@jlongo78/agent-spaces 0.9.8 → 0.9.10

package/.next/standalone/src/components/workspace/workspace-todos.tsx

@@ -0,0 +1,265 @@
+'use client';
+
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { Check, Plus, X } from 'lucide-react';
+import { api } from '@/lib/api';
+import type { Workspace, WorkspaceTodo } from '@/types/claude';
+
+export function WorkspaceTodos({ workspace }: { workspace: Workspace | null }) {
+  const workspaceId = workspace?.id ?? null;
+  const color = workspace?.color ?? '#6366f1';
+
+  const [todos, setTodos] = useState<WorkspaceTodo[]>([]);
+  const [adding, setAdding] = useState(false);
+  const [addInput, setAddInput] = useState('');
+  const [editingId, setEditingId] = useState<number | null>(null);
+  const [editText, setEditText] = useState('');
+  const addInputRef = useRef<HTMLInputElement>(null);
+
+  useEffect(() => {
+    if (workspaceId == null) { setTodos([]); return; }
+    let cancelled = false;
+    fetch(api(`/api/workspaces/${workspaceId}/todos`))
+      .then(r => r.json())
+      .then((data: WorkspaceTodo[]) => { if (!cancelled) setTodos(Array.isArray(data) ? data : []); })
+      .catch(() => { if (!cancelled) setTodos([]); });
+    return () => { cancelled = true; };
+  }, [workspaceId]);
+
+  const addTodo = useCallback(async () => {
+    const text = addInput.trim();
+    if (!text || workspaceId == null) { setAddInput(''); setAdding(false); return; }
+
+    const tempId = -Date.now();
+    const temp: WorkspaceTodo = {
+      id: tempId,
+      workspaceId,
+      text,
+      completed: false,
+      sortOrder: Number.MAX_SAFE_INTEGER,
+      created: new Date().toISOString(),
+      completedAt: null,
+    };
+    setTodos(prev => [...prev, temp]);
+    setAddInput('');
+    addInputRef.current?.focus();
+
+    try {
+      const res = await fetch(api(`/api/workspaces/${workspaceId}/todos`), {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ text }),
+      });
+      if (!res.ok) throw new Error(await res.text());
+      const real: WorkspaceTodo = await res.json();
+      setTodos(prev => prev.map(t => t.id === tempId ? real : t));
+    } catch (err) {
+      console.error('failed to add todo', err);
+      setTodos(prev => prev.filter(t => t.id !== tempId));
+    }
+  }, [addInput, workspaceId]);
+
+  const toggleTodo = useCallback(async (todo: WorkspaceTodo) => {
+    if (workspaceId == null) return;
+    const next = !todo.completed;
+    setTodos(prev => prev.map(t => t.id === todo.id
+      ? { ...t, completed: next, completedAt: next ? new Date().toISOString() : null }
+      : t
+    ));
+    try {
+      const res = await fetch(api(`/api/workspaces/${workspaceId}/todos/${todo.id}`), {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ completed: next }),
+      });
+      if (!res.ok) throw new Error();
+      const real: WorkspaceTodo = await res.json();
+      setTodos(prev => prev.map(t => t.id === todo.id ? real : t));
+    } catch {
+      setTodos(prev => prev.map(t => t.id === todo.id ? todo : t));
+    }
+  }, [workspaceId]);
+
+  const deleteTodo = useCallback(async (todo: WorkspaceTodo) => {
+    if (workspaceId == null) return;
+    // Snapshot the original index so we can restore in place on failure,
+    // rather than appending to the end.
+    let originalIndex = -1;
+    setTodos(prev => {
+      originalIndex = prev.findIndex(t => t.id === todo.id);
+      return prev.filter(t => t.id !== todo.id);
+    });
+    try {
+      const res = await fetch(api(`/api/workspaces/${workspaceId}/todos/${todo.id}`), { method: 'DELETE' });
+      if (!res.ok) throw new Error();
+    } catch {
+      setTodos(prev => {
+        if (originalIndex < 0 || prev.some(t => t.id === todo.id)) return prev;
+        const next = [...prev];
+        next.splice(Math.min(originalIndex, next.length), 0, todo);
+        return next;
+      });
+    }
+  }, [workspaceId]);
+
+  const saveEdit = useCallback(async (todo: WorkspaceTodo) => {
+    const text = editText.trim();
+    setEditingId(null);
+    if (!text || text === todo.text || workspaceId == null) return;
+    setTodos(prev => prev.map(t => t.id === todo.id ? { ...t, text } : t));
+    try {
+      const res = await fetch(api(`/api/workspaces/${workspaceId}/todos/${todo.id}`), {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ text }),
+      });
+      if (!res.ok) throw new Error();
+    } catch {
+      setTodos(prev => prev.map(t => t.id === todo.id ? { ...t, text: todo.text } : t));
+    }
+  }, [editText, workspaceId]);
+
+  const clearCompleted = useCallback(async () => {
+    if (workspaceId == null) return;
+    const done = todos.filter(t => t.completed);
+    if (done.length === 0) return;
+    setTodos(prev => prev.filter(t => !t.completed));
+    const results = await Promise.allSettled(
+      done.map(t => fetch(api(`/api/workspaces/${workspaceId}/todos/${t.id}`), { method: 'DELETE' }))
+    );
+    if (results.some(r => r.status === 'rejected' || (r.status === 'fulfilled' && !r.value.ok))) {
+      // Reconcile by refetching
+      fetch(api(`/api/workspaces/${workspaceId}/todos`))
+        .then(r => r.json())
+        .then((data: WorkspaceTodo[]) => setTodos(Array.isArray(data) ? data : []))
