@hienlh/ppm 0.23.24 → 0.23.26

package/src/services/chat.service.ts

@@ -1,3 +1,4 @@
+import { isMinimalMode } from "./runtime-mode.ts";
 import { providerRegistry } from "../providers/registry.ts";
 import { configService } from "./config.service.ts";
 import { createHash } from "node:crypto";
@@ -31,6 +32,7 @@ import { anyPpmToolOn, TAB_TOOLS } from "../shared/ppm-tools.ts";
 import { isTerminalAgentStatus } from "../shared/background-agent-status.ts";
 import { TraceRun, traceAbort, traceApproval, traceFollowUp } from "./session-trace/trace-recorder.ts";
 import type { TraceOrigin } from "../shared/session-trace.ts";
+import { stopChatSessionProcesses } from "./chat-session-processes/session-processes.service.ts";
 import { createLogger } from "./logger.ts";
 
 const log = createLogger("chat");
@@ -92,8 +94,24 @@ function endsDesignWork(event: ChatEvent): boolean {
 class ChatService {
   // Delivery hints only: a restart/eviction safely sends a fresh snapshot.
   private sharedSnapshots = new Map<string, string>();
-  /** Runs in flight, by every id they answer to — read only by the turn log lines. */
+  /** Runs in flight, by every id they answer to — read by the turn log lines and `turnActivity`. */
   private turnLogs = new Map<string, TurnLog>();
+  /** When each session's last turn ended, in this process. Capped like `sharedSnapshots`. */
+  private turnEnds = new Map<string, number>();
+
+  private noteTurnEnded(sessionId: string): void {
+    this.turnEnds.delete(sessionId);
+    this.turnEnds.set(sessionId, Date.now());
+    if (this.turnEnds.size > 2048) this.turnEnds.delete(this.turnEnds.keys().next().value!);
+  }
+
+  /**
+   * Whether a turn of the session is running now, through any door, and when its last one ended.
+   * What decides that the processes a chat left running have been idle long enough to stop.
+   */
+  turnActivity(sessionId: string): { running: boolean; lastEndedAt?: number } {
+    return { running: (this.turnLogs.get(sessionId)?.startedAt ?? null) !== null, lastEndedAt: this.turnEnds.get(sessionId) };
+  }
 
   private rememberSharedContext(providerId: string, sessionId: string, context?: string): void {
     if (!context) return;
@@ -175,7 +193,15 @@ class ChatService {
     tabOpenBroker.forget(sessionId);
     dbToolsMcpTokens.revoke(sessionId);
     dbApprovalBroker.cancelSession(sessionId, "The chat was deleted, so nothing ran.");
-    return provider.deleteSession(sessionId);
+    this.turnEnds.delete(sessionId);
+    // The provider ends the chat's turn and closes its CLI first. Only then is everything the
+    // chat's commands started stopped, running or not: the one stop that does not wait for idle.
+    // With no limit set it is only logged, as the idle sweep's stops are.
+    try {
+      await provider.deleteSession(sessionId);
+    } finally {
+      stopChatSessionProcesses(sessionId);
+    }
   }
 
