@saluzi/saluzi-edu 0.2.48 → 0.2.49

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@saluzi/saluzi-edu",
-  "version": "0.2.48",
+  "version": "0.2.49",
   "description": "Saluzi CLI - interactive AI coding assistant in the terminal",
   "license": "MIT",
   "type": "module",

package/packages/remote-control-server/src/services/session.ts

@@ -292,6 +292,24 @@ export function resolveOwnedWebSessionId(
 ): string | null {
   try {
     const db = getDb()
+
+    // Admin bypass — admin sees all sessions in list views (listSessions),
+    // so detail/delete/control resolution must also bypass the visibility
+    // check. Otherwise admin sees sessions they cannot open or delete
+    // (orphan ACP sessions, other users' sessions). canManageSession still
+    // gates destructive actions; control.ts gates on session status.
+    const userRow = db
+      .query('SELECT role FROM users WHERE id = $userId')
+      .get({ $userId: uuid }) as { role: string } | null
+    if (userRow?.role === 'admin') {
+      if (storeGetSession(sessionId)) return sessionId
+      const compatibleCodeSessionId = toCompatibleCodeSessionId(sessionId)
+      if (compatibleCodeSessionId && storeGetSession(compatibleCodeSessionId)) {
+        return compatibleCodeSessionId
+      }
+      return sessionId
+    }
+
     const visibility = isSessionVisibleToUser(sessionId, uuid, db)
     if (visibility) {
       if (!requireWrite || visibility === 'owner' || visibility === 'write') {