+        .catch(() => {});
+    }
+  }, [todos, workspaceId]);
+
+  const sorted = [...todos].sort((a, b) => {
+    if (a.completed !== b.completed) return a.completed ? 1 : -1;
+    if (!a.completed) return a.sortOrder - b.sortOrder;
+    const aT = a.completedAt ?? '';
+    const bT = b.completedAt ?? '';
+    return bT.localeCompare(aT);
+  });
+  const completedCount = sorted.filter(t => t.completed).length;
+
+  const chipHeight = 'h-7';
+  const chipShape = `${chipHeight} rounded-full inline-flex items-center gap-1.5 pl-2 pr-1 py-1 text-xs border whitespace-nowrap`;
+
+  return (
+    <div className="border-b border-zinc-800 bg-zinc-900/40 px-4 py-2 flex-shrink-0">
+      <div className="flex flex-wrap items-center gap-1.5 max-h-[30vh] overflow-y-auto">
+        {sorted.map(todo => {
+          const isEditing = editingId === todo.id;
+          const activeStyle = {
+            backgroundColor: `${color}22`,
+            borderColor: `${color}66`,
+            color: color,
+          };
+          const doneStyle = {
+            backgroundColor: 'rgba(39, 39, 42, 0.5)',
+            borderColor: 'rgba(63, 63, 70, 0.5)',
+            color: 'rgb(113, 113, 122)',
+          };
+          const style = todo.completed ? doneStyle : activeStyle;
+
+          return (
+            <div
+              key={todo.id}
+              className={`group ${chipShape}`}
+              style={style}
+            >
+              <button
+                onClick={() => toggleTodo(todo)}
+                className="w-3.5 h-3.5 rounded-full border-2 flex items-center justify-center flex-shrink-0 transition-colors"
+                style={{
+                  borderColor: todo.completed ? color : `${color}aa`,
+                  backgroundColor: todo.completed ? color : 'transparent',
+                }}
+                aria-label={todo.completed ? 'Mark incomplete' : 'Mark complete'}
+              >
+                {todo.completed && <Check className="w-2.5 h-2.5 text-white" />}
+              </button>
+
+              {isEditing ? (
+                <input
+                  autoFocus
+                  value={editText}
+                  onChange={e => setEditText(e.target.value)}
+                  onBlur={() => saveEdit(todo)}
+                  onKeyDown={e => {
+                    if (e.key === 'Enter') saveEdit(todo);
+                    if (e.key === 'Escape') setEditingId(null);
+                  }}
+                  className="bg-transparent focus:outline-none max-w-[240px]"
+                  style={{ color: 'inherit' }}
+                />
+              ) : (
+                <button
+                  onClick={() => { setEditingId(todo.id); setEditText(todo.text); }}
+                  className={`text-left truncate max-w-[200px] ${todo.completed ? 'line-through' : ''}`}
+                  style={{ color: 'inherit' }}
+                >
+                  {todo.text}
+                </button>
+              )}
+
+              <button
+                onClick={() => deleteTodo(todo)}
+                className="opacity-0 group-hover:opacity-100 transition-opacity rounded-full p-0.5 hover:bg-black/20 flex-shrink-0"
+                style={{ color: 'inherit' }}
+                aria-label="Delete todo"
+              >
+                <X className="w-3 h-3" />
+              </button>
+            </div>
+          );
+        })}
+
+        {/* Add chip */}
+        {adding ? (
+          <div className={`${chipShape} border-dashed border-zinc-600 text-zinc-300`}>
+            <Plus className="w-3 h-3 text-zinc-500 flex-shrink-0" />
+            <input
+              ref={addInputRef}
+              autoFocus
+              value={addInput}
+              onChange={e => setAddInput(e.target.value)}
+              onKeyDown={e => {
+                if (e.key === 'Enter') addTodo();
+                if (e.key === 'Escape') { setAddInput(''); setAdding(false); }
+              }}
+              onBlur={() => {
+                if (addInput.trim()) addTodo();
+                else setAdding(false);
+              }}
+              placeholder="todo…"
+              className="bg-transparent focus:outline-none text-xs placeholder:text-zinc-600 max-w-[200px]"
+            />
+          </div>
+        ) : (
+          <button
+            onClick={() => { if (workspaceId != null) setAdding(true); }}
+            disabled={workspaceId == null}
+            className={`${chipHeight} rounded-full inline-flex items-center gap-1 px-3 py-1 text-xs border border-dashed border-zinc-700 text-zinc-500 hover:text-zinc-300 hover:border-zinc-500 transition-colors disabled:opacity-50 disabled:cursor-not-allowed whitespace-nowrap`}
+          >
+            <Plus className="w-3 h-3" />
+            {workspaceId == null ? 'Select a workspace' : 'add todo'}
+          </button>
+        )}
+
+        {/* Clear completed */}
+        {completedCount > 0 && (
+          <button
+            onClick={clearCompleted}
+            className="ml-auto text-[10px] text-zinc-500 hover:text-zinc-300 px-2 py-1 transition-colors whitespace-nowrap"
+          >
+            clear {completedCount} done
+          </button>
+        )}
+      </div>
+    </div>
+  );
+}