   /**
@@ -232,6 +258,7 @@ class ChatService {
     if (event.type !== "done") return;
     const sub = event.resultSubtype;
     logTurnEnd(turn, turn.abortReason ? "aborted" : sub && sub !== "success" ? sub : turn.firstError ? "error" : "success", event);
+    this.noteTurnEnded(turn.sessionId);
     turn.startedAt = null;
     turn.abortReason = undefined;
     turn.firstError = undefined;
@@ -240,6 +267,7 @@ class ChatService {
   /** The run is over: forget it, and close a turn it left open — one that never got its `done`. */
   private endTurnLog(turn: TurnLog, outcome: "completed" | "consumer_closed" | "failed"): void {
     for (const [id, t] of this.turnLogs) if (t === turn) this.turnLogs.delete(id);
+    if (turn.startedAt !== null) this.noteTurnEnded(turn.sessionId);
     // A failed run said how it ended in "run failed".
     if (turn.startedAt === null || outcome === "failed") return;
     // no_done: the provider returned mid-turn without saying how the turn went.
@@ -294,7 +322,7 @@ class ChatService {
           }
           activeSessionId = migratedId;
         }
-        if (endsDesignWork(event)) {
+        if (!isMinimalMode() && endsDesignWork(event)) {
           // Not awaited: the snapshot is debounced and must never hold up or fail the turn.
           scheduleTurnSnapshot(activeSessionId, this.getSession(activeSessionId)?.projectPath);
         }
@@ -321,8 +349,8 @@ class ChatService {
     // A design session checks its canvas with `design_check` instead. A server is attached while
     // one of its tools is on (Settings → Tools); it lists only those.
     const ai = configService.get("ai");
-    const tabToolsMcp = !design.designSession && anyPpmToolOn(ai, TAB_TOOLS) ? tabToolsMcpAccessFor(sessionId) : null;
-    const dbToolsMcp = !design.designSession && anyPpmToolOn(ai, DB_TOOLS) && aiConnections().length > 0
+    const tabToolsMcp = !isMinimalMode() && !design.designSession && anyPpmToolOn(ai, TAB_TOOLS) ? tabToolsMcpAccessFor(sessionId) : null;
+    const dbToolsMcp = !isMinimalMode() && !design.designSession && anyPpmToolOn(ai, DB_TOOLS) && aiConnections().length > 0
       ? dbToolsMcpAccessFor(sessionId) : null;
     let sharedContext: string | undefined;
     if (configService.get("ai").share_provider_context === false || /^\s*\/(compact|clear|new)(\s|$)/i.test(message)) {
@@ -362,6 +390,7 @@ class ChatService {
    */
   private async resolveDesignOptions(providerId: string, sessionId: string, opts?: SendMessageOpts): Promise<SendMessageOpts> {
     const { designInstructions: _instructions, designSession: _flag, designMcp: _mcp, ...rest } = opts ?? {};
+    if (isMinimalMode()) return rest;
     const { getSessionDesignSlug, getSessionPermissionMode, getSessionProjectPath } = await import("./db.service.ts");
     const slug = getSessionDesignSlug(sessionId);
     if (!slug || !isValidDesignSlug(slug)) return rest;

package/src/services/claude-usage.service.ts

@@ -7,7 +7,7 @@ import {
   getAllLatestSnapshots,
   type LimitSnapshotRow,
 } from "./db.service.ts";
-import { accountService } from "./account.service.ts";
+import { accountService, isMissingScopeResponse } from "./account.service.ts";
 import { decrypt } from "../lib/account-crypto.ts";
 import { accountSelector } from "./account-selector.service.ts";
 import { registerAllUsageSources } from "./provider-usage/register-usage-sources.ts";
@@ -46,6 +46,12 @@ export interface AccountUsageEntry {
 }
 
 const API_URL = "https://api.anthropic.com/api/oauth/usage";
+const MESSAGES_URL = "https://api.anthropic.com/v1/messages";
+/**
+ * The cheapest model there is. Reading usage from response headers is a real request billed to
+ * the account (about ten input tokens and one output token), so it goes to the smallest model.
+ */
+const HEADER_PROBE_MODEL = "claude-haiku-4-5";
 const API_BETA = "oauth-2025-04-20";
 const USER_AGENT = "claude-code/1.0";
 const FETCH_TIMEOUT = 10_000;
@@ -106,6 +112,60 @@ function snapshotToUsage(row: LimitSnapshotRow): ClaudeUsage {
 // Fetch usage for a single token
 // ---------------------------------------------------------------------------
 
