aicodeman 1.29.1 → 1.30.0

package/README.md

@@ -443,7 +443,7 @@ PTY Output → 16ms Server Batch → DEC 2026 Wrap → SSE → Client rAF → xt
 - **Clone a GitHub repo as a case** — paste a repository URL into **Add Case → Clone Repo** and Codeman clones it into `~/codeman-cases/<name>` and registers it as a normal case, ready to run an agent in. It preflights the URL while you type (tells you whether it can be cloned anonymously and offers the repo's real branches and tags for the optional branch/tag field), fills the case name in from the URL, and lets you pick which CLI the Run button should use. Public repositories over `https://`; Codeman never collects or stores credentials
 - **Multi-CLI** — run **Claude Code**, **OpenCode**, **Codex**, **Antigravity**, **Gemini**, **Pi**, **Grok**, **DeepSeek Harness**, or **OMP** per session; env-var prefixes auto-gate (`CLAUDE_CODE_*` vs `OPENCODE_*` vs `CODEX_*` vs `ANTIGRAVITY_*` vs `GEMINI_*`/`GOOGLE_*` vs `PI_*` vs `GROK_*`/`XAI_*` vs `DSH_*`/`DEEPSEEK_*` vs `OMP_*`). See [`docs/opencode-integration.md`](docs/opencode-integration.md), [`docs/pi-integration.md`](docs/pi-integration.md), [`docs/grok-integration.md`](docs/grok-integration.md), [`docs/deepseek-integration.md`](docs/deepseek-integration.md) and [`docs/omp-integration.md`](docs/omp-integration.md)
 - **Custom model endpoints** _(new in 1.29.0, HTTP API for now)_ — point a session's CLI at any OpenAI-compatible endpoint instead of its native backend: a local llama.cpp, llama-swap, Ollama or vLLM box, or a cloud gateway such as Azure AI Foundry or OpenRouter. Save an endpoint once (`POST /api/model-endpoints`; its models are discovered from `/v1/models`), apply it to a session (`POST /api/sessions/:id/custom-model`), and the CLI restarts in place on that endpoint. Verified live for Claude, OpenCode, Pi, Grok and OMP; Codex, Gemini and DeepSeek have documented gaps, Antigravity has no mechanism. A toolbar picker is the follow-up. See [`docs/custom-model-endpoints.md`](docs/custom-model-endpoints.md)
-- **Web tabs** — open Grafana, Uptime Kuma, a Vite dev server or any dashboard URL as a tab beside your sessions (Run dropdown → **Web / URL** → **Add dashboard**). Dashboards are proxied through Codeman's own origin, so an `http://` target works from a phone over HTTPS and through the tunnel, single-page apps route on their own paths, and a frame that reloads recovers itself. A `localhost` link an agent prints opens as a web tab automatically. See [`docs/web-tabs.md`](docs/web-tabs.md)
+- **Web tabs** — open Grafana, Uptime Kuma, a Vite dev server or any dashboard URL as a tab beside your sessions (Run dropdown → **Web / URL** → **Add URL**). Dashboards are proxied through Codeman's own origin, so an `http://` target works from a phone over HTTPS and through the tunnel, single-page apps route on their own paths, and a frame that reloads recovers itself. A `localhost` link an agent prints opens as a web tab automatically. See [`docs/web-tabs.md`](docs/web-tabs.md)
 - **Docker sessions** — run a case inside an isolated, hardened container. One checkbox on **Create New** spins up a container with sensible defaults and starts the agent inside it; multiple sessions share one per-case container, or attach a case to a container you already run; export a container + its workspace to a portable `.tar.gz` to move it to another machine. See [`docs/docker-cases.md`](docs/docker-cases.md)
 - **Remote SSH sessions** — point a case at another machine and run the agent there inside a durable remote tmux: survives SSH drops, auto-reconnects, and can discover + attach sessions already running on the host; file previews and downloads come over the same ssh connection. See [`docs/remote-sessions.md`](docs/remote-sessions.md)
 - **Effort & Ultracode** — set a per-session default effort (`low`–`max`) or enable **ultracode** (dynamic multi-agent workflows). Soft defaults only — switchable anytime with `/effort` in-session. Extended-thinking budget is configurable too