package/.next/standalone/src/hooks/use-claude-usage.ts

@@ -0,0 +1,66 @@
+'use client';
+
+import { useEffect, useRef, useState } from 'react';
+import { api } from '@/lib/api';
+import type { UsageResponse } from '@/types/claude';
+
+const POLL_INTERVAL_MS = 60_000;
+const TRANSIENT_TOLERANCE = 2; // consecutive bad polls before we clobber good data
+
+export function useClaudeUsage(enabled: boolean): UsageResponse | null {
+  const [response, setResponse] = useState<UsageResponse | null>(null);
+  const badPollsRef = useRef(0);
+
+  useEffect(() => {
+    if (!enabled) {
+      badPollsRef.current = 0;
+      return;
+    }
+
+    let cancelled = false;
+
+    async function load() {
+      try {
+        const res = await fetch(api('/api/claude/usage'));
+        if (!res.ok || cancelled) return;
+        const data: UsageResponse = await res.json();
+        if (cancelled) return;
+
+        const isTransient = data.status === 'upstream_error' || data.status === 'expired';
+        if (isTransient) {
+          badPollsRef.current += 1;
+          setResponse(prev => {
+            // If we already have a good response, keep it until the bad state persists.
+            if (prev?.status === 'ok' && badPollsRef.current < TRANSIENT_TOLERANCE) {
+              return prev;
+            }
+            return data;
+          });
+        } else {
+          badPollsRef.current = 0;
+          setResponse(data);
+        }
+      } catch {
+        // Network error — treat as transient.
+        if (cancelled) return;
+        badPollsRef.current += 1;
+        setResponse(prev => {
+          if (prev?.status === 'ok' && badPollsRef.current < TRANSIENT_TOLERANCE) {
+            return prev;
+          }
+          return { status: 'upstream_error' };
+        });
+      }
+    }
+
+    load();
+    const timer = setInterval(load, POLL_INTERVAL_MS);
+
+    return () => {
+      cancelled = true;
+      clearInterval(timer);
+    };
+  }, [enabled]);
+
+  return response;
+}