+/** Back off a token after a 429, and say for how long. */
+function coolDown(token: string, res: Response, what: string): Error {
+  const retryAfter = parseInt(res.headers.get("retry-after") ?? "60", 10);
+  const cooldownMs = Math.max(retryAfter * 1000, MIN_COOLDOWN_MS);
+  tokenCooldowns.set(token.substring(0, 20), Date.now() + cooldownMs);
+  return new Error(`${what} 429 — cooldown ${Math.ceil(cooldownMs / 1000)}s`);
+}
+
+/** One `anthropic-ratelimit-unified-<window>-*` header pair as a bucket; utilization arrives as 0–1. */
+function headerBucket(headers: Headers, window: string, windowHours: number): LimitBucket | undefined {
+  const util = Number(headers.get(`anthropic-ratelimit-unified-${window}-utilization`) ?? NaN);
+  if (!Number.isFinite(util)) return undefined;
+  const resetS = Number(headers.get(`anthropic-ratelimit-unified-${window}-reset`) ?? 0);
+  return parseApiBucket({
+    utilization: util * 100,
+    resets_at: resetS > 0 ? new Date(resetS * 1000).toISOString() : "",
+  }, windowHours);
+}
+
+/**
+ * Usage for a token that may not read the usage endpoint: one from `claude setup-token` carries
+ * only `user:inference`, so `/api/oauth/usage` answers 403. Every message response carries the
+ * same 5-hour and 7-day figures in its `anthropic-ratelimit-unified-*` headers (Claude Code's
+ * own status line reads them there), so a one-token message reads them back. Unlike the usage
+ * endpoint this spends a little of the account's limit, which is why it is the fallback only.
+ */
+async function fetchUsageFromRateLimitHeaders(token: string): Promise<ClaudeUsage> {
+  const res = await fetch(MESSAGES_URL, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      Authorization: `Bearer ${token}`,
+      "anthropic-version": "2023-06-01",
+      "anthropic-beta": API_BETA,
+      "User-Agent": USER_AGENT,
+    },
+    body: JSON.stringify({ model: HEADER_PROBE_MODEL, max_tokens: 1, messages: [{ role: "user", content: "hi" }] }),
+    signal: AbortSignal.timeout(FETCH_TIMEOUT),
+  });
+  await res.text().catch(() => "");
+  // A refused message still reports the windows it was refused for — that is the reading an
+  // exhausted account most needs — so the headers are read whatever the status.
+  const session = headerBucket(res.headers, "5h", 5);
+  const weekly = headerBucket(res.headers, "7d", 168);
+  if (!session && !weekly) {
+    if (res.status === 429) throw coolDown(token, res, "Usage via message");
+    throw new Error(`Usage via message returned ${res.status} with no rate-limit headers`);
+  }
+  const data: ClaudeUsage = { lastFetchedAt: new Date().toISOString() };
+  if (session) data.session = session;
+  if (weekly) data.weekly = weekly;
+  return data;
+}
+
 async function fetchUsageForToken(token: string): Promise<ClaudeUsage> {
   const res = await fetch(API_URL, {
     headers: {
@@ -116,12 +176,9 @@ async function fetchUsageForToken(token: string): Promise<ClaudeUsage> {
     },
     signal: AbortSignal.timeout(FETCH_TIMEOUT),
   });
-  if (res.status === 429) {
-    const retryAfter = parseInt(res.headers.get("retry-after") ?? "60", 10);
-    const cooldownMs = Math.max(retryAfter * 1000, MIN_COOLDOWN_MS);
-    const cooldownKey = token.substring(0, 20);
-    tokenCooldowns.set(cooldownKey, Date.now() + cooldownMs);
-    throw new Error(`Usage API 429 — cooldown ${Math.ceil(cooldownMs / 1000)}s`);
+  if (res.status === 429) throw coolDown(token, res, "Usage API");
+  if (res.status === 403 && isMissingScopeResponse(res.status, await res.text().catch(() => ""))) {
+    return fetchUsageFromRateLimitHeaders(token);
   }
   if (!res.ok) throw new Error(`Usage API returned ${res.status}`);
   const raw = (await res.json()) as Record<string, any>;

package/src/services/config-secret-keys.ts

@@ -11,6 +11,7 @@
  */
 export const SECRET_CONFIG_KEYS: readonly string[] = [
   "tunnel.namedTunnelToken",
+  "share_host.token",
   "auth.token",
   "telegram.bot_token",
   "ntfy.token",

package/src/services/config.service.ts

@@ -23,6 +23,7 @@ import {
  */
 const CONFIG_TABLE_KEYS: (keyof PpmConfig)[] = [
   "device_name", "port", "host", "theme", "auth", "ai", "telegram", "ntfy", "clawbot", "notifications", "query_audit", "session_trace", "tunnel",
+  "share_host",
 ];
 