package/README.zh-CN.md

@@ -445,7 +445,7 @@ PTY 输出 → 16ms 服务端批处理 → DEC 2026 包裹 → SSE → 客户端
 - **把 GitHub 仓库克隆成 case** —— 在 **Add Case → Clone Repo** 里粘贴一个仓库 URL，Codeman 会把它克隆到 `~/codeman-cases/<name>` 并注册为普通 case，随时可以跑智能体。输入时它会预检 URL（告诉你能否匿名克隆，并为可选的分支/标签字段提供仓库真实的分支与标签），从 URL 里填好 case 名，还让你选 Run 按钮该用哪个 CLI。支持 `https://` 的公开仓库；Codeman 绝不收集或保存凭据
 - **多 CLI** —— 每个会话可选 **Claude Code**、**OpenCode**、**Codex**、**Antigravity**、**Gemini**、**Pi**、**Grok**、**DeepSeek Harness** 或 **OMP**；环境变量前缀自动隔离（`CLAUDE_CODE_*`、`OPENCODE_*`、`CODEX_*`、`ANTIGRAVITY_*`、`GEMINI_*`/`GOOGLE_*`、`PI_*`、`GROK_*`/`XAI_*`、`DSH_*`/`DEEPSEEK_*` 与 `OMP_*`）。详见 [`docs/opencode-integration.md`](docs/opencode-integration.md)、[`docs/pi-integration.md`](docs/pi-integration.md)、[`docs/grok-integration.md`](docs/grok-integration.md)、[`docs/deepseek-integration.md`](docs/deepseek-integration.md) 与 [`docs/omp-integration.md`](docs/omp-integration.md)
 - **自定义模型端点**（1.29.0 新增，目前仅 HTTP API）—— 让某个会话的 CLI 指向任意 OpenAI 兼容端点，而不是它自己的官方后端：本地的 llama.cpp、llama-swap、Ollama 或 vLLM 机器，也可以是 Azure AI Foundry、OpenRouter 这类云端网关。端点只需保存一次（`POST /api/model-endpoints`，模型列表从它的 `/v1/models` 自动发现），再应用到会话（`POST /api/sessions/:id/custom-model`），CLI 就会在原地重启并接上该端点。Claude、OpenCode、Pi、Grok 与 OMP 已实测通过；Codex、Gemini 与 DeepSeek 存在已记录的缺口，Antigravity 没有可用机制。工具栏选择器是下一步。详见 [`docs/custom-model-endpoints.md`](docs/custom-model-endpoints.md)
-- **Web 标签页** —— 把 Grafana、Uptime Kuma、一个 Vite 开发服务器或任何仪表盘 URL 作为标签页打开在会话旁边（Run 下拉菜单 → **Web / URL** → **Add dashboard**）。仪表盘通过 Codeman 自己的源代理，因此 `http://` 目标在手机上走 HTTPS 也能用、走隧道也能用；单页应用能在自己的路径上正常路由，页面自己重载后也能自行恢复。智能体打印出的 `localhost` 链接会自动以 Web 标签页打开。详见 [`docs/web-tabs.md`](docs/web-tabs.md)
+- **Web 标签页** —— 把 Grafana、Uptime Kuma、一个 Vite 开发服务器或任何仪表盘 URL 作为标签页打开在会话旁边（Run 下拉菜单 → **Web / URL** → **Add URL**）。仪表盘通过 Codeman 自己的源代理，因此 `http://` 目标在手机上走 HTTPS 也能用、走隧道也能用；单页应用能在自己的路径上正常路由，页面自己重载后也能自行恢复。智能体打印出的 `localhost` 链接会自动以 Web 标签页打开。详见 [`docs/web-tabs.md`](docs/web-tabs.md)
 - **Docker 会话** —— 在隔离且加固的容器中运行 case。**Create New** 上勾选一个复选框即可用合理的默认值启动容器并在其中启动智能体；同一 case 的多个会话共享一个容器，也可以把 case 挂到你已经在跑的容器上；可将容器连同工作区导出为可移植的 `.tar.gz`，迁移到另一台机器。详见 [`docs/docker-cases.md`](docs/docker-cases.md)
 - **远程 SSH 会话** —— 把 case 指向另一台机器，让智能体在那里一个持久的远程 tmux 中运行：SSH 断连不中断任务、自动重连，还能发现并附着主机上已在运行的会话；文件预览与下载走同一条 ssh 连接。详见 [`docs/remote-sessions.md`](docs/remote-sessions.md)
 - **Effort 与 Ultracode** —— 设置每会话的默认 effort（`low`–`max`），或启用 **ultracode**（动态多智能体工作流）。这些都只是软默认值 —— 会话中可随时用 `/effort` 切换。扩展思考预算也可配置

