aicodeman 1.29.0 → 1.30.0

package/dist/session-auto-name.js

@@ -0,0 +1,339 @@
+/**
+ * @fileoverview Automatic session names from the first prompt.
+ *
+ * A new tab is born as `w3-myapp`, which says where it runs and nothing about
+ * what it is doing. Once the user submits a real prompt the tab can carry a
+ * title derived from it (`w3-myapp: fix the login redirect`), and this module
+ * holds the three pure pieces of that: a tracker that reconstructs the composer
+ * text from the keystrokes Codeman forwards, the title heuristic, and the
+ * prefix-preserving composition.
+ *
+ * Deliberately no LLM: the prompt already passes through the input boundary,
+ * so a local title is private, deterministic and identical for every CLI.
+ *
+ * ⚠️ The tracker sits on the raw keystroke stream, which carries far more than
+ * the prompt: cursor keys, mouse reports Codeman forwards to the CLI, bracketed
+ * pastes, Alt chords, the bare Esc that interrupts a turn. Every one of those
+ * once named a tab something wrong (a lone Esc ate the next prompt's first
+ * character; a wheel tick mid-word dropped the first half of the prompt), so
+ * the rules below are explicit per key. The model is a best-effort transcript:
+ * keys whose effect on the composer is knowable are mirrored, keys that leave
+ * the text alone are ignored, and keys that replace it with something the
+ * tracker cannot see (history recall) TAINT the draft so that Enter submits
+ * nothing rather than a fragment. A prompt that yields no title leaves the
+ * session eligible for the next one.
+ *
+ * Only user-originated input is fed here; the Session decides that. Ralph
+ * kick-starts, respawn `/clear`s, cron launches and approval answers all go
+ * through the same write paths and must never become a tab title.
+ *
+ * @module session-auto-name
+ */
+import { MAX_SESSION_NAME_LENGTH } from './config/terminal-limits.js';
+/**
+ * Longest composer draft kept, in code points. The title is cut from the HEAD
+ * of the prompt, so once the cap is reached further text is counted rather
+ * than kept (backspaces consume that count first). Keeping the tail instead
+ * would turn a long paste into a title made of its last line.
+ */
+const MAX_PROMPT_BUFFER_CODE_POINTS = 8_192;
+/** Longest escape sequence collected before the tracker gives up on it. */
+const MAX_ESCAPE_SEQUENCE_LENGTH = 64;
+/** Longest title, in code points, before it is cut with an ellipsis. */
+const MAX_AUTO_NAME_CODE_POINTS = 72;
+/**
+ * A sentence boundary is only honoured this far into the prompt, or "e.g. fix
+ * this now" becomes "e.g." and "Ok. Fix the bug" becomes "Ok". Short enough
+ * that a CJK sentence (a dozen code points is a full request) still cuts.
+ */
+const MIN_SENTENCE_CODE_POINTS = 8;
+/** A CSI sequence ends at its first byte in this range. */
+const CSI_FINAL_BYTE = /[\x40-\x7e]/;
+/** CSI parameter and intermediate bytes; anything else mid-sequence is malformed. */
+const CSI_BODY_BYTE = /[\x20-\x3f]/;
+/**
+ * `/clear`, `/model opus`, `/ralph-loop:ralph-loop`: a slash followed by a
+ * command word and then whitespace or the end. A path (`/home/me/notes.txt
+ * what is this`) has a second slash where the whitespace should be and so is a
+ * prompt.
+ */
+const SLASH_COMMAND_PATTERN = /^\/[a-z][a-z0-9_:-]*(?:\s|$)/i;
+// eslint-disable-next-line no-control-regex
+const CSI_SEQUENCE_PATTERN = /\x1b\[[\x30-\x3f]*[\x20-\x2f]*[\x40-\x7e]/g;
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHAR_PATTERN = /[\x00-\x1f\x7f]/g;
+const SENTENCE_TERMINATORS = new Set(['.', '!', '?', '。', '！', '？']);
+/**
+ * Reconstructs the composer draft from forwarded keystrokes and reports each
+ * submitted prompt. Input arrives in arbitrary chunks (one keystroke, a paste,
+ * an agent's whole prompt plus Enter), so all state lives across calls.
