@rubytech/create-maxy-code 0.1.436 → 0.1.438

package/payload/platform/services/claude-session-manager/dist/http-server.js

@@ -30,6 +30,7 @@ import { mergeTarget, isMultiTarget, targetKinds } from './channel-targets.js';
 import { randomUUID, createHash } from 'node:crypto';
 import { execFile, execFileSync } from 'node:child_process';
 import { buildRcChildEnv, reapplyAdminLevers } from './rc-daemon.js';
+import { resolveSpawnUserId, formatMcpUserBindingLine } from './mcp-user-binding.js';
 import { runConnectorAuthLogin } from './connector-auth.js';
 import { isEffortLevel, isNewSessionEffortLevel, isPermissionMode, SONNET_MODEL } from '../../../lib/models/dist/index.js';
 import { spawnClaudeSession, stopSession, writeInterruptToPty, isLive, onPtyExit, livePtyCount, liveSessionIds, getPtyTrackerForTests, livePidForSession, classifyLiveness, priorExitedCountForSession, PERMISSION_MODES, openFdCount, registerRcSpawnPty, } from './pty-spawner.js';
@@ -44,7 +45,7 @@ import { createRcChildLog } from './rc-child-log.js';
 // Task 1214 — the admin voice-section reader, injected into the rc-spawn
 // --append-system-prompt for channel-bound admin sessions.
 import { extractVoiceSection } from './system-prompt.js';
-import { readJsonlSession } from './jsonl-enumerator.js';
+import { readJsonlSession, readJsonlSessionAtPath } from './jsonl-enumerator.js';
 import { computeMetering } from './session-metering.js';
 import { claudeStateRoot, projectSlugForCwd, jsonlPathForSessionId, sidecarPathForSessionId, permissionModeLogPathForSessionId, findExistingJsonlForSessionId, slugForExistingJsonl, jsonlPathForSlug, sidecarPathForSlug, detectRemoteControlSlug, classifyBindBlocker, classifyChildAuth, } from './jsonl-path.js';
 import { basename, dirname, join } from 'node:path';
@@ -1464,11 +1465,16 @@ export function buildHttpApp(deps) {
         // the /events SSE rowToPayload's 64 KB tail; otherwise the payload
         // shape matches what /events emits.
         let payload = toPayload(row);
-        const candidatePath = row.state === 'archived'
-            ? jsonlPathForSessionId(deps.spawnCwd, row.sessionId, { archived: true })
-            : jsonlPathForSessionId(deps.spawnCwd, row.sessionId);
-        if (existsSync(candidatePath)) {
-            const enriched = readJsonlSession(deps.spawnCwd, row.sessionId, deps.jsonlReadMaxBytes, deps.logger, deps.titleStores.forSessionCwd(row.cwd));
+        // Task 1565 — resolve the JSONL by the all-slug scan, the same primitive
+        // the transcript uses (findSessionProjectDir). A sub-account rc-spawned in
+        // a different cwd lands under a different slug; the old single-slug
+        // jsonlPathForSessionId(deps.spawnCwd, …) gate missed it and reported
+        // model:null turns:0 while the transcript rendered. The scan finds the file
+        // under any slug (top-level or archive), so footer enrichment can never
+        // disagree with the transcript about where the JSONL is.
+        const scanPath = findExistingJsonlForSessionId(deps.claudeConfigDir, row.sessionId);
+        if (scanPath) {
+            const enriched = readJsonlSessionAtPath(scanPath, row.sessionId, deps.jsonlReadMaxBytes, deps.logger, deps.titleStores.forSessionCwd(row.cwd));
             if (enriched) {
                 payload = {
                     ...payload,
@@ -1487,6 +1493,11 @@ export function buildHttpApp(deps) {
                 };
             }
         }
+        // Task 1565 — standing observability: which resolver ran (always the shared
+        // scan post-unification) and whether it found the file, per session. A
+        // session whose transcript renders but that logs jsonl=absent, or jsonl=found
+        // with model=null, is the divergence this task closes.
