@quantiya/codevibe-claude-plugin 2.0.19 → 2.0.21

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "codevibe-claude",
-  "version": "2.0.19",
+  "version": "2.0.21",
   "description": "Sync Claude Code sessions with iOS mobile app via AWS backend. Control Claude Code from your phone with real-time bidirectional synchronization.",
   "author": {
     "name": "CodeVibe Team"

package/libexec/companion-launcher

@@ -130,6 +130,47 @@ if [ "${CODEVIBE_COMPANION_DIAGNOSTIC:-}" = "version" ]; then
     exit 0
 fi
 
+# Primary-handoff isolation contract (the codex launcher established the
+# direct-path `env -u` and the pane-command `unset`; this launcher adds the
+# fresh-server `env -u` and the server scrub).
+# `codevibe --agent claude` reaches this launcher with core's subprocess
+# markers exported — including QUORUM_REVIEWER_SUBPROCESS=1, the reviewer
+# gate that makes every hook in hooks/common.sh exit 0. That gate is right
+# for reviewer/implementor subprocesses and wrong for the user's primary
+# Companion session: if it reaches `claude`, no hook fires, no daemon
+# starts, and the session never syncs to mobile. A tmux server STARTED by
+# this launcher inherits the launcher's environment into its global
+# environment, so the marker would also reach every pane on that server
+# for the server's lifetime (an existing server does not copy it —
+# see `update-environment`). The launcher therefore removes QUORUM at the
+# exact primary handoff on every path below: `env -u` in front of the
+# direct `claude` runs and in front of `tmux new-session` (so a fresh
+# server never sees it), `unset` inside the pane command (so a server
+# that already carries it — e.g. one started by a pre-2.0.19 launcher —
+# still hands `claude` a clean environment), and a bounded scrub of the
+# server's global environment. Reviewers and implementors spawned later
+# add the marker again themselves and stay gated.
+_CV_QUORUM_MARKER="QUORUM_REVIEWER_SUBPROCESS"
+
+# Remove the reviewer gate from the global environment of the tmux server
+# the current client talks to, if that server carries it (started by a
+# 2.0.14–2.0.18 launcher, or by any tool that inherited the marker). The
+# pane command / `env -u` already protect the session being launched; this
+# keeps the marker from reaching panes the user opens later on that
+# server. Bounded: exactly one named variable, only when the server
+# reports it set; the prior value is logged before removal and a failed
+# removal is logged rather than hidden. Never aborts the launcher.
+cv_scrub_server_env() {
+    local prev
+    prev="$(tmux show-environment -g "$_CV_QUORUM_MARKER" 2>/dev/null)" || return 0
+    if tmux set-environment -g -u "$_CV_QUORUM_MARKER"; then
+        log "Removed $_CV_QUORUM_MARKER from the tmux server global environment (was: $prev)"
+    else
+        log "WARNING: failed to remove $_CV_QUORUM_MARKER from the tmux server global environment (was: $prev)"
+    fi
+    return 0
+}
+
 # Metadata commands are intentionally short-lived and do not create a
 # Companion session. Run them directly in the foreground so a TTY invocation
 # cannot race a detached tmux session that exits before attach. Arguments and
@@ -141,7 +182,7 @@ case "${1:-}" in
             echo "Install Claude Code from https://docs.anthropic.com/claude/docs/claude-code" >&2
             exit 127
         fi
-        exec claude "$@"
+        exec env -u "$_CV_QUORUM_MARKER" claude "$@"
         ;;
 esac
 
@@ -310,6 +351,7 @@ log "Arguments: $*"
 # (claude remains the foreground process for the duration).
 if [ -n "$TMUX" ]; then
     log "Already inside tmux, running claude directly"
+    cv_scrub_server_env
     _CV_AGENT_INVOKED="true"
     _CV_AGENT_STARTED_AT="$(date +%s)"
     # `|| _CV_RC=$?` is load-bearing: with `set -e`, a non-zero exit
@@ -319,7 +361,7 @@ if [ -n "$TMUX" ]; then
     # 0 leaves _CV_RC at its 0 default. printf's `|| true` keeps a
     # disk-full failure from clobbering diagnostics.
     _CV_RC=0
-    claude --append-system-prompt "$CODEVIBE_SYSTEM_PROMPT" "$@" || _CV_RC=$?
+    env -u "$_CV_QUORUM_MARKER" claude --append-system-prompt "$CODEVIBE_SYSTEM_PROMPT" "$@" || _CV_RC=$?
     printf '%s' "$_CV_RC" > "$_CV_CLAUDE_EXIT_FILE" 2>/dev/null || true
     exit "$_CV_RC"
 fi
@@ -330,7 +372,7 @@ if [ ! -t 0 ] || [ ! -t 1 ]; then
     _CV_AGENT_INVOKED="true"
     _CV_AGENT_STARTED_AT="$(date +%s)"
     _CV_RC=0
-    claude --append-system-prompt "$CODEVIBE_SYSTEM_PROMPT" "$@" || _CV_RC=$?
+    env -u "$_CV_QUORUM_MARKER" claude --append-system-prompt "$CODEVIBE_SYSTEM_PROMPT" "$@" || _CV_RC=$?
     printf '%s' "$_CV_RC" > "$_CV_CLAUDE_EXIT_FILE" 2>/dev/null || true
     exit "$_CV_RC"
 fi
@@ -358,9 +400,14 @@ done
 # 2. Runs claude
 # 3. Exits the tmux session when claude exits
 
-tmux new-session -d -s "$SESSION_NAME" -x "$(tput cols)" -y "$(tput lines)" \
-    "export CODEVIBE_TMUX_SESSION='$SESSION_NAME'; export ENVIRONMENT='$ENVIRONMENT'; $CLAUDE_CMD; printf '%s' \"\$?\" > '$_CV_CLAUDE_EXIT_FILE'; exit"
+env -u "$_CV_QUORUM_MARKER" tmux new-session -d -s "$SESSION_NAME" -x "$(tput cols)" -y "$(tput lines)" \
+    "unset $_CV_QUORUM_MARKER; export CODEVIBE_TMUX_SESSION='$SESSION_NAME'; export ENVIRONMENT='$ENVIRONMENT'; $CLAUDE_CMD; printf '%s' \"\$?\" > '$_CV_CLAUDE_EXIT_FILE'; exit"
 _CV_TMUX_STARTED="true"
+
+# A server that already carries the gate (pre-existing, contaminated by a
+# 2.0.14–2.0.18 launcher) hands this pane a clean environment via the
+# `unset` above; scrub its global environment for later panes too.
+cv_scrub_server_env
 _CV_AGENT_INVOKED="true"
 _CV_AGENT_STARTED_AT="$(date +%s)"