package/.next/standalone/src/lib/claude/credentials.ts

@@ -0,0 +1,36 @@
+import path from 'path';
+import os from 'os';
+import { readFile } from 'fs/promises';
+
+export interface ClaudeAiOAuthTokens {
+  accessToken: string;
+  refreshToken: string | null;
+  expiresAt: number | null; // epoch ms
+  scopes?: string[];
+}
+
+function getCredentialsPath(): string {
+  const home = process.env.CLAUDE_CONFIG_DIR || path.join(os.homedir(), '.claude');
+  return path.join(home, '.credentials.json');
+}
+
+/**
+ * Reads ~/.claude/.credentials.json and returns the claudeAiOauth block.
+ * Returns null on any read/parse failure or if the block is absent.
+ */
+export async function readClaudeAiOauthTokens(): Promise<ClaudeAiOAuthTokens | null> {
+  try {
+    const raw = await readFile(getCredentialsPath(), 'utf8');
+    const parsed = JSON.parse(raw) as { claudeAiOauth?: ClaudeAiOAuthTokens };
+    const tokens = parsed.claudeAiOauth;
+    if (!tokens?.accessToken) return null;
+    return tokens;
+  } catch {
+    return null;
+  }
+}
+
+export function isTokenExpired(tokens: ClaudeAiOAuthTokens, nowMs = Date.now()): boolean {
+  if (!tokens.expiresAt) return false; // no expiry set → treat as valid
+  return nowMs >= tokens.expiresAt;
+}

package/.next/standalone/src/lib/claude/usage.ts

@@ -0,0 +1,69 @@
+import { createHash } from 'crypto';
+import type { Utilization } from '@/types/claude';
+
+const ANTHROPIC_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
+const REQUEST_TIMEOUT_MS = 5_000;
+const CACHE_TTL_MS = 30_000;
+
+// UA + anthropic-beta header match Claude Code's. The endpoint requires the
+// beta header; see claude-code/src/utils/http.ts (getAuthHeaders) and
+// claude-code/src/constants/oauth.ts (OAUTH_BETA_HEADER).
+const USER_AGENT = 'claude-code/spaces';
+const OAUTH_BETA_HEADER = 'oauth-2025-04-20';
+
+interface CacheEntry {
+  fetchedAt: number;
+  data: Utilization;
+}
+
+const cache = new Map<string, CacheEntry>();
+
+function cacheKey(accessToken: string): string {
+  // Full SHA-256 of the token so two tokens sharing a prefix cannot collide.
+  return createHash('sha256').update(accessToken).digest('hex');
+}
+
+export type FetchOutcome =
+  | { ok: true; data: Utilization }
+  | { ok: false; reason: 'upstream_error' };
+
+export async function fetchUtilization(accessToken: string): Promise<FetchOutcome> {
+  const key = cacheKey(accessToken);
+  const cached = cache.get(key);
+  if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
+    return { ok: true, data: cached.data };
+  }
+
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+
+  try {
+    const res = await fetch(ANTHROPIC_USAGE_URL, {
+      method: 'GET',
+      headers: {
+        'Authorization': `Bearer ${accessToken}`,
+        'anthropic-beta': OAUTH_BETA_HEADER,
+        'Content-Type': 'application/json',
+        'User-Agent': USER_AGENT,
+      },
+      signal: controller.signal,
+    });
+
+    if (!res.ok) {
+      return { ok: false, reason: 'upstream_error' };
+    }
+
+    const data = (await res.json()) as Utilization;
+    cache.set(key, { fetchedAt: Date.now(), data });
+    return { ok: true, data };
+  } catch {
+    return { ok: false, reason: 'upstream_error' };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** Testing/hot-reload helper. */
+export function __clearUsageCache() {
+  cache.clear();
+}

package/.next/standalone/src/lib/config.ts

@@ -90,6 +90,7 @@ export interface SpacesConfig {
   installId: string;
   telemetryOptOut: boolean;
   devDirectories: string[];
+  todosEnabled: boolean;
   cortex?: CortexConfig;
   customModels?: CustomModelConfig[];
 }
@@ -103,6 +104,7 @@ export function readConfig(username: string): SpacesConfig {
         installId: raw.installId || crypto.randomUUID(),
         telemetryOptOut: !!raw.telemetryOptOut,
         devDirectories: Array.isArray(raw.devDirectories) ? raw.devDirectories.filter((d: unknown) => typeof d === 'string') : [],
+        todosEnabled: !!raw.todosEnabled,
         ...(raw.cortex && typeof raw.cortex === 'object' ? { cortex: raw.cortex } : {}),
         customModels: Array.isArray(raw.customModels) ? raw.customModels : [],
       };
@@ -117,6 +119,7 @@ export function readConfig(username: string): SpacesConfig {
     installId: crypto.randomUUID(),
     telemetryOptOut: false,
     devDirectories: [],
+    todosEnabled: false,
     customModels: [],
   };
   fs.writeFileSync(configPath, JSON.stringify(config, null, 2));