+ */
+export class SubmittedPromptTracker {
+    buffer = '';
+    bufferCodePoints = 0;
+    /** Code points typed past the cap; backspaces eat these before real text. */
+    overflow = 0;
+    /** Escape sequence in progress; a lone ESC means "just saw ESC". */
+    sequence = '';
+    inPaste = false;
+    /** The composer holds text the tracker never saw (history recall); Enter submits nothing. */
+    tainted = false;
+    feed(data) {
+        const submitted = [];
+        for (const ch of data) {
+            if (this.sequence) {
+                this.continueSequence(ch);
+                continue;
+            }
+            if (ch === '\x1b') {
+                this.sequence = ch;
+                continue;
+            }
+            this.handleKey(ch, submitted);
+        }
+        // A chunk that ENDS in a lone ESC is the Esc key, not the start of a
+        // sequence: xterm hands each key's whole sequence to one write, and the
+        // programmatic senders (an approval deny sends exactly `\x1b`) send it
+        // alone. Leaving it pending would make the next prompt's first character
+        // look like an Alt chord and swallow it.
+        if (this.sequence === '\x1b')
+            this.sequence = '';
+        return submitted;
+    }
+    continueSequence(ch) {
+        if (this.sequence === '\x1b') {
+            if (ch === '[' || ch === 'O' || ch === ']' || ch === 'P') {
+                this.sequence += ch;
+                return;
+            }
+            this.sequence = ch === '\x1b' ? ch : '';
+            // Alt+Enter inserts a newline in the composer; every other Alt chord
+            // (word movement, Alt+B/F) leaves the text alone.
+            if (ch === '\r' || ch === '\n')
+                this.appendSeparator();
+            return;
+        }
+        this.sequence += ch;
+        if (this.sequence.length > MAX_ESCAPE_SEQUENCE_LENGTH) {
+            // Not a sequence any terminal sends; what follows is unknowable, so the
+            // draft is tainted rather than titled after the tail of the garbage.
+            this.sequence = '';
+            this.tainted = true;
+            return;
+        }
+        const kind = this.sequence[1];
+        if (kind === '[') {
+            if (CSI_FINAL_BYTE.test(ch)) {
+                const sequence = this.sequence;
+                this.sequence = '';
+                this.handleCsi(sequence);
+            }
+            else if (!CSI_BODY_BYTE.test(ch)) {
+                // Malformed (an ESC [ followed by text): drop the sequence and let the
+                // character count as typed rather than swallowing up to 64 of them.
+                this.sequence = '';
+                this.handleKeyOrEscape(ch);
+            }
+            return;
+        }
+        if (kind === 'O') {
+            // SS3 carries exactly one byte (application-mode cursor keys).
+            this.sequence = '';
+            if (ch === 'A' || ch === 'B')
+                this.tainted = true;
+            return;
+        }
+        // OSC / DCS run to BEL or ST (ESC \).
+        if (ch === '\x07' || this.sequence.endsWith('\x1b\\'))
+            this.sequence = '';
+    }
+    handleKeyOrEscape(ch) {
+        if (ch === '\x1b') {
+            this.sequence = ch;
+            return;
+        }
+        // Only reached mid-chunk from a malformed sequence, where no submission can
+        // be reported; a stray Enter there resets the draft like any other Enter.
+        this.handleKey(ch, []);
+    }
+    handleCsi(sequence) {
+        if (sequence === '\x1b[200~') {
+            this.inPaste = true;
+            return;
+        }
+        if (sequence === '\x1b[201~') {
+            this.inPaste = false;
+            return;
+        }
+        const final = sequence[sequence.length - 1];
+        // Up/Down (with or without modifiers) recall history: the composer now
+        // holds a line this tracker never saw. Everything else leaves the text as
+        // it is: Left/Right/Home/End, Delete (`3~`), Shift+Tab (`Z`), SGR mouse
+        // reports (`<…M`/`m`, forwarded on every wheel tick), focus reports.