+        deps.logger(`[session-meta] op=enrich session=${row.sessionId.slice(0, 8)} resolver=scan jsonl=${scanPath ? 'found' : 'absent'} model=${payload.model ?? 'null'} effort=${payload.effortLevel ?? 'null'} turns=${payload.turnCount ?? 0}`);
         deps.logger(`meta sessionId=${row.sessionId.slice(0, 8)} fields=${Object.keys(payload).length} ms=${Date.now() - start}`);
         timed(deps.logger, 'GET', `/${id}/meta`, 200, Date.now() - start);
         return c.json(payload, 200);
@@ -2282,8 +2293,10 @@ export function buildHttpApp(deps) {
             : undefined;
         // Task 682 — per-session userId override. Server-resolved by the UI from the
         // authoritative users.json/account.json (never message content) and shape-
-        // validated here the same way as personId. Absent for owner self-phone and
-        // any unbound sender, where the boot-time deps.userId (owner) is used.
+        // validated here the same way as personId. Task 1573 — absent for owner
+        // self-phone and any unbound sender; USER_ID is then the authenticated
+        // adminUserId when present, else empty. The boot owner is no longer a
+        // fallback at this layer (see resolveSpawnUserId).
         const overrideUserId = typeof body.userId === 'string' && body.userId.length > 0 && body.userId.length <= 128
             ? body.userId
             : undefined;
@@ -2830,9 +2843,12 @@ export function buildHttpApp(deps) {
             }
             deps.logger(`[rc-spawn] op=voice-injected bytes=${voiceBytes}`);
         }
+        // Task 1573 — the authenticated admin identity, resolved from the body
+        // (validated PIN session) or the persisted sidecar. This, not the
+        // owner-defaulting overrideUserId, is the source of the child USER_ID.
+        const resolvedAdminUserId = adminUserId ?? priorSidecar?.adminUserId ?? null;
         if (effectiveWebchatChannel && adminBinding) {
             const resolvedName = authenticatedName ?? priorSidecar?.authenticatedName ?? null;
-            const resolvedAdminUserId = adminUserId ?? priorSidecar?.adminUserId ?? null;
             // `source` follows where the resolved name actually came from. When no
             // name resolves (resolved=0) it reports which signal marked the session
             // admin: the caller's body role, else the persisted sidecar.
@@ -2878,12 +2894,22 @@ export function buildHttpApp(deps) {
             acctIsHouse,
             inject: rcHouseAdminScope !== null,
         }));
+        // Task 1573 — stamp USER_ID from the authenticated admin identity, never
+        // the owner via `deps.userId`. An authenticated non-owner session whose body
+        // omitted `userId` used to fall back to the owner, so its admin MCP inherited
+        // the owner's USER_ID and rewrote the owner's credential row. Empty (no admin
+        // identity, unbound sender) is a documented-legal USER_ID. The reconciliation
+        // line compares the two independent identity signals (authenticated adminUserId
+        // vs server-resolved overrideUserId) and records the stamped USER_ID, so a
+        // future disagreement is greppable at spawn time.
+        const childUserId = resolveSpawnUserId({ resolvedAdminUserId, overrideUserId });
+        deps.logger(formatMcpUserBindingLine({ authenticatedAdmin: resolvedAdminUserId, resolvedOverride: overrideUserId, stampedUserId: childUserId }));
         // Task 606 — thread the validated per-session sessionId (fresh and resume
         // share the one var) so session-linked writes resolve SESSION_ID; logDir
         // so the child's MCP stderr-tee writes its readable per-server log.
         const env = buildRcChildEnv({
             accountId: effectiveAccountId,
-            userId: overrideUserId ?? deps.userId,
+            userId: childUserId,
             sessionId: sessionId ?? undefined,
             uiPort: process.env.MAXY_UI_INTERNAL_PORT ?? '',
             platformRoot: deps.platformRoot,