package/dist/reboot-restore.d.ts

@@ -0,0 +1,146 @@
+/**
+ * @fileoverview Decide which sessions a host reboot destroyed and may be rebuilt.
+ *
+ * A server restart and a host reboot both leave `reconcileSessions()` reporting
+ * dead sessions, and they need opposite handling. A server restart leaves the
+ * tmux panes running, so recovery ATTACHES to them. A host reboot takes the tmux
+ * server down with it, so there is nothing to attach to and the pane has to be
+ * created again. This module holds the decision half of that second case, kept
+ * free of tmux and disk access so it can be unit tested without either. Every
+ * observation it reads is gathered by the caller and passed in.
+ *
+ * "Eligible" here means a session the user did not end on purpose. The rule that
+ * an intentional kill or detach is never auto-revived is enforced at runtime by
+ * an in-memory guard in `TmuxManager`, and memory does not survive a reboot. The
+ * durable equivalent is the record `cleanupSession()` leaves behind. An unpinned
+ * kill deletes the record outright, so it is already absent here. A pinned kill
+ * goes through `demoteOrRemoveSession()` and lands as `status: 'stopped'`, which
+ * is the marker this module refuses. Pruning keeps a pinned record WITHOUT
+ * touching its status, so a pinned session a reboot killed still reads `idle` or
+ * `busy` and stays eligible.
+ *
+ * ⚠️ Ending the AGENT rather than the session is a shape this module CANNOT
+ * recognise today, and a reboot restores it. `/exit` ends the CLI inside the
+ * pane, `remain-on-exit` keeps the pane, and the PTY Codeman owns is the
+ * `tmux attach-session` process, which stays alive throughout — so no exit
+ * handler runs, no lifecycle `exit` is logged, and the record keeps both its pid
+ * and `status: 'idle'`. Nothing durable distinguishes it from a session that was
+ * simply idle when the power went. Ark0N/Codeman#446 covers making Codeman
+ * notice the dead pane; until a record can say the agent is gone, this pass will
+ * offer those sessions back, and the user dismisses or closes them.
+ *
+ * The `pid` check below is therefore NOT that rule. It refuses a record whose
+ * attach process was already gone, which is a session that never started or
+ * whose pane died outright.
+ *
+ * @dependencies types (SessionState), config/cli-registry
+ * @consumedby web/server (plan build at boot), web/routes/reboot-restore-routes
+ *
+ * @module reboot-restore
+ */
+import type { SessionState } from './types.js';
+/** Observations the reboot heuristic reads. Gathered by the caller, never here. */
+export interface RebootEvidence {
+    /** Sessions that still had a live pane during reconciliation. */
+    livePaneCount: number;
+    /** Sessions reconciliation just marked dead. */
+    deadSessionCount: number;
+    /** `os.uptime()`, in seconds. */
+    uptimeSeconds: number;
+    /** Newest `lastActivityAt` across the persisted records, in ms since the epoch. */
+    newestPersistedActivityAt: number;
+    /** `Date.now()` when the evidence was gathered, in ms. */
+    now: number;
+}
+/**
+ * Decide whether the machine plausibly rebooted rather than the server restarting.
+ *
+ * Two signals have to agree. The socket must hold no panes at all while state
+ * still lists sessions, which rules out an ordinary server restart. The host
+ * must also have booted after the newest persisted session activity, which is
+ * the corroboration `os.uptime()` provides cheaply. A wiped tmux socket on a
+ * long-uptime host fails the second test, so a user who killed the tmux server
+ * by hand does not get every session offered back to them.
+ *
+ * This heuristic decides whether to ASK, never whether to act. A wrong yes costs
+ * the user a banner they dismiss, because the restore itself waits for a click.
+ *
+ * ⚠️ `os.uptime()` reports the HOST's uptime, which a container shares, and that
+ * cuts BOTH ways rather than simply switching the feature off in Docker. After a
+ * genuine host reboot a containerized Codeman sees the host's short uptime, so the
+ * banner DOES appear and the feature works. What it cannot see is a container-only
+ * restart: the host uptime is long, the boot test fails, and no banner appears
+ * although every in-container pane is gone (`docker/server.Dockerfile` installs
+ * tmux inside the Codeman container, and the self-updater restarts the Compose
+ * deployment by exiting the container, so that is the case where this would help
+ * most). Failing quiet is the safe direction, and closing the gap needs a boot
+ * signal the container owns (PID 1's start time, gated on the existing
+ * `isRunningInContainer()`) rather than a wider heuristic.
+ */
+export declare function looksLikeHostReboot(evidence: RebootEvidence): boolean;
+/**
+ * Pick the conversation the rebuilt pane should resume.
+ *
+ * The chain's tail is the newest conversation the session was holding, which is
+ * what a compact or a clear leaves behind; `resumeSessionId` covers a session
+ * that was itself started as a resume, and the session id is the original
+ * conversation for everything else.
+ */
+export declare function resolveResumeConversationId(state: SessionState): string;
+/**
+ * Why one session was passed over. Reported for logging and shown to the user.
+ *
+ * The first seven are decided before anything is built. `capacity-reached` and
+ * `rebuild-failed` can only happen once a click is spending the plan, and they
+ * are the two the banner must not confuse with a missing workspace: one means
+ * "try again after closing something", the other means the CLI would not start.
+ */
+export interface RebootRestoreRejection {
+    sessionId: string;
+    reason: 'no-persisted-record' | 'intentionally-ended' | 'not-running' | 'respawn-blocked' | 'remote-or-docker' | 'unsupported-mode' | 'no-working-dir' | 'workspace-missing' | 'workspace-forbidden' | 'already-live' | 'capacity-reached' | 'rebuild-failed';
+}
+/** One restorable session, as the banner shows it and the rebuild replays it. */
+export interface RebootRestoreEntry {
+    sessionId: string;
+    name?: string;
+    workingDir: string;
+    owner?: string;
+    mode: string;
+    /** The conversation the rebuilt pane resumes. */
+    resumeConversationId: string;
+    /**
+     * The persisted record, kept whole so the rebuild can replay what it held.
+     * Read at boot, before pruning deletes it, and held in memory until the click.
+     */
+    state: SessionState;
+}
+export interface RebootRestorePlan {
+    restore: RebootRestoreEntry[];
+    skipped: RebootRestoreRejection[];
+}
+/**
+ * Split the sessions reconciliation just killed into the ones a reboot restore
+ * may offer and the ones it must leave alone.
+ *
+ * @param deadSessionIds Session ids `reconcileSessions()` reported as dead.
+ * @param persisted The `state.json` session records, which `cleanupStaleSessions()`
+ *   has not pruned yet at the point this runs.
+ * @param workspaceExists Whether a working directory is still on disk. A tmux
+ *   session can outlive its deleted repo, and rebuilding one there would scaffold
+ *   an empty tree. The caller owns the disk access; the click re-checks, because
+ *   a repo can be deleted between the boot and the click.
+ */
+export declare function planRebootRestore(deadSessionIds: readonly string[], persisted: Readonly<Record<string, SessionState>>, workspaceExists: (workingDir: string) => boolean): RebootRestorePlan;
+/**
+ * Drop the entries whose conversation is already on screen.
+ *
+ * Hours can pass between the boot that built the plan and the click that spends
+ * it, and the Resume list can reach the same conversation in the meantime. Two
+ * panes running `claude --resume` on one conversation is the failure this
+ * prevents, so a match on either the session id or the conversation id is enough
+ * to skip the entry.
+ */
+export declare function rejectAlreadyLive(entries: readonly RebootRestoreEntry[], liveSessionIds: ReadonlySet<string>, liveConversationIds: ReadonlySet<string>): RebootRestorePlan;
+/** Newest `lastActivityAt` across persisted records, or 0 when there are none. */
+export declare function newestPersistedActivity(persisted: Readonly<Record<string, SessionState>>): number;
+//# sourceMappingURL=reboot-restore.d.ts.map