 const log = createLogger("config");

package/src/services/db.service.ts

@@ -14,7 +14,7 @@ const log = createLogger("db");
 const proxyLog = createLogger("proxy");
 // Must equal the last `PRAGMA user_version` below: the pre-migration snapshot is skipped for
 // any database already at this version, so a stale value silently drops that backup.
-export const CURRENT_SCHEMA_VERSION = 57;
+export const CURRENT_SCHEMA_VERSION = 58;
 
 let db: Database | null = null;
 let dbProfile: string | null = null;
@@ -1283,6 +1283,63 @@ export function runMigrations(database: Database): void {
     `);
     database.exec(`PRAGMA user_version = 57;`);
   }
+
+  if (current < 58) {
+    // Script schedules. Columns are added rather than the table rebuilt: rebuilding a table
+    // other tables reference cascades their rows away (see migration 55). Every schedule saved
+    // before this was a prompt run once per cron fire, which is what the defaults say.
+    for (const column of [
+      "kind TEXT NOT NULL DEFAULT 'prompt' CHECK (kind IN ('prompt', 'script'))",
+      "mode TEXT NOT NULL DEFAULT 'tick' CHECK (mode IN ('tick', 'always-on'))",
+      "description TEXT NOT NULL DEFAULT ''",
+      "script TEXT",
+      "inputs_json TEXT NOT NULL DEFAULT '[]'",
+      "input_values_json TEXT NOT NULL DEFAULT '{}'",
+      "secrets_enc TEXT",
+      "state_json TEXT",
+    ]) {
+      try { database.exec(`ALTER TABLE schedules ADD COLUMN ${column}`); } catch { /* column exists */ }
+    }
+    database.exec(`
+      -- The chat a script's ctx.ai.chat(key) talks to; title is the one the script last set.
+      CREATE TABLE IF NOT EXISTS schedule_chats (
+        schedule_id  INTEGER NOT NULL REFERENCES schedules(id) ON DELETE CASCADE,
+        key          TEXT NOT NULL,
+        session_id   TEXT NOT NULL,
+        title        TEXT,
+        created_at   TEXT NOT NULL DEFAULT (datetime('now')),
+        last_used_at TEXT,
+        PRIMARY KEY (schedule_id, key)
+      );
+      -- Chat turns a script started without waiting; ctx.ai.finished() hands each out once.
+      CREATE TABLE IF NOT EXISTS schedule_ai_turns (
+        id          INTEGER PRIMARY KEY AUTOINCREMENT,
+        schedule_id INTEGER NOT NULL REFERENCES schedules(id) ON DELETE CASCADE,
+        key         TEXT NOT NULL,
+        session_id  TEXT NOT NULL,
+        status      TEXT NOT NULL CHECK (status IN ('running', 'done', 'error')),
+        text        TEXT,
+        cost_usd    REAL,
+        error       TEXT,
+        timed_out   INTEGER NOT NULL DEFAULT 0,
+        started_at  TEXT NOT NULL DEFAULT (datetime('now')),
+        finished_at TEXT,
+        collected   INTEGER NOT NULL DEFAULT 0
+      );
+      CREATE INDEX IF NOT EXISTS idx_schedule_ai_turns_sched ON schedule_ai_turns(schedule_id, collected, status);
+      -- The child process a script schedule runs in, so a restarted server can find one it left behind.
+      CREATE TABLE IF NOT EXISTS schedule_runtime (
+        schedule_id  INTEGER PRIMARY KEY REFERENCES schedules(id) ON DELETE CASCADE,
+        pid          INTEGER,
+        token        TEXT,
+        started_at   TEXT,
+        restarts     INTEGER NOT NULL DEFAULT 0,
+        last_exit_at TEXT,
+        last_error   TEXT
+      );
+      PRAGMA user_version = 58;
+    `);
+  }
 }
 
