@jpcasabiancai/cayenne 0.3.0 → 0.3.1

package/dist/cli.js

@@ -324,8 +324,35 @@ var init_command = __esm({
         effort: Effort.optional(),
         model: z4.string().optional(),
         resumeProviderSessionId: z4.string().optional(),
+        // Duplicate a chat (D36): start from a fork of `resumeProviderSessionId` instead of appending
+        // to its transcript. Claude-only, no `worktree`. The runner additionally refuses a source that
+        // is not the caller's own Claude session on this runner, or a cwd other than the source's own directory.
+        forkSession: z4.boolean().optional(),
         initialPrompt: z4.string().optional(),
         title: z4.string().max(200).optional()
+      }).superRefine((p, ctx) => {
+        if (p.forkSession !== true) return;
+        if (p.resumeProviderSessionId === void 0) {
+          ctx.addIssue({
+            code: "custom",
+            message: "forkSession needs resumeProviderSessionId",
+            path: ["forkSession"]
+          });
+        }
+        if (p.worktree !== void 0) {
+          ctx.addIssue({
+            code: "custom",
+            message: "a forked session keeps its working directory",
+            path: ["worktree"]
+          });
+        }
+        if (p.provider === "codex") {
+          ctx.addIssue({
+            code: "custom",
+            message: "codex sessions cannot be forked",
+            path: ["provider"]
+          });
+        }
       }),
       "session.prompt": z4.object({
         text: z4.string().min(1).max(2e5),
@@ -634,6 +661,12 @@ var init_runner = __esm({
        * cannot grant a terminal. Optional so an older row still parses.
        */
       memberTerminalIds: z8.array(z8.uuid()).max(64).optional(),
+      /**
+       * Whether this runner honours `session.start { forkSession: true }` (D36, protocol §9). An older
+       * runner strips the field and then refuses the resume under R30, so a client sends
+       * `forkSession` only when this is true. Absent reads as false; optional so an older row parses.
+       */
+      sessionFork: z8.boolean().optional(),
       /**
        * The raw Ed25519 public key of the running process (32 bytes, unpadded base64url), which signs
        * the local server's `hello` (protocol §6.2). New on every start, republished by every capabilities refresh that changes the row;
@@ -650,6 +683,21 @@ var init_runner = __esm({
   }
 });
 
+// ../../packages/shared/src/protocol/session.ts
+import { z as z9 } from "zod";
+var SlashCommand, SessionCommandsListed;
+var init_session = __esm({
+  "../../packages/shared/src/protocol/session.ts"() {
+    "use strict";
+    SlashCommand = z9.object({
+      name: z9.string(),
+      description: z9.string(),
+      argumentHint: z9.string()
+    });
+    SessionCommandsListed = z9.object({ slashCommands: z9.array(SlashCommand) });
+  }
+});
+
 // ../../packages/shared/src/protocol/transport.ts
 var init_transport = __esm({
   "../../packages/shared/src/protocol/transport.ts"() {
@@ -668,6 +716,7 @@ var init_protocol = __esm({
     init_github();
     init_local();
     init_runner();
+    init_session();
     init_terminal();
     init_transport();
   }
@@ -817,7 +866,7 @@ import {
 } from "fs";
 import { homedir as homedir2 } from "os";
 import { dirname, isAbsolute as isAbsolute2, join as join3 } from "path";
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 function setProfileOverride(name) {
   profileOverride = name;
 }
@@ -892,24 +941,24 @@ var init_config = __esm({
     init_cloud();
     init_profile();
     MEMBER_TERMINALS_ERROR = "allowMemberTerminals must be false or a list of user ids";
-    RunnerConfig = z9.object({
-      supabaseUrl: z9.url(),
-      supabaseAnonKey: z9.string().min(1),
-      workspaceId: z9.uuid().optional(),
-      runnerId: z9.uuid().optional(),
-      name: z9.string().optional(),
-      roots: z9.array(z9.string()).default([]),
-      port: z9.number().int().default(LOCAL_PORT),
+    RunnerConfig = z10.object({
+      supabaseUrl: z10.url(),
+      supabaseAnonKey: z10.string().min(1),
+      workspaceId: z10.uuid().optional(),
+      runnerId: z10.uuid().optional(),
+      name: z10.string().optional(),
+      roots: z10.array(z10.string()).default([]),
+      port: z10.number().int().default(LOCAL_PORT),
       /** Extra page origins the local server admits, beside the built-in list (`buildOrigins`). */
-      localOrigins: z9.array(z9.string()).default([]),
-      allowBypassPermissions: z9.boolean().default(false),
+      localOrigins: z10.array(z10.string()).default([]),
+      allowBypassPermissions: z10.boolean().default(false),
       /** Absolute path to the `codex` binary, when it is not on the daemon's PATH. */
-      codexPath: z9.string().optional(),
+      codexPath: z10.string().optional(),
       /**
        * The Claude Code config directory this profile's sessions run on (D33), handed to them as
        * `CLAUDE_CONFIG_DIR`. Unset means the CLI's own default, `~/.claude`.
