string;
+}
+/**
+ * Start sessions for auto-fix mode:
+ * - w1 (coder) session: launched in projectDir (feature branch already checked out)
+ * - brain session: launched with audit-enhanced system prompt env var so the brain dispatcher
+ *   can call registerAutoFixExtensions() on startup
+ */
+export declare function startAutoFixProject(config: AutoFixProjectConfig): Promise<{
+    coderSession: string;
+    auditorSession: string;
+}>;
+export {};
+//# sourceMappingURL=session-manager.d.ts.map

package/dist/agent/session-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.d.ts","sourceRoot":"","sources":["../../src/agent/session-manager.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAG7C,OAAO,EAML,KAAK,aAAa,EACnB,MAAM,2BAA2B,CAAC;AA2BnC,KAAK,oBAAoB,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,SAAS,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;AAG7G,wBAAgB,uBAAuB,CAAC,EAAE,EAAE,oBAAoB,GAAG,IAAI,CAEtE;AAOD,oFAAoF;AACpF,KAAK,sBAAsB,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAG5F,wBAAgB,yBAAyB,CAAC,EAAE,EAAE,sBAAsB,GAAG,IAAI,CAE1E;AAMD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,SAAS,EAAE,CAAC;IACzB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,CAStD;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,MAAM,EAAE,GAAG,MAAM,CAEjF;AAED,0DAA0D;AAC1D,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CASvE;AAED,uCAAuC;AACvC,wBAAsB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWpE;AAED,8FAA8F;AAC9F,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAEnD;AAKD,wGAAwG;AACxG,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CAoFtD;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAiC5E;AAED,UAAU,UAAU;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,GAAG,IAAI,MAAM,EAAE,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,iEAAiE;IACjE,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wFAAwF;IACxF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,aAAa,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAsKnE;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM;;qBAGrB,MAAM;;EAG1B;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,SAAS,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC;IAC/E,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC,CA4BD"}