 /**

package/src/services/design/preview/design-csp.ts

@@ -3,26 +3,31 @@ import { DESIGN_CDN_HOSTS } from "../../../shared/design-cdn-hosts.ts";
 /**
  * The Content-Security-Policy every design document is served under.
  *
- * `source` is the capability's own prefix (`host/api/design-preview/content/<token>/`),
- * scheme-less so it follows the document's real scheme through a tunnel. The boundary this
- * policy draws is `connect-src`: only the design's own files, never a CDN and never `*`,
- * because `fetch`/XHR/WebSocket are how a page would send data somewhere. `'unsafe-eval'` is
+ * `source` is the capability's own prefix (`host/api/design-preview/content/<token>/`), written
+ * out under both `https://` and `http://` because behind a tunnel the browser's scheme is not
+ * the one the request reached PPM on. It must not go out scheme-less: that takes its scheme
+ * from the document's origin, which WebKit reads off the sandboxed frame's opaque origin, so
+ * it matches nothing there — WebKit 26.4 and 26.5 refused every file of the page, and 26.6
+ * still refuses the page's `fetch` of its own files. The boundary this policy draws is
+ * `connect-src`: only the design's own files, never a CDN and never `*`, because
+ * `fetch`/XHR/WebSocket are how a page would send data somewhere. `'unsafe-eval'` is
  * allowed on purpose — `'unsafe-inline'` already runs any code written into the file, and
  * common CDN setups (Alpine, Vue in-DOM templates, Babel standalone) need eval.
  *
  * `allowModals` is for the print view only, which needs `print()`; a canvas never gets it.
  */
 export function buildDesignCsp(source: string, opts: { allowModals?: boolean } = {}): string {
+  const own = `https://${source} http://${source}`;
   const cdns = DESIGN_CDN_HOSTS.map((host) => `https://${host}`).join(" ");
   return [
     opts.allowModals ? "sandbox allow-scripts allow-modals" : "sandbox allow-scripts",
     "default-src 'none'",
-    `script-src 'unsafe-inline' 'unsafe-eval' ${source} ${cdns}`,
-    `style-src 'unsafe-inline' ${source} ${cdns}`,
-    `font-src ${source} data: ${cdns}`,
-    `img-src ${source} data: blob: ${cdns}`,
-    `media-src ${source} blob:`,
-    `connect-src ${source}`,
+    `script-src 'unsafe-inline' 'unsafe-eval' ${own} ${cdns}`,
+    `style-src 'unsafe-inline' ${own} ${cdns}`,
+    `font-src ${own} data: ${cdns}`,
+    `img-src ${own} data: blob: ${cdns}`,
+    `media-src ${own} blob:`,
+    `connect-src ${own}`,
     "base-uri 'none'",
     "form-action 'none'",
     "frame-ancestors 'self'",

package/src/services/design/share/design-share-address.ts

@@ -3,73 +3,108 @@ import { readStatus } from "../../supervisor-state.ts";
 import { tunnelService } from "../../tunnel.service.ts";
 import { getConfigValue } from "../../db.service.ts";
 import { resolveTunnelConfig } from "../../named-tunnel/named-tunnel-config.ts";
+import { resolveShareHostConfig } from "../../share-host/share-host-config.ts";
+import { originOf, pidAlive, readShareHostLive, shareHostApplyProblem } from "../../share-host/share-host-status.ts";
 import { shareAuthEnabled } from "./design-share-link-rules.ts";
 
 /**
  * The public address a share link is reachable at now.
  *
- * Under a supervisor, `status.json` is read directly rather than through
- * `tunnelService.getTunnelUrl()`: that keeps the last URL it saw when the supervisor nulls
- * `shareUrl`, and a link built on it would point at a tunnel that is gone. Without a
- * supervisor the only tunnel is one this server process started itself, which is quick.
+ * With the share host switched on, that is the share host's address and nothing else: it
+ * reaches the review pages only, and falling back to PPM's own tunnel would hand reviewers an
+ * address that reaches all of PPM. A stable hostname is kept while it reconnects, with a
+ * warning; a quick one has no address until it is up.
  *
- * Cached for {@link ADDRESS_CACHE_MS}, because guest requests read it too.
+ * Otherwise it is PPM's own tunnel. Under a supervisor, `status.json` is read directly rather
+ * than through `tunnelService.getTunnelUrl()`: that keeps the last URL it saw when the
+ * supervisor nulls `shareUrl`, and a link built on it would point at a tunnel that is gone.
+ * Without a supervisor the only tunnel is one this server process started itself, which is
+ * quick.
+ *
+ * Cached for {@link ADDRESS_CACHE_MS}, because guest requests read it too; the owner's own read
+ * ({@link getShareAddress}) is always fresh.
  */
 
 export const ADDRESS_CACHE_MS = 5000;
+export const SHARE_HOST_NOT_CONNECTED = "The review address is not connected right now. Links work again once it reconnects.";
 