+        if (final === 'A' || final === 'B')
+            this.tainted = true;
+    }
+    handleKey(ch, submitted) {
+        const codePoint = ch.codePointAt(0) ?? 0;
+        if (this.inPaste) {
+            // Pasted newlines are newlines IN the composer, never Enter; they and
+            // the other controls (tabs) become a single separator.
+            if (codePoint < 0x20 || codePoint === 0x7f)
+                this.appendSeparator();
+            else
+                this.append(ch);
+            return;
+        }
+        switch (ch) {
+            case '\r': {
+                const prompt = this.tainted ? '' : this.buffer.trim();
+                if (prompt)
+                    submitted.push(prompt);
+                this.reset();
+                return;
+            }
+            case '\n':
+                // Ctrl+J, and the line feed the send-key route injects for Shift+Enter:
+                // a newline inside the composer, so the lines join with a separator.
+                this.appendSeparator();
+                return;
+            case '\x7f':
+            case '\x08':
+                this.backspace();
+                return;
+            case '\x17': // Ctrl+W: word rubout
+                this.killWord();
+                return;
+            case '\x15': // Ctrl+U: line discard
+            case '\x03': // Ctrl+C: clears the composer (or, empty, arms an exit)
+                this.reset();
+                return;
+            case '\x10': // Ctrl+P
+            case '\x0e': // Ctrl+N
+            case '\x12': // Ctrl+R: history search
+            case '\x1f': // Ctrl+_: undo
+                this.tainted = true;
+                return;
+            default:
+                // Tab (the @-mention completer, which only ever extends the token),
+                // cursor chords (Ctrl+A/E/B/F) and the rest of C0 leave the text alone.
+                if (codePoint < 0x20 || codePoint === 0x7f)
+                    return;
+                this.append(ch);
+        }
+    }
+    /** One space between lines, never a run of them, and none at the start. */
+    appendSeparator() {
+        if (this.overflow > 0)
+            return;
+        if (!this.buffer || /\s$/.test(this.buffer))
+            return;
+        this.append(' ');
+    }
+    append(ch) {
+        if (this.bufferCodePoints >= MAX_PROMPT_BUFFER_CODE_POINTS) {
+            this.overflow += 1;
+            return;
+        }
+        this.buffer += ch;
+        this.bufferCodePoints += 1;
+    }
+    backspace() {
+        if (this.overflow > 0) {
+            this.overflow -= 1;
+            return;
+        }
+        if (!this.buffer)
+            return;
+        const last = this.buffer.charCodeAt(this.buffer.length - 1);
+        const units = last >= 0xdc00 && last <= 0xdfff && this.buffer.length >= 2 ? 2 : 1;
+        this.buffer = this.buffer.slice(0, -units);
+        this.bufferCodePoints -= 1;
+    }
+    killWord() {
+        this.overflow = 0;
+        this.buffer = this.buffer.replace(/\S+\s*$/u, '');
+        this.bufferCodePoints = Array.from(this.buffer).length;
+    }
+    reset() {
+        this.buffer = '';
+        this.bufferCodePoints = 0;
+        this.overflow = 0;
+        this.tainted = false;
+    }
+}
+/**
+ * Turns a submitted prompt into a title, or null when the prompt is not a task:
+ * empty, a slash command (`/clear`, `/model`), or a `!` shell escape.
+ */
+export function deriveAutoSessionName(prompt) {
+    const text = prompt.replace(CSI_SEQUENCE_PATTERN, '').replace(CONTROL_CHAR_PATTERN, ' ').replace(/\s+/g, ' ').trim();
+    if (!text || text.startsWith('!') || SLASH_COMMAND_PATTERN.test(text))
+        return null;
+    return truncateCodePoints(firstSentence(text), MAX_AUTO_NAME_CODE_POINTS);
+}
+/**
+ * The first sentence, provided it is long enough to be one; a trailing full
+ * stop is dropped because a tab title is not a sentence.
