aicodeman 1.29.1 → 1.30.0

package/dist/web/routes/reboot-restore-routes.js

@@ -0,0 +1,273 @@
+/**
+ * @fileoverview Reboot-restore routes: offer back the sessions a host reboot destroyed.
+ *
+ * The boot pass leaves a plan in `web/reboot-restore-registry` when the machine
+ * plausibly rebooted. The board reads it, shows a banner, and the user decides:
+ * - `GET  /api/reboot-restore`: what is on offer, ownership-scoped
+ * - `POST /api/reboot-restore/restore`: rebuild some or all of it
+ * - `POST /api/reboot-restore/dismiss`: drop the offer
+ *
+ * A click, not the heuristic, is what creates panes. The heuristic only decides
+ * whether the banner appears, so a wrong yes costs a line of text the user
+ * dismisses rather than N CLI processes nobody asked for.
+ *
+ * Rebuilding is take-then-build: entries leave the plan synchronously at the top
+ * of the route, before the first `await`, and the whole route is single-flighted,
+ * so a double-click or two devices cannot put two panes on one conversation.
+ * Three things are re-checked at click time rather than trusted from boot: the
+ * owner's privilege grant, the workspace still being on disk, and the
+ * conversation not already being live because the user resumed it by hand.
+ *
+ * A rebuilt session comes back attached, idle and disarmed. Respawn controllers
+ * and Ralph loops are deliberately not re-armed, and its terminal scrollback is
+ * gone, because the pane is new. The banner says so.
+ */
+import { existsSync } from 'node:fs';
+import { ApiErrorCode, createErrorResponse, getErrorMessage } from '../../types.js';
+import { RebootRestoreRequestSchema } from '../schemas.js';
+import { parseBody, getAuthUser, canAccessOwned, ownerFor, isWorkingDirAllowedForUsername, sessionCapacityMessage, } from '../route-helpers.js';
+import { rebootRestoreRegistry } from '../reboot-restore-registry.js';
+import { rejectAlreadyLive } from '../../reboot-restore.js';
+import { clampEnvOverridesForOwner } from '../../session-env-clamp.js';
+import { Session } from '../../session.js';
+import { resolveClaudeModeForUsername } from '../../user-store.js';
+import { getCli } from '../../config/cli-registry/registry.js';
+import { applyWorkspaceHooks, seedAgentSessionPreamble } from '../../hooks-config.js';
+import { getLifecycleLog } from '../../session-lifecycle-log.js';
+import { STATS_COLLECTION_INTERVAL_MS } from '../../config/server-timing.js';
+import { SseEvent } from '../sse-events.js';
+/** The banner's view of one restorable session. The record itself never leaves the server. */
+function toBannerItem(entry) {
+    return {
+        id: entry.sessionId,
+        name: entry.name,
+        workingDir: entry.workingDir,
+        mode: entry.mode,
+        owner: entry.owner,
+    };
+}
+export function registerRebootRestoreRoutes(app, ctx) {
+    const accessorFor = (req) => {
+        const user = getAuthUser(req);
+        return (owner) => canAccessOwned(user, owner);
+    };
+    // ========== What is on offer ==========
+    app.get('/api/reboot-restore', async (req) => {
+        const entries = rebootRestoreRegistry.list(accessorFor(req));
+        return {
+            sessions: entries.map(toBannerItem),
+            // Said plainly here so the banner never implies a full restore: the pane is
+            // new, so the conversation continues and the terminal history does not.
+            scrollbackRestored: false,
+        };
+    });
+    // ========== Spend it ==========
+    app.post('/api/reboot-restore/restore', async (req, reply) => {
+        const body = parseBody(RebootRestoreRequestSchema, req.body, 'Invalid reboot restore request');
+        const canAccess = accessorFor(req);
+        const owner = ownerFor(req);
+        // Take BEFORE the first await: a second click must find nothing to spend.
+        // The flight is per owner, because `take()` already guarantees two callers
+        // never receive the same entry, so one user's restore need not block another's.
+        if (!rebootRestoreRegistry.beginSpending(owner)) {
+            return reply.code(409).send(createErrorResponse(ApiErrorCode.CONFLICT, 'A reboot restore is already running'));
+        }
+        const taken = rebootRestoreRegistry.take(canAccess, body.sessionIds, owner);
+        // Entries nothing built a pane for, returned to the plan on every exit path
+        // including a throw. Without this a failure between here and the loop would
+        // spend the offer and rebuild nothing, and the plan cannot be rebuilt.
+        const unspent = new Set(taken);
+        try {
+            if (taken.length === 0)
+                return { restored: [], skipped: [] };
+            // The plan was built at boot and the board has moved on since. A conversation
+            // the user resumed by hand from the Resume list is already on screen, and a
+            // second pane on it would fight the first for the same transcript. This one
+            // is never re-offered: unlike a missing workspace, it cannot stop being true.