package/dist/reboot-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reboot-restore.d.ts","sourceRoot":"","sources":["../src/reboot-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAM/C,mFAAmF;AACnF,MAAM,WAAW,cAAc;IAC7B,iEAAiE;IACjE,aAAa,EAAE,MAAM,CAAC;IACtB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,CAAC;IACzB,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,mFAAmF;IACnF,yBAAyB,EAAE,MAAM,CAAC;IAClC,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CAMrE;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAIvE;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EACF,qBAAqB,GACrB,qBAAqB,GACrB,aAAa,GACb,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,qBAAqB,GACrB,cAAc,GACd,kBAAkB,GAClB,gBAAgB,CAAC;CACtB;AAED,iFAAiF;AACjF,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,oBAAoB,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,OAAO,EAAE,sBAAsB,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,iBAAiB,CAC/B,cAAc,EAAE,SAAS,MAAM,EAAE,EACjC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,EACjD,eAAe,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,GAC/C,iBAAiB,CAuEnB;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,SAAS,kBAAkB,EAAE,EACtC,cAAc,EAAE,WAAW,CAAC,MAAM,CAAC,EACnC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,GACvC,iBAAiB,CAWnB;AAED,kFAAkF;AAClF,wBAAgB,uBAAuB,CAAC,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,GAAG,MAAM,CAOjG"}