        */
-      claudeConfigDir: z9.string().optional(),
+      claudeConfigDir: z10.string().optional(),
       /**
        * Who besides the runner owner may hold a terminal here (D34, plan ruling 14): `false`, or the
        * user ids this machine's owner names. Machine-local like `allowBypassPermissions`: a workspace
@@ -917,15 +966,15 @@ var init_config = __esm({
        * `true` is refused — there is no "every member" switch. A listed member's shell runs as this
        * machine's OS user; the env allowlist is not a boundary.
        */
-      allowMemberTerminals: z9.union(
+      allowMemberTerminals: z10.union(
         [
-          z9.literal(false),
-          z9.array(z9.uuid({ error: MEMBER_TERMINALS_ERROR }), { error: MEMBER_TERMINALS_ERROR }).max(64, { error: MEMBER_TERMINALS_ERROR })
+          z10.literal(false),
+          z10.array(z10.uuid({ error: MEMBER_TERMINALS_ERROR }), { error: MEMBER_TERMINALS_ERROR }).max(64, { error: MEMBER_TERMINALS_ERROR })
         ],
         { error: MEMBER_TERMINALS_ERROR }
       ).default(false),
       /** Minutes a terminal nobody attends stays alive before the runner kills it (features §2). */
-      terminalIdleMinutes: z9.number().int().min(1).max(1440).default(10)
+      terminalIdleMinutes: z10.number().int().min(1).max(1440).default(10)
     });
     memberTerminalIdsOf = (cfg) => cfg.allowMemberTerminals === false ? [] : [...cfg.allowMemberTerminals];
     configPath = (dir) => join3(dir, "config.json");
@@ -1170,7 +1219,7 @@ import {
 } from "fs";
 import { uptime } from "os";
 import { join as join5 } from "path";
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function bootedAt(now = Date.now()) {
   return new Date(Math.round((now - uptime() * 1e3) / 1e3) * 1e3).toISOString();
 }
@@ -1313,13 +1362,13 @@ var LockRecord, BOOT_DRIFT_MS, ATTEMPTS, BACKOFF_MS, CLAIM_TTL_MS, errno, claimO
 var init_lock = __esm({
   "src/lock.ts"() {
     "use strict";
-    LockRecord = z10.object({
-      pid: z10.number().int().positive(),
-      profile: z10.string(),
-      startedAt: z10.string(),
+    LockRecord = z11.object({
+      pid: z11.number().int().positive(),
+      profile: z11.string(),
+      startedAt: z11.string(),
       /** `bootedAt()` when the lock was taken; a lock from another boot is stale whatever its pid. */
-      bootedAt: z10.string(),
-      version: z10.string()
+      bootedAt: z11.string(),
+      version: z11.string()
     });
     BOOT_DRIFT_MS = 1e4;
     ATTEMPTS = 8;
@@ -3962,11 +4011,12 @@ var init_refusals = __esm({
 });
 
 // src/sessions/handlers.ts
+import { ZodError } from "zod";
 function parsePayload(row, kind) {
   try {
     return parseCommand(row, kind);
   } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
+    const message = err instanceof ZodError ? err.issues.map((i) => i.message).join("; ") : err instanceof Error ? err.message : String(err);
     throw new Error(message.startsWith("VALIDATION:") ? message : `VALIDATION: ${message}`);
   }
 }
@@ -4354,7 +4404,7 @@ import { randomUUID as randomUUID3 } from "crypto";
 import { EventEmitter } from "events";
 import { query as sdkQuery } from "@anthropic-ai/claude-agent-sdk";
 var ClaudeSession;
-var init_session = __esm({
+var init_session2 = __esm({
   "src/claude/session.ts"() {
     "use strict";
     init_src();
@@ -4364,7 +4414,7 @@ var init_session = __esm({
       constructor(opts) {