package/.next/standalone/src/lib/db/queries.ts

@@ -1,6 +1,6 @@
 import crypto from 'crypto';
 import { getDb } from './schema';
-import type { SessionWithMeta, Project, Workspace, Tag, SearchResult } from '@/types/claude';
+import type { SessionWithMeta, Project, Workspace, Tag, SearchResult, WorkspaceTodo } from '@/types/claude';
 
 // ─── Projects ───────────────────────────────────────────────
 
@@ -738,3 +738,105 @@ export function getDailyActivity(days = 30): { date: string; sessionCount: numbe
   `).all(`-${days} days`) as any[];
 }
 
+// ─── Workspace Todos ───────────────────────────────────────
+
+interface TodoRow {
+  id: number;
+  workspace_id: number;
+  text: string;
+  completed: number;
+  sort_order: number;
+  created: string;
+  completed_at: string | null;
+}
+
+function rowToTodo(r: TodoRow): WorkspaceTodo {
+  return {
+    id: r.id,
+    workspaceId: r.workspace_id,
+    text: r.text,
+    completed: !!r.completed,
+    sortOrder: r.sort_order,
+    created: r.created,
+    completedAt: r.completed_at,
+  };
+}
+
+export function getWorkspaceTodos(workspaceId: number): WorkspaceTodo[] {
+  const db = getDb();
+  const rows = db.prepare(`
+    SELECT id, workspace_id, text, completed, sort_order, created, completed_at
+    FROM workspace_todos
+    WHERE workspace_id = ?
+    ORDER BY completed ASC,
+             CASE WHEN completed = 0 THEN sort_order END ASC,
+             completed_at DESC
+  `).all(workspaceId) as TodoRow[];
+  return rows.map(rowToTodo);
+}
+
+export function addWorkspaceTodo(workspaceId: number, text: string): WorkspaceTodo {
+  const db = getDb();
+  const trimmed = text.trim();
+  if (!trimmed) throw new Error('todo text is required');
+
+  const maxRow = db.prepare(`
+    SELECT COALESCE(MAX(sort_order), -1) AS max_order
+    FROM workspace_todos
+    WHERE workspace_id = ? AND completed = 0
+  `).get(workspaceId) as { max_order: number };
+  const nextOrder = (maxRow?.max_order ?? -1) + 1;
+
+  const info = db.prepare(`
+    INSERT INTO workspace_todos (workspace_id, text, sort_order)
+    VALUES (?, ?, ?)
+  `).run(workspaceId, trimmed, nextOrder);
+
+  const row = db.prepare(`
+    SELECT id, workspace_id, text, completed, sort_order, created, completed_at
+    FROM workspace_todos WHERE id = ?
+  `).get(Number(info.lastInsertRowid)) as TodoRow;
+  return rowToTodo(row);
+}
+
+export function updateWorkspaceTodo(
+  workspaceId: number,
+  todoId: number,
+  data: { text?: string; completed?: boolean }
+): WorkspaceTodo | null {
+  const db = getDb();
+
+  if (data.text !== undefined) {
+    const trimmed = data.text.trim();
+    if (!trimmed) throw new Error('todo text cannot be empty');
+    db.prepare('UPDATE workspace_todos SET text = ? WHERE id = ? AND workspace_id = ?').run(trimmed, todoId, workspaceId);
+  }
+
+  if (data.completed !== undefined) {
+    if (data.completed) {
+      db.prepare(`
+        UPDATE workspace_todos
+        SET completed = 1, completed_at = datetime('now')
+        WHERE id = ? AND workspace_id = ?
+      `).run(todoId, workspaceId);
+    } else {
+      db.prepare(`
+        UPDATE workspace_todos
+        SET completed = 0, completed_at = NULL
+        WHERE id = ? AND workspace_id = ?
+      `).run(todoId, workspaceId);
+    }
+  }
+
+  const row = db.prepare(`
+    SELECT id, workspace_id, text, completed, sort_order, created, completed_at
+    FROM workspace_todos WHERE id = ? AND workspace_id = ?
+  `).get(todoId, workspaceId) as TodoRow | undefined;
+  return row ? rowToTodo(row) : null;
+}
+
+export function deleteWorkspaceTodo(workspaceId: number, todoId: number): void {
+  const db = getDb();
+  db.prepare('DELETE FROM workspace_todos WHERE id = ? AND workspace_id = ?').run(todoId, workspaceId);
+}
+