package/dist/reboot-restore.js

@@ -0,0 +1,205 @@
+/**
+ * @fileoverview Decide which sessions a host reboot destroyed and may be rebuilt.
+ *
+ * A server restart and a host reboot both leave `reconcileSessions()` reporting
+ * dead sessions, and they need opposite handling. A server restart leaves the
+ * tmux panes running, so recovery ATTACHES to them. A host reboot takes the tmux
+ * server down with it, so there is nothing to attach to and the pane has to be
+ * created again. This module holds the decision half of that second case, kept
+ * free of tmux and disk access so it can be unit tested without either. Every
+ * observation it reads is gathered by the caller and passed in.
+ *
+ * "Eligible" here means a session the user did not end on purpose. The rule that
+ * an intentional kill or detach is never auto-revived is enforced at runtime by
+ * an in-memory guard in `TmuxManager`, and memory does not survive a reboot. The
+ * durable equivalent is the record `cleanupSession()` leaves behind. An unpinned
+ * kill deletes the record outright, so it is already absent here. A pinned kill
+ * goes through `demoteOrRemoveSession()` and lands as `status: 'stopped'`, which
+ * is the marker this module refuses. Pruning keeps a pinned record WITHOUT
+ * touching its status, so a pinned session a reboot killed still reads `idle` or
+ * `busy` and stays eligible.
+ *
+ * ⚠️ Ending the AGENT rather than the session is a shape this module CANNOT
+ * recognise today, and a reboot restores it. `/exit` ends the CLI inside the
+ * pane, `remain-on-exit` keeps the pane, and the PTY Codeman owns is the
+ * `tmux attach-session` process, which stays alive throughout — so no exit
+ * handler runs, no lifecycle `exit` is logged, and the record keeps both its pid
+ * and `status: 'idle'`. Nothing durable distinguishes it from a session that was
+ * simply idle when the power went. Ark0N/Codeman#446 covers making Codeman
+ * notice the dead pane; until a record can say the agent is gone, this pass will
+ * offer those sessions back, and the user dismisses or closes them.
+ *
+ * The `pid` check below is therefore NOT that rule. It refuses a record whose
+ * attach process was already gone, which is a session that never started or
+ * whose pane died outright.
+ *
+ * @dependencies types (SessionState), config/cli-registry
+ * @consumedby web/server (plan build at boot), web/routes/reboot-restore-routes
+ *
+ * @module reboot-restore
+ */
+import { getCli } from './config/cli-registry/registry.js';
+/** Session statuses a reboot restore may rebuild. `stopped` is the kill marker. */
+const RESTORABLE_STATUSES = new Set(['idle', 'busy', 'error']);
+/**
+ * Decide whether the machine plausibly rebooted rather than the server restarting.
+ *
+ * Two signals have to agree. The socket must hold no panes at all while state
+ * still lists sessions, which rules out an ordinary server restart. The host
+ * must also have booted after the newest persisted session activity, which is
+ * the corroboration `os.uptime()` provides cheaply. A wiped tmux socket on a
+ * long-uptime host fails the second test, so a user who killed the tmux server
+ * by hand does not get every session offered back to them.
+ *
+ * This heuristic decides whether to ASK, never whether to act. A wrong yes costs
+ * the user a banner they dismiss, because the restore itself waits for a click.
+ *
+ * ⚠️ `os.uptime()` reports the HOST's uptime, which a container shares, and that
+ * cuts BOTH ways rather than simply switching the feature off in Docker. After a
+ * genuine host reboot a containerized Codeman sees the host's short uptime, so the
+ * banner DOES appear and the feature works. What it cannot see is a container-only
+ * restart: the host uptime is long, the boot test fails, and no banner appears
+ * although every in-container pane is gone (`docker/server.Dockerfile` installs
+ * tmux inside the Codeman container, and the self-updater restarts the Compose
+ * deployment by exiting the container, so that is the case where this would help
+ * most). Failing quiet is the safe direction, and closing the gap needs a boot
+ * signal the container owns (PID 1's start time, gated on the existing
+ * `isRunningInContainer()`) rather than a wider heuristic.
+ */
+export function looksLikeHostReboot(evidence) {
+    if (evidence.deadSessionCount === 0)
+        return false;
+    if (evidence.livePaneCount > 0)
+        return false;
+    if (evidence.newestPersistedActivityAt <= 0)
+        return false;
+    const bootedAt = evidence.now - evidence.uptimeSeconds * 1000;
+    return bootedAt > evidence.newestPersistedActivityAt;
+}
+/**
+ * Pick the conversation the rebuilt pane should resume.
+ *
+ * The chain's tail is the newest conversation the session was holding, which is
+ * what a compact or a clear leaves behind; `resumeSessionId` covers a session
+ * that was itself started as a resume, and the session id is the original
+ * conversation for everything else.
+ */
+export function resolveResumeConversationId(state) {
+    const chain = state.claudeSessionChain;
+    const chainTail = Array.isArray(chain) && chain.length > 0 ? chain[chain.length - 1] : undefined;
+    return chainTail || state.resumeSessionId || state.id;
+}
+/**
+ * Split the sessions reconciliation just killed into the ones a reboot restore
+ * may offer and the ones it must leave alone.
+ *
+ * @param deadSessionIds Session ids `reconcileSessions()` reported as dead.
+ * @param persisted The `state.json` session records, which `cleanupStaleSessions()`
+ *   has not pruned yet at the point this runs.
+ * @param workspaceExists Whether a working directory is still on disk. A tmux
+ *   session can outlive its deleted repo, and rebuilding one there would scaffold
+ *   an empty tree. The caller owns the disk access; the click re-checks, because
+ *   a repo can be deleted between the boot and the click.
+ */
+export function planRebootRestore(deadSessionIds, persisted, workspaceExists) {
+    const restore = [];
+    const skipped = [];
+    for (const sessionId of deadSessionIds) {
+        const state = persisted[sessionId];
+        if (!state) {
+            // An unpinned kill already deleted the record, so absence IS the guard.
+            skipped.push({ sessionId, reason: 'no-persisted-record' });
+            continue;
+        }
+        if (!RESTORABLE_STATUSES.has(state.status)) {
+            // A pinned kill was demoted to `stopped`. Reviving it would undo the kill.
+            skipped.push({ sessionId, reason: 'intentionally-ended' });
+            continue;
+        }
+        if (state.pid === null || state.pid === undefined) {
+            // No attach process when the record was last written: the session never
+            // started, or its pane died outright rather than its agent exiting inside a
+            // surviving pane. Either way there was nothing running to bring back.
+            //
+            // ⚠️ This does NOT catch a session the user ended with `/exit`. See the
+            // module header: that leaves the pid in place, because the pid is the tmux
+            // attach process and `remain-on-exit` keeps it alive.
+            //
+            // Conservative on purpose. A session that somehow persisted no pid while
+            // genuinely running is not offered, and its conversation stays reachable
+            // from the Resume list, which is where every session would be without this
+            // feature.
+            skipped.push({ sessionId, reason: 'not-running' });
+            continue;
+        }
+        if (state.respawnBlocked === true) {
+            // The crash-loop breaker tripped on this pane. Re-creating it restarts the loop.
+            skipped.push({ sessionId, reason: 'respawn-blocked' });
+            continue;
+        }
+        if (state.remote || state.docker) {
+            // Both need another host or a container to be up, which a just-booted machine
+            // cannot promise. The remote reconnect watcher owns the remote case already.
+            skipped.push({ sessionId, reason: 'remote-or-docker' });
+            continue;
+        }
+        // Capability, not a CLI id: this pass resumes by handing the CLI a conversation
+        // id through the top-level `resumeSessionId`, which only a CLI whose history the
+        // claude-jsonl reader understands can consume that way. Others carry their thread
+        // id in their own `<Mode>Config`, which this pass does not thread through.
+        if (getCli(state.mode ?? 'claude')?.capabilities.transcript !== 'claude-jsonl') {
+            skipped.push({ sessionId, reason: 'unsupported-mode' });
+            continue;
+        }
+        if (!state.workingDir) {
+            skipped.push({ sessionId, reason: 'no-working-dir' });
+            continue;
+        }
+        if (!workspaceExists(state.workingDir)) {
+            skipped.push({ sessionId, reason: 'workspace-missing' });
+            continue;
+        }
+        restore.push({
+            sessionId,
+            name: state.name,
+            workingDir: state.workingDir,
+            owner: state.owner,
+            mode: state.mode ?? 'claude',
+            resumeConversationId: resolveResumeConversationId(state),
+            state,
+        });
+    }
+    return { restore, skipped };
+}
+/**
+ * Drop the entries whose conversation is already on screen.
+ *
+ * Hours can pass between the boot that built the plan and the click that spends
+ * it, and the Resume list can reach the same conversation in the meantime. Two
+ * panes running `claude --resume` on one conversation is the failure this
+ * prevents, so a match on either the session id or the conversation id is enough
+ * to skip the entry.
+ */
+export function rejectAlreadyLive(entries, liveSessionIds, liveConversationIds) {
+    const restore = [];
+    const skipped = [];
+    for (const entry of entries) {
+        if (liveSessionIds.has(entry.sessionId) || liveConversationIds.has(entry.resumeConversationId)) {
+            skipped.push({ sessionId: entry.sessionId, reason: 'already-live' });
+            continue;
+        }
+        restore.push(entry);
+    }
+    return { restore, skipped };
+}
+/** Newest `lastActivityAt` across persisted records, or 0 when there are none. */
+export function newestPersistedActivity(persisted) {
+    let newest = 0;
+    for (const state of Object.values(persisted)) {
+        const stamp = state.lastActivityAt ?? state.createdAt ?? 0;
+        if (stamp > newest)
+            newest = stamp;
+    }
+    return newest;
+}
+//# sourceMappingURL=reboot-restore.js.map