-export type ShareTunnelAddress = Pick<DesignShareAddress, "kind" | "url" | "warning">;
+export type ShareTunnelAddress = Pick<DesignShareAddress, "kind" | "url" | "warning" | "via">;
 
-const NONE: ShareTunnelAddress = { kind: "none", url: null, warning: null };
-let cache: { at: number; value: ShareTunnelAddress } | null = null;
+const NONE: ShareTunnelAddress = { kind: "none", url: null, warning: null, via: "ppm" };
+let cache: { at: number; value: ShareTunnelAddress; hosts: string[] } | null = null;
 
-/** Alive, or owned by another user (`EPERM`), which is still a running process. */
-function pidAlive(pid: unknown): boolean {
-  if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) return false;
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (e) {
-    return (e as { code?: string }).code === "EPERM";
+function readPpmTunnelAddress(status: Record<string, unknown>): ShareTunnelAddress {
+  if (pidAlive(status.supervisorPid)) {
+    const warning = typeof status.tunnelWarning === "string" && status.tunnelWarning ? status.tunnelWarning : null;
+    const url = originOf(status.shareUrl);
+    // A recorded tunnel process that has died means the URL answers nothing.
+    if (!url || (status.tunnelPid != null && !pidAlive(status.tunnelPid))) return { ...NONE, warning };
+    return { kind: status.tunnelMode === "named" ? "named" : "quick", url, warning, via: "ppm" };
   }
+  const url = originOf(tunnelService.getTunnelUrl());
+  if (url && pidAlive(tunnelService.getTunnelPid())) return { kind: "quick", url, warning: null, via: "ppm" };
+  return NONE;
 }
 
-function originOf(url: unknown): string | null {
-  if (typeof url !== "string" || !url) return null;
+function hostOf(url: string | null): string | null {
+  if (!url) return null;
   try {
-    const parsed = new URL(url);
-    return parsed.protocol === "https:" || parsed.protocol === "http:" ? parsed.origin : null;
+    return new URL(url).host.toLowerCase();
   } catch {
     return null;
   }
 }
 
-function readTunnelAddress(): ShareTunnelAddress {
+function readAddresses(): { value: ShareTunnelAddress; hosts: string[] } {
   const status = readStatus();
-  if (pidAlive(status.supervisorPid)) {
-    const warning = typeof status.tunnelWarning === "string" && status.tunnelWarning ? status.tunnelWarning : null;
-    const url = originOf(status.shareUrl);
-    // A recorded tunnel process that has died means the URL answers nothing.
-    if (!url || (status.tunnelPid != null && !pidAlive(status.tunnelPid))) return { ...NONE, warning };
-    return { kind: status.tunnelMode === "named" ? "named" : "quick", url, warning };
-  }
-  const url = originOf(tunnelService.getTunnelUrl());
-  if (url && pidAlive(tunnelService.getTunnelPid())) return { kind: "quick", url, warning: null };
-  return NONE;
+  const ppm = readPpmTunnelAddress(status);
+  const shareHost = readShareHostLive(resolveShareHostConfig(getConfigValue("share_host")), status);
+  // A temporary address stays published while its worker restarts, and is what its reviewers
+  // come back through: they keep their own rate-limit keys rather than all sharing "local".
+  const published = shareHost.enabled ? originOf(status.shareHostUrl) : null;
+  const hosts = [...new Set([hostOf(ppm.url), hostOf(shareHost.url), hostOf(published)])].filter((h): h is string => h !== null);
+  if (!shareHost.enabled) return { value: ppm, hosts };
+  // Down because nothing will ever act on the switch: say that rather than "reconnecting".
+  const problem = shareHost.connected ? null : shareHostApplyProblem(status);
+  const value: ShareTunnelAddress = shareHost.url
+    ? {
+        kind: shareHost.mode === "quick" ? "quick" : "named",
+        url: shareHost.url,
+        warning: shareHost.connected ? shareHost.warning : problem ?? shareHost.warning ?? SHARE_HOST_NOT_CONNECTED,
+        via: "share-host",
+      }
+    : { kind: "none", url: null, warning: problem ?? shareHost.warning, via: "share-host" };
+  return { value, hosts };
+}
+
+function cached(now: number): { value: ShareTunnelAddress; hosts: string[] } {
+  if (cache && now - cache.at < ADDRESS_CACHE_MS) return cache;
+  cache = { at: now, ...readAddresses() };
+  return cache;
 }
 
