@hyperdrive.bot/fleet-server 0.3.153 → 0.3.155

package/dist/server/server/agent/providers/claude/transport/tmux.d.ts

@@ -50,6 +50,20 @@ export interface TmuxWrap {
     session: string;
 }
 export declare function tmuxEnabled(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Env the pane must get from THIS agent, never from the tmux server.
+ *
+ * The server is started once, by whichever agent spawns first, and keeps that agent's
+ * environment for its whole life; every pane is the server's child and inherits it. So a
+ * value that differs per agent silently becomes the first agent's value everywhere
+ * (AWPROD-6933: half the live sessions carried one agent's PASEO_AGENT_ID, and `/cleanup` in
+ * any of them archived that agent). `new-session -e` puts the value on the session itself,
+ * which tmux layers over the server's global environment.
+ *
+ * An allowlist, not "all of env": these land in argv, which `ps` shows to every process on
+ * the host, so nothing secret belongs here. PASEO_AGENT_ID is an id, not a credential.
+ */
+export declare const TMUX_PER_AGENT_ENV: readonly ["PASEO_AGENT_ID"];
 /** Stable, collision-free session name. */
 export declare function tmuxSessionName(sessionId: string): string;
 /**

package/dist/server/server/agent/providers/claude/transport/tmux.js

@@ -75,6 +75,20 @@ function writeConf(dir, dims) {
     ].join("\n") + "\n", { mode: 0o600 });
     return conf;
 }
+/**
+ * Env the pane must get from THIS agent, never from the tmux server.
+ *
+ * The server is started once, by whichever agent spawns first, and keeps that agent's
+ * environment for its whole life; every pane is the server's child and inherits it. So a
+ * value that differs per agent silently becomes the first agent's value everywhere
+ * (AWPROD-6933: half the live sessions carried one agent's PASEO_AGENT_ID, and `/cleanup` in
+ * any of them archived that agent). `new-session -e` puts the value on the session itself,
+ * which tmux layers over the server's global environment.
+ *
+ * An allowlist, not "all of env": these land in argv, which `ps` shows to every process on
+ * the host, so nothing secret belongs here. PASEO_AGENT_ID is an id, not a credential.
+ */
+export const TMUX_PER_AGENT_ENV = ["PASEO_AGENT_ID"];
 /** Stable, collision-free session name. */
 export function tmuxSessionName(sessionId) {
     return `paseo-${sessionId.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 40)}`;
@@ -96,6 +110,10 @@ export function wrapWithTmux(opts) {
     const socket = path.join(dir, "paseo.sock");
     const conf = writeConf(dir, opts.dims);
     const session = tmuxSessionName(opts.sessionId);
+    const perAgentEnv = TMUX_PER_AGENT_ENV.flatMap((key) => {
+        const value = opts.env[key];
+        return value ? ["-e", `${key}=${value}`] : [];
+    });
     return {
         binary: "tmux",
         args: [
@@ -113,6 +131,7 @@ export function wrapWithTmux(opts) {
             String(opts.dims.cols),
             "-y",
             String(opts.dims.rows),
+            ...perAgentEnv,
             "--",
             opts.binary,
             ...opts.args,

package/dist/server/server/agent/tools/paseo-tools.js

@@ -1606,14 +1606,30 @@ export function createPaseoToolCatalog(options) {
     });
     registerTool("archive_agent", {
         title: "Archive agent",
-        description: "Archive an agent (soft-delete). The agent is interrupted if running and removed from the active list.",
+        description: "Archive an agent (soft-delete). The agent is interrupted if running and removed from the active list. " +
+            "When archiving YOURSELF (end of session), pass expectSelf: true: the call is then refused unless " +
+            "agentId is the agent this MCP connection belongs to, so a stale or inherited PASEO_AGENT_ID can " +
+            "never archive someone else's session.",
         inputSchema: {
             agentId: z.string(),
+            expectSelf: z.boolean().optional(),
         },
         outputSchema: {
             success: z.boolean(),
         },
-    }, async ({ agentId }) => {
+    }, async ({ agentId, expectSelf }) => {
+        // AWPROD-6933: PASEO_AGENT_ID reached agents through a shared tmux server and named the
+        // FIRST agent that server was started for, so a self-archive in any other session
+        // archived that one instead. callerAgentId comes from this connection's own url, which
+        // is the value nothing inherits.
+        if (expectSelf && agentId !== callerAgentId) {
+            throw new Error(callerAgentId
+                ? `Refusing to archive ${agentId}: expectSelf is set but this session is agent ` +
+                    `${callerAgentId}. Your PASEO_AGENT_ID is probably inherited from another agent; ` +
+                    `nothing was archived.`
+                : `Refusing to archive ${agentId}: expectSelf is set but this connection has no caller ` +
+                    `agent to compare against; nothing was archived.`);
+        }
         await archiveAgentCommand({
             agentManager,
             agentStorage,