package/dist/reboot-restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reboot-restore.js","sourceRoot":"","sources":["../src/reboot-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AAE3D,mFAAmF;AACnF,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAgBpF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAwB;IAC1D,IAAI,QAAQ,CAAC,gBAAgB,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,QAAQ,CAAC,aAAa,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,QAAQ,CAAC,yBAAyB,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,GAAG,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAC;IAC9D,OAAO,QAAQ,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,KAAmB;IAC7D,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,CAAC;IACvC,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,OAAO,SAAS,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,EAAE,CAAC;AACxD,CAAC;AAgDD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAC/B,cAAiC,EACjC,SAAiD,EACjD,eAAgD;IAEhD,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAE7C,KAAK,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,wEAAwE;YACxE,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3C,2EAA2E;YAC3E,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAClD,wEAAwE;YACxE,4EAA4E;YAC5E,sEAAsE;YACtE,EAAE;YACF,wEAAwE;YACxE,2EAA2E;YAC3E,sDAAsD;YACtD,EAAE;YACF,yEAAyE;YACzE,yEAAyE;YACzE,2EAA2E;YAC3E,WAAW;YACX,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YAClC,iFAAiF;YACjF,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACvD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,8EAA8E;YAC9E,6EAA6E;YAC7E,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,gFAAgF;QAChF,iFAAiF;QACjF,kFAAkF;QAClF,2EAA2E;QAC3E,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,IAAI,QAAQ,CAAC,EAAE,YAAY,CAAC,UAAU,KAAK,cAAc,EAAE,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACxD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACtD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,SAAS;YACT,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,QAAQ;YAC5B,oBAAoB,EAAE,2BAA2B,CAAC,KAAK,CAAC;YACxD,KAAK;SACN,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsC,EACtC,cAAmC,EACnC,mBAAwC;IAExC,MAAM,OAAO,GAAyB,EAAE,CAAC;IACzC,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;YACrE,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,uBAAuB,CAAC,SAAiD;IACvF,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,CAAC;QAC3D,IAAI,KAAK,GAAG,MAAM;YAAE,MAAM,GAAG,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/session-env-clamp.d.ts