 /** Kind, origin and warning of the current public address (cached). */
 export function getShareTunnelAddress(now = Date.now()): ShareTunnelAddress {
-  if (cache && now - cache.at < ADDRESS_CACHE_MS) return cache.value;
-  const value = readTunnelAddress();
-  cache = { at: now, value };
-  return value;
+  return cached(now).value;
 }
 
-/** The address plus the two switches the Share dialog needs, which are read live. */
+/**
+ * The public hostnames whose requests reach PPM through a connector on this machine — PPM's own
+ * tunnel and the share host — lower-cased `host[:port]` (cached).
+ */
+export function getForwardedShareHosts(now = Date.now()): string[] {
+  return cached(now).hosts;
+}
+
+/**
+ * The address plus the two switches the Share dialog needs. Read fresh, past the cache: the
+ * dialog asks right after flipping a switch and while an address comes up. What it reads
+ * replaces the cached address.
+ */
 export function getShareAddress(): DesignShareAddress {
+  cache = { at: Date.now(), ...readAddresses() };
   return {
-    ...getShareTunnelAddress(),
+    ...cache.value,
     enabled: resolveTunnelConfig(getConfigValue("tunnel")).enabled,
     authEnabled: shareAuthEnabled(),
   };

package/src/services/design/share/design-share-client-key.ts

@@ -1,14 +1,14 @@
 import { isIP } from "node:net";
-import { getShareTunnelAddress } from "./design-share-address.ts";
+import { getForwardedShareHosts } from "./design-share-address.ts";
 
 /**
  * Which client a reviewer's request is counted against, for the share routes' rate limits.
  *
- * `CF-Connecting-IP` is believed only when the request came through PPM's own tunnel: the
- * peer is loopback (cloudflared, or the supervisor's edge forwarder, runs on this machine)
- * and `Host` is the tunnel's public hostname (cached by the address helper, so no file is
- * read per request). Cloudflare's edge sets that header itself; anywhere else it is
- * whatever the client wrote. Every other request is keyed by its peer address, and loopback
+ * `CF-Connecting-IP` is believed only when the request came through a tunnel of this
+ * machine's: the peer is loopback (cloudflared, the supervisor's edge forwarder or the share
+ * host's worker, all on this machine) and `Host` is one of the public hostnames — PPM's own
+ * tunnel or the share host (cached by the address helper, so no file is read per request).
+ * Cloudflare's edge sets that header itself; anywhere else it is whatever the client wrote. Every other request is keyed by its peer address, and loopback
  * peers share one key, `"local"` — behind the supervisor that is every LAN and Tailscale
  * reviewer at once, which the budgets are sized for.
  *
@@ -18,8 +18,8 @@ import { getShareTunnelAddress } from "./design-share-address.ts";
 
 export const LOCAL_CLIENT_KEY = "local";
 
-/** Test seam: where the current public tunnel URL comes from. */
-export const clientKeyDeps = { tunnelUrl: (): string | null => getShareTunnelAddress().url };
+/** Test seam: the public hostnames (`host[:port]`, lower-cased) whose tunnels end on this machine. */
+export const clientKeyDeps = { publicHosts: (): string[] => getForwardedShareHosts() };
 