+ */
+function firstSentence(text) {
+    const codePoints = Array.from(text);
+    for (let i = MIN_SENTENCE_CODE_POINTS - 1; i < codePoints.length; i++) {
+        if (!SENTENCE_TERMINATORS.has(codePoints[i]))
+            continue;
+        const next = codePoints[i + 1];
+        if (next !== undefined && !/\s/.test(next))
+            continue;
+        return codePoints
+            .slice(0, i + 1)
+            .join('')
+            .replace(/[.。]+$/, '');
+    }
+    return text.replace(/[.。]+$/, '');
+}
+/** Cuts to `max` code points with an ellipsis, on a word boundary when one is near the end. */
+function truncateCodePoints(text, max) {
+    const codePoints = Array.from(text);
+    if (codePoints.length <= max)
+        return text;
+    let cut = codePoints.slice(0, max - 1).join('');
+    const lastSpace = cut.lastIndexOf(' ');
+    if (lastSpace >= Math.floor(cut.length / 2))
+        cut = cut.slice(0, lastSpace);
+    return `${cut.trimEnd()}…`;
+}
+/**
+ * The name a placeholder becomes: `<prefix>: <title>`, so the tab keeps its
+ * case identity and its `w<n>` counter (the tab strip already renders that
+ * form as the title alone, prefix in the tooltip, and the next-session counter
+ * still matches it). A session with no name at all just takes the title. The
+ * result honours `maxLength` in UTF-16 units, the unit the rename route caps.
+ */
+export function composeAutoSessionName(currentName, title, maxLength = MAX_SESSION_NAME_LENGTH) {
+    const prefix = currentName.trim();
+    if (!prefix)
+        return fitTitle(title, maxLength);
+    const room = maxLength - prefix.length - 2;
+    if (room <= 0)
+        return prefix;
+    return `${prefix}: ${fitTitle(title, room)}`;
+}
+/** Fits a title into `maxUnits` UTF-16 units, ellipsis included. */
+function fitTitle(title, maxUnits) {
+    if (title.length <= maxUnits)
+        return title;
+    let units = 0;
+    let keep = 0;
+    for (const codePoint of Array.from(title)) {
+        if (units + codePoint.length > maxUnits - 1)
+            break;
+        units += codePoint.length;
+        keep += 1;
+    }
+    return truncateCodePoints(title, keep + 1);
+}
+/** Codeman's own `w<n>-<case>` / `s<n>-<case>` placeholders, the only names auto-naming replaces. */
+export function isGeneratedSessionName(name) {
+    return /^[ws]\d+-[a-zA-Z0-9_-]+$/.test(name);
+}
+//# sourceMappingURL=session-auto-name.js.map

package/dist/session-auto-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-auto-name.js","sourceRoot":"","sources":["../src/session-auto-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,6BAA6B,GAAG,KAAK,CAAC;AAE5C,2EAA2E;AAC3E,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAEtC,wEAAwE;AACxE,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC;;;;GAIG;AACH,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC,2DAA2D;AAC3D,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,qFAAqF;AACrF,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAE9D,4CAA4C;AAC5C,MAAM,oBAAoB,GAAG,4CAA4C,CAAC;AAC1E,4CAA4C;AAC5C,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAChD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAErE;;;;GAIG;AACH,MAAM,OAAO,sBAAsB;IACzB,MAAM,GAAG,EAAE,CAAC;IACZ,gBAAgB,GAAG,CAAC,CAAC;IAC7B,6EAA6E;IACrE,QAAQ,GAAG,CAAC,CAAC;IACrB,oEAAoE;IAC5D,QAAQ,GAAG,EAAE,CAAC;IACd,OAAO,GAAG,KAAK,CAAC;IACxB,6FAA6F;IACrF,OAAO,GAAG,KAAK,CAAC;IAExB,IAAI,CAAC,IAAY;QACf,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,KAAK,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;gBAClB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QAChC,CAAC;QACD,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,yCAAyC;QACzC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,gBAAgB,CAAC,EAAU;QACjC,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC7B,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACzD,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;gBACpB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,EAAE,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,qEAAqE;YACrE,kDAAkD;YAClD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;gBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;YACvD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACpB,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;YACtD,wEAAwE;YACxE,qEAAqE;YACrE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;gBAC/B,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACnB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC3B,CAAC;iBAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBACnC,uEAAuE;gBACvE,oEAAoE;gBACpE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;gBACnB,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjB,+DAA+D;YAC/D,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG;gBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YAClD,OAAO;QACT,CAAC;QACD,sCAAsC;QACtC,IAAI,EAAE,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;IAC5E,CAAC;IAEO,iBAAiB,CAAC,EAAU;QAClC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QACD,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACzB,CAAC;IAEO,SAAS,CAAC,QAAgB;QAChC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5C,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,qEAAqE;QACrE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG;YAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IAC1D,CAAC;IAEO,SAAS,CAAC,EAAU,EAAE,SAAmB;QAC/C,MAAM,SAAS,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,sEAAsE;YACtE,uDAAuD;YACvD,IAAI,SAAS,GAAG,IAAI,IAAI,SAAS,KAAK,IAAI;gBAAE,IAAI,CAAC,eAAe,EAAE,CAAC;;gBAC9D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,QAAQ,EAAE,EAAE,CAAC;YACX,KAAK,IAAI,CAAC,CAAC,CAAC;gBACV,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,MAAM;oBAAE,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,KAAK,IAAI;gBACP,wEAAwE;gBACxE,qEAAqE;gBACrE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACvB,OAAO;YACT,KAAK,MAAM,CAAC;YACZ,KAAK,MAAM;gBACT,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjB,OAAO;YACT,KAAK,MAAM,EAAE,sBAAsB;gBACjC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAChB,OAAO;YACT,KAAK,MAAM,CAAC,CAAC,uBAAuB;YACpC,KAAK,MAAM,EAAE,wDAAwD;gBACnE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACb,OAAO;YACT,KAAK,MAAM,CAAC,CAAC,SAAS;YACtB,KAAK,MAAM,CAAC,CAAC,SAAS;YACtB,KAAK,MAAM,CAAC,CAAC,yBAAyB;YACtC,KAAK,MAAM,EAAE,eAAe;gBAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBACpB,OAAO;YACT;gBACE,oEAAoE;gBACpE,wEAAwE;gBACxE,IAAI,SAAS,GAAG,IAAI,IAAI,SAAS,KAAK,IAAI;oBAAE,OAAO;gBACnD,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,2EAA2E;IACnE,eAAe;QACrB,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC;YAAE,OAAO;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO;QACpD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnB,CAAC;IAEO,MAAM,CAAC,EAAU;QACvB,IAAI,IAAI,CAAC,gBAAgB,IAAI,6BAA6B,EAAE,CAAC;YAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QAClB,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;IAC7B,CAAC;IAEO,QAAQ;QACd,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IACzD,CAAC;IAEO,KAAK;QACX,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrH,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,OAAO,kBAAkB,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,yBAAyB,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,IAAI,CAAC,GAAG,wBAAwB,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrD,OAAO,UAAU;aACd,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;aACf,IAAI,CAAC,EAAE,CAAC;aACR,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,+FAA+F;AAC/F,SAAS,kBAAkB,CAAC,IAAY,EAAE,GAAW;IACnD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC3E,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,KAAa,EACb,SAAS,GAAG,uBAAuB;IAEnC,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3C,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAC7B,OAAO,GAAG,MAAM,KAAK,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,KAAa,EAAE,QAAgB;IAC/C,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,GAAG,SAAS,CAAC,MAAM,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM;QACnD,KAAK,IAAI,SAAS,CAAC,MAAM,CAAC;QAC1B,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,kBAAkB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,qGAAqG;AACrG,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC/C,CAAC"}

package/dist/session-env-clamp.d.ts

@@ -0,0 +1,80 @@
+/**
+ * @fileoverview The env-var half of the multi-user privilege clamp.