@@ -0,0 +1,80 @@
+/**
+ * @fileoverview The env-var half of the multi-user privilege clamp.
+ *
+ * A session's `envOverrides` can hand back privilege that the per-CLI config
+ * clamp removed, so a non-granted owner's overrides get the privileged keys
+ * stripped before the session is built. The create and resume routes are what
+ * this bites on: they clamp what a request asked for.
+ *
+ * The reboot-restore route calls it as defence in depth, and today it can strip
+ * nothing. `Session.getEnvOverridesForPersist()` keeps only `CLAUDE_CODE_*` and
+ * `CLAUDE_CONFIG_DIR` out of a session's overrides, claude's `privilegedEnvKeys`
+ * are the five `ANTHROPIC_*` names, and that pass admits claude alone — so a
+ * persisted record cannot carry a clamped key. The call is there for the day the
+ * persisted set widens. The grant re-resolution that does bite on that path is
+ * `resolveClaudeModeForUsername`, which recomputes the permission mode.
+ *
+ * This lives outside `web/routes` on purpose. The question it answers is about
+ * session privilege rather than about HTTP, and `cron/cron-service.ts` sets the
+ * precedent by importing `canUsernameRunPrivilegedCommands` from `user-store.ts`
+ * directly and re-resolving the owner's grant when a job fires. Every caller here
+ * re-resolves the grant at the moment it builds a session, for the same reason.
+ *
+ * @dependencies user-store (canUsernameRunPrivilegedCommands), config/cli-registry
+ * @consumedby web/routes/session-routes, web/routes/reboot-restore-routes
+ *
+ * @module session-env-clamp
+ */
+/**
+ * Env-var keys a non-granted owner must not be able to set, because each one
+ * hands back privilege `clampExternalCliBypassForOwner()` just removed, or redirects a
+ * credential-resolution endpoint.
+ *
+ * The DeepSeek three are reachable because `DSH_*` and `DEEPSEEK_*` are
+ * allowlisted `envOverrides` prefixes (schemas.ts) — which they have to be, since
+ * that is also how a user configures the harness's non-privileged knobs.
+ *
+ * - `DSH_PERMISSION_MODE` IS the harness's permission switch. Every other CLI's
+ *   bypass is a command-line FLAG, reachable only through the per-CLI config the
+ *   clamp already owns; this one is an env var, so the config clamp alone is
+ *   half a gate.
+ * - `DSH_HOME` points the launcher at a profile tree, and a profile's plugin code
+ *   executes at BOOT, before any approval row can apply. A user who can write a
+ *   workspace can put a profile in it, so this is the wider of the two.
+ * - `DEEPSEEK_BASE_URL` aims the provider endpoint, and `_configureCliEnv()`
+ *   forwards the SERVER's own `DEEPSEEK_API_KEY` into every dsh pane before
+ *   `applyEnvOverrides()` runs — so a non-granted owner who could set the base
+ *   URL would have the operator's API key sent as a bearer credential to a host
+ *   of their choosing. (`DEEPSEEK_API_KEY` itself stays overridable: supplying
+ *   your OWN key removes privilege rather than granting it.)
+ * - `OMP_AUTH_BROKER_URL`/`OMP_AUTH_BROKER_TOKEN` are where omp resolves
+ *   credentials from — the same shape as `DEEPSEEK_BASE_URL` above, reachable
+ *   because `OMP_*` is an allowlisted prefix. Unlike DeepSeek, Codeman does not
+ *   forward any operator-held key into an omp pane today (omp's provider
+ *   credentials live in `~/.omp` config files, not env vars), so there is no
+ *   known concrete exfiltration path yet — clamped defensively anyway, since a
+ *   non-granted owner redirecting where a shared multi-tenant deployment
+ *   resolves auth from is not something to allow silently (found in
+ *   Ark0N/Codeman#353 review; omp's own knobs are otherwise mostly `PI_*`,
+ *   already allowlisted for pi and not addressed here — see resolveOmpHome()).
+ */
+export declare function ownerClampedEnvKeys(): string[];
+/**
+ * Env-var half of the multi-user bypass clamp.
+ *
+ * `clampExternalCliBypassForOwner()` in `web/routes/session-routes.ts` clamps the
+ * per-CLI CONFIG, and for every CLI
+ * but DeepSeek that is the whole story. Here it is not: `applyEnvOverrides()` runs
+ * AFTER `_configureCliEnv()` in tmux-manager, so an override sent on the SAME
+ * request lands last and wins, and a non-granted owner could restore
+ * `danger-full-access` on the very request the config clamp downgraded.
+ *
+ * Keys are DROPPED rather than rewritten: dropping falls through to what
+ * `_configureCliEnv()` exports, which is the clamped config and the server's own
+ * `DSH_HOME`, i.e. exactly the intended state. No-op in single-user mode and for a
+ * granted owner, like every other clamp here
+ * (`canUsernameRunPrivilegedCommands()` returns true when `!isMultiUserMode()`),
+ * and it returns the caller's own object untouched when there is nothing to strip.
+ */
+export declare function clampEnvOverridesForOwner(owner: string | undefined, envOverrides: Record<string, string> | undefined): Promise<Record<string, string> | undefined>;
+//# sourceMappingURL=session-env-clamp.d.ts.map

package/dist/session-env-clamp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-env-clamp.d.ts","sourceRoot":"","sources":["../src/session-env-clamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAKH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAQ7C"}