package/.next/standalone/src/lib/db/schema.ts

@@ -113,6 +113,19 @@ function initSchema(db: Database.Database) {
       enabled INTEGER DEFAULT 0,
       created TEXT DEFAULT (datetime('now'))
     );
+
+    CREATE TABLE IF NOT EXISTS workspace_todos (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      workspace_id INTEGER NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,
+      text TEXT NOT NULL,
+      completed INTEGER NOT NULL DEFAULT 0,
+      sort_order INTEGER NOT NULL DEFAULT 0,
+      created TEXT NOT NULL DEFAULT (datetime('now')),
+      completed_at TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_workspace_todos_workspace
+      ON workspace_todos(workspace_id);
   `);
 
   // Migrate: add workspace and popout columns to existing tables
@@ -204,3 +217,8 @@ export function closeDb() {
   }
   _dbs.clear();
 }
+
+// Test-only export. Do not use outside of tests.
+export const __testing = {
+  dbs: _dbs,
+};

package/.next/standalone/src/lib/spawn-env.ts

@@ -0,0 +1,32 @@
+// Build a minimal, safe environment for child processes that execute user-controlled
+// code (PTY shells, `claude` CLI, etc). The server's own env contains secrets —
+// SPACES_SESSION_SECRET, GH_PAT, NPM_TOKEN, ANTHROPIC_API_KEY — and any of those
+// leaking into a user PTY would let the user forge sessions or impersonate the
+// server against upstream services.
+
+const ALLOWED_ENV_VARS = new Set([
+  // Identity / shell basics
+  'HOME', 'USER', 'LOGNAME', 'SHELL', 'PATH', 'PWD', 'OLDPWD', 'HOSTNAME',
+  // Locale / time
+  'LANG', 'LC_ALL', 'LC_CTYPE', 'LC_MESSAGES', 'LC_COLLATE', 'LC_TIME',
+  'LC_NUMERIC', 'LC_MONETARY', 'TZ',
+  // XDG base dirs
+  'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_CACHE_HOME', 'XDG_RUNTIME_DIR',
+  'XDG_STATE_HOME',
+  // Terminal / display
+  'TERM', 'TERM_PROGRAM', 'TERM_PROGRAM_VERSION', 'COLORTERM', 'COLUMNS', 'LINES',
+  // Node / package manager tooling child tools may need
+  'NODE_ENV', 'NVM_DIR', 'NVM_BIN',
+]);
+
+export function buildSpawnEnv(extras: Record<string, string | undefined> = {}): NodeJS.ProcessEnv {
+  const env: Record<string, string> = {};
+  for (const key of ALLOWED_ENV_VARS) {
+    const v = process.env[key];
+    if (v !== undefined) env[key] = v;
+  }
+  for (const [k, v] of Object.entries(extras)) {
+    if (v !== undefined) env[k] = v;
+  }
+  return env as unknown as NodeJS.ProcessEnv;
+}

package/.next/standalone/src/lib/terminal/server.ts

@@ -3,6 +3,7 @@ import * as pty from 'node-pty';
 import { IncomingMessage } from 'http';
 import crypto from 'crypto';
 import { AGENT_TYPES } from '../agents';
+import { buildSpawnEnv } from '../spawn-env';
 
 interface TermSession {
   pty: pty.IPty;
@@ -83,9 +84,8 @@ export function startTerminalServer(port = 3458) {
     const shell = isWindows ? 'cmd.exe' : (process.env.SHELL || '/bin/bash');
     const agent = AGENT_TYPES[agentType];
 
-    // Strip CLAUDECODE to avoid nesting detection
-    const env = { ...process.env } as Record<string, string>;
-    delete env.CLAUDECODE;
+    // Build a minimal, non-secret-bearing env for the user-facing PTY.
+    const env = buildSpawnEnv() as Record<string, string>;
 
     if (customModelId) {
       const port = process.env.SPACES_PORT || '3457';