+ *
+ * A session's `envOverrides` can hand back privilege that the per-CLI config
+ * clamp removed, so a non-granted owner's overrides get the privileged keys
+ * stripped before the session is built. The create and resume routes are what
+ * this bites on: they clamp what a request asked for.
+ *
+ * The reboot-restore route calls it as defence in depth, and today it can strip
+ * nothing. `Session.getEnvOverridesForPersist()` keeps only `CLAUDE_CODE_*` and
+ * `CLAUDE_CONFIG_DIR` out of a session's overrides, claude's `privilegedEnvKeys`
+ * are the five `ANTHROPIC_*` names, and that pass admits claude alone — so a
+ * persisted record cannot carry a clamped key. The call is there for the day the
+ * persisted set widens. The grant re-resolution that does bite on that path is
+ * `resolveClaudeModeForUsername`, which recomputes the permission mode.
+ *
+ * This lives outside `web/routes` on purpose. The question it answers is about
+ * session privilege rather than about HTTP, and `cron/cron-service.ts` sets the
+ * precedent by importing `canUsernameRunPrivilegedCommands` from `user-store.ts`
+ * directly and re-resolving the owner's grant when a job fires. Every caller here
+ * re-resolves the grant at the moment it builds a session, for the same reason.
+ *
+ * @dependencies user-store (canUsernameRunPrivilegedCommands), config/cli-registry
+ * @consumedby web/routes/session-routes, web/routes/reboot-restore-routes
+ *
+ * @module session-env-clamp
+ */
+/**
+ * Env-var keys a non-granted owner must not be able to set, because each one
+ * hands back privilege `clampExternalCliBypassForOwner()` just removed, or redirects a
+ * credential-resolution endpoint.
+ *
+ * The DeepSeek three are reachable because `DSH_*` and `DEEPSEEK_*` are
+ * allowlisted `envOverrides` prefixes (schemas.ts) — which they have to be, since
+ * that is also how a user configures the harness's non-privileged knobs.
+ *
+ * - `DSH_PERMISSION_MODE` IS the harness's permission switch. Every other CLI's
+ *   bypass is a command-line FLAG, reachable only through the per-CLI config the
+ *   clamp already owns; this one is an env var, so the config clamp alone is
+ *   half a gate.
+ * - `DSH_HOME` points the launcher at a profile tree, and a profile's plugin code
+ *   executes at BOOT, before any approval row can apply. A user who can write a
+ *   workspace can put a profile in it, so this is the wider of the two.
+ * - `DEEPSEEK_BASE_URL` aims the provider endpoint, and `_configureCliEnv()`
+ *   forwards the SERVER's own `DEEPSEEK_API_KEY` into every dsh pane before
+ *   `applyEnvOverrides()` runs — so a non-granted owner who could set the base
+ *   URL would have the operator's API key sent as a bearer credential to a host
+ *   of their choosing. (`DEEPSEEK_API_KEY` itself stays overridable: supplying
+ *   your OWN key removes privilege rather than granting it.)
+ * - `OMP_AUTH_BROKER_URL`/`OMP_AUTH_BROKER_TOKEN` are where omp resolves
+ *   credentials from — the same shape as `DEEPSEEK_BASE_URL` above, reachable
+ *   because `OMP_*` is an allowlisted prefix. Unlike DeepSeek, Codeman does not
+ *   forward any operator-held key into an omp pane today (omp's provider
+ *   credentials live in `~/.omp` config files, not env vars), so there is no
+ *   known concrete exfiltration path yet — clamped defensively anyway, since a
+ *   non-granted owner redirecting where a shared multi-tenant deployment
+ *   resolves auth from is not something to allow silently (found in
+ *   Ark0N/Codeman#353 review; omp's own knobs are otherwise mostly `PI_*`,
+ *   already allowlisted for pi and not addressed here — see resolveOmpHome()).