 /** What `c.env` holds when Hono runs under `Bun.serve`: the server, which knows the peer. */
 interface PeerSource {
@@ -50,23 +50,12 @@ export function isLoopbackAddress(address: string): boolean {
   return address === "::1" || (isIP(v4) === 4 && v4.startsWith("127."));
 }
 
-/** The public tunnel's host (`name.example.com`), lower-cased, or null when there is none. */
-function tunnelHost(): string | null {
-  const url = clientKeyDeps.tunnelUrl();
-  if (!url) return null;
-  try {
-    return new URL(url).host.toLowerCase();
-  } catch {
-    return null;
-  }
-}
-
 export function shareClientKey(input: ClientKeyInput): string {
   const peer = peerAddress(input.env, input.req);
   if (!peer) return LOCAL_CLIENT_KEY;
   if (!isLoopbackAddress(peer)) return `ip:${peer}`;
   const forwarded = input.cfConnectingIp?.trim();
   const host = input.host?.trim().toLowerCase();
-  if (forwarded && host && isIP(forwarded) && host === tunnelHost()) return `cf:${forwarded.toLowerCase()}`;
+  if (forwarded && host && isIP(forwarded) && clientKeyDeps.publicHosts().includes(host)) return `cf:${forwarded.toLowerCase()}`;
   return LOCAL_CLIENT_KEY;
 }

package/src/services/named-tunnel/named-tunnel-setup.service.ts

@@ -36,7 +36,7 @@ export class SetupError extends Error {
 // and `=` padding — a real token is ~180 chars ending in `=`), not URL-safe
 // base64, so the alphabet must include those three or every real token is
 // rejected as "unexpected output".
-const TOKEN_SHAPE = /^[A-Za-z0-9+/=._-]{100,}$/;
+export const TOKEN_SHAPE = /^[A-Za-z0-9+/=._-]{100,}$/;
 const RELOAD_RETRY_DELAY_MS = 2_000;
 
 /** Module-level in-flight guard — two concurrent setups would race `route dns`. */

package/src/services/proxy-openai-bridge.ts

@@ -5,7 +5,7 @@
  * Endpoint: POST /proxy/v1/chat/completions
  * Reference: https://github.com/fuergaosi233/claude-code-proxy
  */
-import { query } from "@anthropic-ai/claude-agent-sdk";
+import { query } from "../providers/claude-cli-process-group.ts";
 import { accountSelector } from "./account-selector.service.ts";
 import {
   buildPromptFromOpenAiMessages, openAiError, SSE_HEADERS,

package/src/services/proxy-sdk-bridge.ts

@@ -6,7 +6,7 @@
  * meant for the Claude Code infrastructure, not raw api.anthropic.com.
  * This bridge uses the same SDK approach as opencode-claude-max-proxy.
  */
-import { query } from "@anthropic-ai/claude-agent-sdk";
+import { query } from "../providers/claude-cli-process-group.ts";
 import { accountSelector } from "./account-selector.service.ts";
 
 /** Map Anthropic model IDs to SDK model names */

package/src/services/runtime-mode.ts

@@ -0,0 +1,15 @@
+/** Process-scoped mode; propagated through supervisor/server argv, never global config. */
+export function isMinimalMode(argv: readonly string[] = process.argv): boolean {
+  return argv.includes("--minimal");
+}
+
+/** Services outside the chat workspace stay unavailable, even to a stale full-mode client. */
+export function isMinimalPathDisabled(path: string): boolean {
+  if (path.startsWith("/ws/")) {
+    return !/^\/ws\/(health|global)\/?$/.test(path) && !/^\/ws\/project\/[^/]+\/chat(?:\/|$)/.test(path);
+  }
+  return /^\/(proxy|s)(\/|$)/.test(path)
+    || /^\/api\/(db|db-tools-mcp|tab-tools-mcp|design-mcp|design-preview|design-shares|system|extensions|schedules|jira|ppmbot|group-chat|remote-desktop|android|lsp|preview|html-preview|tunnels|logs)(\/|$)/.test(path)
+    || /^\/api\/settings\/(design|clawbot)(\/|$)/.test(path)
+    || /^\/api\/project\/[^/]+\/(git|lsp|designs)(\/|$)/.test(path);
+}