         super();
         this.opts = opts;
-        this.providerSessionId = opts.resume ?? null;
+        this.providerSessionId = opts.forkSession ? null : opts.resume ?? null;
       }
       opts;
       provider = "claude";
@@ -4397,6 +4447,7 @@ var init_session = __esm({
             // Present only when asked for, so the default call stays the CLI's own behaviour.
             ...this.opts.strictMcpConfig === void 0 ? {} : { strictMcpConfig: this.opts.strictMcpConfig },
             ...this.opts.mcpServers === void 0 ? {} : { mcpServers: this.opts.mcpServers },
+            ...this.opts.forkSession ? { forkSession: true } : {},
             canUseTool,
             abortController: this.abort,
             stderr: (line) => {
@@ -4645,7 +4696,7 @@ function scrubSecrets(text) {
   return SECRET_PATTERNS.reduce((acc, [pattern, to]) => acc.replace(pattern, to), text);
 }
 var STDERR_TAIL_MAX, SIGKILL_AFTER_MS, SECRET_PATTERNS, APPROVAL_METHODS, CodexSession;
-var init_session2 = __esm({
+var init_session3 = __esm({
   "src/codex/session.ts"() {
     "use strict";
     init_src();
@@ -4991,8 +5042,8 @@ function createProviderSession(provider, opts) {
 var init_create = __esm({
   "src/providers/create.ts"() {
     "use strict";
-    init_session();
     init_session2();
+    init_session3();
   }
 });
 
@@ -5095,10 +5146,16 @@ var init_manager = __esm({
         }
         this.assertModeAllowed(p.permissionMode);
         const provider = p.provider ?? "claude";
+        if (p.forkSession && provider !== "claude") {
+          throw new Error("VALIDATION: codex sessions cannot be forked");
+        }
         this.assertProviderAllowed(provider, createdBy);
         const typed = resolveInsideRoots(p.cwd, this.deps.roots);
         this.assertNotRemoving(typed.real);
-        if (p.resumeProviderSessionId !== void 0) {
+        const forking = p.forkSession === true && p.resumeProviderSessionId !== void 0;
+        if (forking) {
+          await this.assertForkable(p.resumeProviderSessionId, createdBy, typed.real);
+        } else if (p.resumeProviderSessionId !== void 0) {
           await this.assertResumable(sessionId, p.resumeProviderSessionId);
         }
         let { real: cwd, root } = typed;
@@ -5106,7 +5163,7 @@ var init_manager = __esm({
         if (p.worktree) {
           cwd = await this.startWorktree(typed.real, typed.root, p.worktree, createdBy);
           inWorktree = true;
-        } else if (p.resumeProviderSessionId !== void 0) {
+        } else if (p.resumeProviderSessionId !== void 0 && !forking) {
           const recorded = await this.recordedWorktree(sessionId);
           if (recorded) ({ real: cwd, root } = recorded);
         }
@@ -5127,6 +5184,7 @@ var init_manager = __esm({
             permissionMode: p.permissionMode,
             model: p.model,
             resume: p.resumeProviderSessionId,
+            ...forking ? { forkSession: true } : {},
             ...provider === "codex" ? {
               codexPath: this.deps.codexPath,
               checkInput: this.codexGate(sessionId, cwd),
@@ -5137,7 +5195,9 @@ var init_manager = __esm({
           started();
         }
         if (inWorktree) await this.recordSessionWorktree(sessionId, cwd, root);
-        else if (p.resumeProviderSessionId === void 0) this.forgetSessionWorktree(sessionId);
+        else if (p.resumeProviderSessionId === void 0 || forking) {
+          this.forgetSessionWorktree(sessionId);
+        }
         live.status = "idle";
         await this.updateSession(sessionId, { status: "idle", model: p.model ?? null });
         await this.broadcast(sessionId, {
@@ -5584,6 +5644,37 @@ var init_manager = __esm({
           throw new Error("VALIDATION: resumeProviderSessionId does not belong to this session");
         }
       }
+      /**
+       * D36, amending R30 for `forkSession: true`: the resume id may be held by another session, but
+       * only one on this runner that `createdBy` owns — a member must not fork the runner owner's
+       * conversation, or anyone else's. A command with no creator owns nothing. Only a Claude row with
+       * a non-empty id can be a source. The new session must run where the source did, decided the way
+       * a resume of the source would be: the worktree this runner recorded for it, else its canonical
+       * `cwd`. Never `worktree_path`: the runner owner can rewrite that column on a member's chat, and
+       * it must not steer where the member's fork runs. A source path that no longer resolves inside
+       * the roots cannot be proved equal, so it is refused, not thrown through.
+       */
+      async assertForkable(providerSessionId, createdBy, cwd) {
+        if (providerSessionId === "") {
+          throw new Error("VALIDATION: forkSession source is not a session you own on this runner");
+        }
+        const { data, error } = await this.deps.db.from("chat_sessions").select("id, owner_id, cwd").eq("provider_session_id", providerSessionId).eq("runner_id", this.deps.runnerId).eq("provider", "claude").maybeSingle();
+        if (error) throw new Error(`PROVIDER_ERROR: could not read the session: ${error.message}`);
+        if (!data || createdBy === null || data.owner_id !== createdBy) {
+          throw new Error("VALIDATION: forkSession source is not a session you own on this runner");
+        }
+        let sourceCwd = (await this.recordedWorktree(data.id))?.real ?? null;
+        if (sourceCwd === null) {
+          try {
+            sourceCwd = resolveInsideRoots(data.cwd, this.deps.roots).real;
+          } catch {
+            sourceCwd = null;
+          }
+        }
+        if (sourceCwd !== cwd) {
+          throw new Error("VALIDATION: a forked session keeps its working directory");
+        }
+      }
       /**
        * Whether this runner may open a session on `provider` for `createdBy`.
        *
@@ -7517,7 +7608,9 @@ async function compose(cfg, lock, host, preflight) {
     claude: true,
     providers,
     // Who the runner's own config names (D34); every heartbeat refresh republishes it.
-    memberTerminalIds: [...memberTerminalIds]
+    memberTerminalIds: [...memberTerminalIds],
+    // D36: this build forks a Claude session on `session.start { forkSession: true }`.
+    sessionFork: true
   });
   const registered = capabilities();
   let loggedCodex = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jpcasabiancai/cayenne",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "files": [
     "dist/cli.js"
   ],
@@ -42,8 +42,8 @@
     "tsx": "4.23.13",
     "typescript": "~5.9.3",
     "vitest": "5.0.0",
-    "@cayenne/shared": "0.0.1",
-    "@cayenne/db": "0.0.1"
+    "@cayenne/db": "0.0.1",
+    "@cayenne/shared": "0.0.1"
   },
   "scripts": {
     "cli": "tsx src/cli.ts",