+ */
+export declare function ownerClampedEnvKeys(): string[];
+/**
+ * Env-var half of the multi-user bypass clamp.
+ *
+ * `clampExternalCliBypassForOwner()` in `web/routes/session-routes.ts` clamps the
+ * per-CLI CONFIG, and for every CLI
+ * but DeepSeek that is the whole story. Here it is not: `applyEnvOverrides()` runs
+ * AFTER `_configureCliEnv()` in tmux-manager, so an override sent on the SAME
+ * request lands last and wins, and a non-granted owner could restore
+ * `danger-full-access` on the very request the config clamp downgraded.
+ *
+ * Keys are DROPPED rather than rewritten: dropping falls through to what
+ * `_configureCliEnv()` exports, which is the clamped config and the server's own
+ * `DSH_HOME`, i.e. exactly the intended state. No-op in single-user mode and for a
+ * granted owner, like every other clamp here
+ * (`canUsernameRunPrivilegedCommands()` returns true when `!isMultiUserMode()`),
+ * and it returns the caller's own object untouched when there is nothing to strip.
+ */
+export declare function clampEnvOverridesForOwner(owner: string | undefined, envOverrides: Record<string, string> | undefined): Promise<Record<string, string> | undefined>;
+//# sourceMappingURL=session-env-clamp.d.ts.map

package/dist/session-env-clamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-env-clamp.d.ts","sourceRoot":"","sources":["../src/session-env-clamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAQ7C"}

package/dist/session-env-clamp.js

@@ -0,0 +1,96 @@
+/**
+ * @fileoverview The env-var half of the multi-user privilege clamp.
+ *
+ * A session's `envOverrides` can hand back privilege that the per-CLI config
+ * clamp removed, so a non-granted owner's overrides get the privileged keys
+ * stripped before the session is built. The create and resume routes are what
+ * this bites on: they clamp what a request asked for.
+ *
+ * The reboot-restore route calls it as defence in depth, and today it can strip
+ * nothing. `Session.getEnvOverridesForPersist()` keeps only `CLAUDE_CODE_*` and
+ * `CLAUDE_CONFIG_DIR` out of a session's overrides, claude's `privilegedEnvKeys`
+ * are the five `ANTHROPIC_*` names, and that pass admits claude alone — so a
+ * persisted record cannot carry a clamped key. The call is there for the day the
+ * persisted set widens. The grant re-resolution that does bite on that path is
+ * `resolveClaudeModeForUsername`, which recomputes the permission mode.
+ *
+ * This lives outside `web/routes` on purpose. The question it answers is about
+ * session privilege rather than about HTTP, and `cron/cron-service.ts` sets the
+ * precedent by importing `canUsernameRunPrivilegedCommands` from `user-store.ts`
+ * directly and re-resolving the owner's grant when a job fires. Every caller here
+ * re-resolves the grant at the moment it builds a session, for the same reason.
+ *
+ * @dependencies user-store (canUsernameRunPrivilegedCommands), config/cli-registry
+ * @consumedby web/routes/session-routes, web/routes/reboot-restore-routes
+ *
+ * @module session-env-clamp
+ */
+import { canUsernameRunPrivilegedCommands } from './user-store.js';
+import { enabledClis } from './config/cli-registry/registry.js';
+/**
+ * Env-var keys a non-granted owner must not be able to set, because each one
+ * hands back privilege `clampExternalCliBypassForOwner()` just removed, or redirects a
+ * credential-resolution endpoint.
+ *
+ * The DeepSeek three are reachable because `DSH_*` and `DEEPSEEK_*` are
+ * allowlisted `envOverrides` prefixes (schemas.ts) — which they have to be, since
+ * that is also how a user configures the harness's non-privileged knobs.