package/dist/session-env-clamp.js

@@ -0,0 +1,96 @@
+/**
+ * @fileoverview The env-var half of the multi-user privilege clamp.
+ *
+ * A session's `envOverrides` can hand back privilege that the per-CLI config
+ * clamp removed, so a non-granted owner's overrides get the privileged keys
+ * stripped before the session is built. The create and resume routes are what
+ * this bites on: they clamp what a request asked for.
+ *
+ * The reboot-restore route calls it as defence in depth, and today it can strip
+ * nothing. `Session.getEnvOverridesForPersist()` keeps only `CLAUDE_CODE_*` and
+ * `CLAUDE_CONFIG_DIR` out of a session's overrides, claude's `privilegedEnvKeys`
+ * are the five `ANTHROPIC_*` names, and that pass admits claude alone — so a
+ * persisted record cannot carry a clamped key. The call is there for the day the
+ * persisted set widens. The grant re-resolution that does bite on that path is
+ * `resolveClaudeModeForUsername`, which recomputes the permission mode.
+ *
+ * This lives outside `web/routes` on purpose. The question it answers is about
+ * session privilege rather than about HTTP, and `cron/cron-service.ts` sets the
+ * precedent by importing `canUsernameRunPrivilegedCommands` from `user-store.ts`
+ * directly and re-resolving the owner's grant when a job fires. Every caller here
+ * re-resolves the grant at the moment it builds a session, for the same reason.
+ *
+ * @dependencies user-store (canUsernameRunPrivilegedCommands), config/cli-registry
+ * @consumedby web/routes/session-routes, web/routes/reboot-restore-routes
+ *
+ * @module session-env-clamp
+ */
+import { canUsernameRunPrivilegedCommands } from './user-store.js';
+import { enabledClis } from './config/cli-registry/registry.js';
+/**
+ * Env-var keys a non-granted owner must not be able to set, because each one
+ * hands back privilege `clampExternalCliBypassForOwner()` just removed, or redirects a
+ * credential-resolution endpoint.
+ *
+ * The DeepSeek three are reachable because `DSH_*` and `DEEPSEEK_*` are
+ * allowlisted `envOverrides` prefixes (schemas.ts) — which they have to be, since
+ * that is also how a user configures the harness's non-privileged knobs.
+ *
+ * - `DSH_PERMISSION_MODE` IS the harness's permission switch. Every other CLI's
+ *   bypass is a command-line FLAG, reachable only through the per-CLI config the
+ *   clamp already owns; this one is an env var, so the config clamp alone is
+ *   half a gate.
+ * - `DSH_HOME` points the launcher at a profile tree, and a profile's plugin code
+ *   executes at BOOT, before any approval row can apply. A user who can write a
+ *   workspace can put a profile in it, so this is the wider of the two.
+ * - `DEEPSEEK_BASE_URL` aims the provider endpoint, and `_configureCliEnv()`
+ *   forwards the SERVER's own `DEEPSEEK_API_KEY` into every dsh pane before
+ *   `applyEnvOverrides()` runs — so a non-granted owner who could set the base
+ *   URL would have the operator's API key sent as a bearer credential to a host
+ *   of their choosing. (`DEEPSEEK_API_KEY` itself stays overridable: supplying
+ *   your OWN key removes privilege rather than granting it.)
+ * - `OMP_AUTH_BROKER_URL`/`OMP_AUTH_BROKER_TOKEN` are where omp resolves
+ *   credentials from — the same shape as `DEEPSEEK_BASE_URL` above, reachable
+ *   because `OMP_*` is an allowlisted prefix. Unlike DeepSeek, Codeman does not
+ *   forward any operator-held key into an omp pane today (omp's provider
+ *   credentials live in `~/.omp` config files, not env vars), so there is no
+ *   known concrete exfiltration path yet — clamped defensively anyway, since a
+ *   non-granted owner redirecting where a shared multi-tenant deployment
+ *   resolves auth from is not something to allow silently (found in
+ *   Ark0N/Codeman#353 review; omp's own knobs are otherwise mostly `PI_*`,
+ *   already allowlisted for pi and not addressed here — see resolveOmpHome()).
+ */
+export function ownerClampedEnvKeys() {
+    return enabledClis().flatMap((entry) => entry.capabilities.privilegedEnvKeys);
+}
+/**
+ * Env-var half of the multi-user bypass clamp.
+ *
+ * `clampExternalCliBypassForOwner()` in `web/routes/session-routes.ts` clamps the
+ * per-CLI CONFIG, and for every CLI
+ * but DeepSeek that is the whole story. Here it is not: `applyEnvOverrides()` runs
+ * AFTER `_configureCliEnv()` in tmux-manager, so an override sent on the SAME
+ * request lands last and wins, and a non-granted owner could restore
+ * `danger-full-access` on the very request the config clamp downgraded.
+ *
+ * Keys are DROPPED rather than rewritten: dropping falls through to what
+ * `_configureCliEnv()` exports, which is the clamped config and the server's own
+ * `DSH_HOME`, i.e. exactly the intended state. No-op in single-user mode and for a
+ * granted owner, like every other clamp here
+ * (`canUsernameRunPrivilegedCommands()` returns true when `!isMultiUserMode()`),
+ * and it returns the caller's own object untouched when there is nothing to strip.
+ */
+export async function clampEnvOverridesForOwner(owner, envOverrides) {
+    if (!envOverrides)
+        return envOverrides;
+    const keys = ownerClampedEnvKeys();
+    if (!keys.some((key) => key in envOverrides))
+        return envOverrides;
+    if (await canUsernameRunPrivilegedCommands(owner))
+        return envOverrides;
+    const clamped = { ...envOverrides };
+    for (const key of keys)
+        delete clamped[key];
+    return clamped;
+}
+//# sourceMappingURL=session-env-clamp.js.map

package/dist/session-env-clamp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-env-clamp.js","sourceRoot":"","sources":["../src/session-env-clamp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,gCAAgC,EAAE,MAAM,iBAAiB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAEhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,WAAW,EAAE,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;AAChF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAyB,EACzB,YAAgD;IAEhD,IAAI,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IACvC,MAAM,IAAI,GAAG,mBAAmB,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,YAAY,CAAC;QAAE,OAAO,YAAY,CAAC;IAClE,IAAI,MAAM,gCAAgC,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACvE,MAAM,OAAO,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC;IAC5C,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/session.d.ts

@@ -579,6 +579,15 @@ export declare class Session extends EventEmitter {
      * re-pinning an already-pinned session refreshes its pinnedAt.
      */
     setPinned(pinned: boolean): void;
+    /**
+     * Restore a pin from a persisted record, keeping the moment it was pinned.
+     *
+     * `setPinned()` stamps `pinnedAt` with now, which is right for a user pinning a
+     * session and wrong for a restore: the session-manager orders its pinned group
+     * by that stamp, so a restored session would jump to the front of a list it had
+     * been sitting further down.
+     */
+    restorePin(pinned: boolean, pinnedAt?: number): void;
     get flickerFilterEnabled(): boolean;
     set flickerFilterEnabled(enabled: boolean);
     isIdle(): boolean;