+ *
+ * - `DSH_PERMISSION_MODE` IS the harness's permission switch. Every other CLI's
+ *   bypass is a command-line FLAG, reachable only through the per-CLI config the
+ *   clamp already owns; this one is an env var, so the config clamp alone is
+ *   half a gate.
+ * - `DSH_HOME` points the launcher at a profile tree, and a profile's plugin code
+ *   executes at BOOT, before any approval row can apply. A user who can write a
+ *   workspace can put a profile in it, so this is the wider of the two.
+ * - `DEEPSEEK_BASE_URL` aims the provider endpoint, and `_configureCliEnv()`
+ *   forwards the SERVER's own `DEEPSEEK_API_KEY` into every dsh pane before
+ *   `applyEnvOverrides()` runs — so a non-granted owner who could set the base
+ *   URL would have the operator's API key sent as a bearer credential to a host
+ *   of their choosing. (`DEEPSEEK_API_KEY` itself stays overridable: supplying
+ *   your OWN key removes privilege rather than granting it.)
+ * - `OMP_AUTH_BROKER_URL`/`OMP_AUTH_BROKER_TOKEN` are where omp resolves
+ *   credentials from — the same shape as `DEEPSEEK_BASE_URL` above, reachable
+ *   because `OMP_*` is an allowlisted prefix. Unlike DeepSeek, Codeman does not
+ *   forward any operator-held key into an omp pane today (omp's provider
+ *   credentials live in `~/.omp` config files, not env vars), so there is no
+ *   known concrete exfiltration path yet — clamped defensively anyway, since a
+ *   non-granted owner redirecting where a shared multi-tenant deployment
+ *   resolves auth from is not something to allow silently (found in
+ *   Ark0N/Codeman#353 review; omp's own knobs are otherwise mostly `PI_*`,
+ *   already allowlisted for pi and not addressed here — see resolveOmpHome()).
+ */
+export function ownerClampedEnvKeys() {
+    return enabledClis().flatMap((entry) => entry.capabilities.privilegedEnvKeys);
+}
+/**
+ * Env-var half of the multi-user bypass clamp.
+ *
+ * `clampExternalCliBypassForOwner()` in `web/routes/session-routes.ts` clamps the
+ * per-CLI CONFIG, and for every CLI
+ * but DeepSeek that is the whole story. Here it is not: `applyEnvOverrides()` runs
+ * AFTER `_configureCliEnv()` in tmux-manager, so an override sent on the SAME
+ * request lands last and wins, and a non-granted owner could restore
+ * `danger-full-access` on the very request the config clamp downgraded.
+ *
+ * Keys are DROPPED rather than rewritten: dropping falls through to what
+ * `_configureCliEnv()` exports, which is the clamped config and the server's own
+ * `DSH_HOME`, i.e. exactly the intended state. No-op in single-user mode and for a
+ * granted owner, like every other clamp here
+ * (`canUsernameRunPrivilegedCommands()` returns true when `!isMultiUserMode()`),
+ * and it returns the caller's own object untouched when there is nothing to strip.
+ */
+export async function clampEnvOverridesForOwner(owner, envOverrides) {
+    if (!envOverrides)
+        return envOverrides;
+    const keys = ownerClampedEnvKeys();
+    if (!keys.some((key) => key in envOverrides))
+        return envOverrides;
+    if (await canUsernameRunPrivilegedCommands(owner))
+        return envOverrides;
+    const clamped = { ...envOverrides };
+    for (const key of keys)
+        delete clamped[key];
+    return clamped;
+}
+//# sourceMappingURL=session-env-clamp.js.map

package/dist/session-env-clamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-env-clamp.js","sourceRoot":"","sources":["../src/session-env-clamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB,EACzB,YAAgD;IAEhD,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IACvC,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAClE,IAAI,MAAM,gCAAgC,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvE,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC"}