+            // Read fresh each time rather than snapshotted once: the loop below awaits a
+            // real `startInteractive()` per entry, so by the tenth entry a snapshot taken
+            // here is tens of seconds old, and a conversation the user resumed by hand in
+            // that window would be invisible to it.
+            const liveSessionIds = () => new Set(ctx.sessions.keys());
+            const liveConversationIds = () => new Set([...ctx.sessions.values()].map((session) => session.claudeSessionId).filter((id) => !!id));
+            const { restore, skipped } = rejectAlreadyLive(taken, liveSessionIds(), liveConversationIds());
+            for (const entry of taken) {
+                if (skipped.some((s) => s.sessionId === entry.sessionId))
+                    unspent.delete(entry);
+            }
+            const restored = [];
+            const failures = [...skipped];
+            const workspaceHooksEnabled = await ctx.getWorkspaceHooksEnabled();
+            for (const entry of restore) {
+                // The already-live check, re-run against the board as it is NOW. The pass
+                // above decided the batch; this catches a conversation that went live while
+                // an earlier entry in this same batch was starting. Spent rather than
+                // returned to the plan, for the same reason as the batch pass: unlike a
+                // missing workspace or a withdrawn grant, an open conversation is not a
+                // condition that stops being true.
+                const [lateLive] = rejectAlreadyLive([entry], liveSessionIds(), liveConversationIds()).skipped;
+                if (lateLive) {
+                    failures.push(lateLive);
+                    unspent.delete(entry);
+                    continue;
+                }
+                // Capacity is re-checked per iteration, because this loop is itself
+                // creating the sessions it counts. The offer can be a day old, so the
+                // board may be fuller now than the plan assumed.
+                const capMsg = sessionCapacityMessage(ctx.sessions, entry.owner);
+                if (capMsg) {
+                    failures.push({ sessionId: entry.sessionId, reason: 'capacity-reached' });
+                    continue;
+                }
+                // A repo can be deleted between the boot that planned this and the click.
+                if (!existsSync(entry.workingDir)) {
+                    failures.push({ sessionId: entry.sessionId, reason: 'workspace-missing' });
+                    continue;
+                }
+                // Multi-user workspace separation: the create route confines a non-admin's
+                // workingDir to their own case space, and a grant can be withdrawn between
+                // the session's creation and this restore, so the confinement is re-run
+                // rather than inherited from the record. Keyed on the OWNER, not on the
+                // caller: an admin spending another user's entry must be held to that
+                // user's confinement, and `isWorkingDirAllowed` would wave an admin
+                // through. The same reason the two grant re-checks below read
+                // `saved.owner`.
+                if (!(await isWorkingDirAllowedForUsername(entry.owner, entry.workingDir))) {
+                    // Left on offer: a withdrawn grant can be restored, unlike an already-open
+                    // conversation, so this is not the permanent kind of refusal.
+                    failures.push({ sessionId: entry.sessionId, reason: 'workspace-forbidden' });
+                    continue;
+                }
+                try {
+                    const saved = entry.state;
+                    const claudeModeConfig = await ctx.getClaudeModeConfig();
+                    const session = new Session({
+                        // The old id is reused on purpose: a pinned record, subagent parents,
+                        // window states and the lifecycle log all key off it, and the unpinned
+                        // record is gone, so there is nothing to collide with.
+                        id: saved.id,
+                        workingDir: saved.workingDir,
+                        mode: saved.mode,
+                        name: saved.name,
+                        // Without this the constructor re-infers ownership from the name, so a
+                        // session the user renamed by hand to something shaped like `w<n>-<case>`
+                        // comes back as `placeholder` and auto-naming overwrites their name on
+                        // the next prompt. The route persists below, so the loss would go to
+                        // disk. `restoreMuxSessions()` passes it for the same reason.
+                        nameSource: saved.nameSource,
+                        createdAt: saved.createdAt,
+                        mux: ctx.mux,
+                        useMux: true,
+                        // No `muxSession`: the reboot took the pane with it, so `startInteractive()`
+                        // takes its create branch and makes a fresh one.
+                        claudeMode: await resolveClaudeModeForUsername(claudeModeConfig.claudeMode, saved.owner),
+                        allowedTools: claudeModeConfig.allowedTools,
+                        resumeSessionId: entry.resumeConversationId,
+                        // Re-resolved against the owner's CURRENT grant, never replayed from the
+                        // record: a grant held when the record was written may be gone now.
+                        envOverrides: await clampEnvOverridesForOwner(saved.owner, saved.__envOverrides),
+                        effort: saved.effort,
+                        attachmentHistory: saved.__attachmentHistory ??
+                            saved.attachmentHistory,
+                        lastSubmitAt: saved.lastSubmitAt,
+                        claudeSessionChain: saved.claudeSessionChain,
+                        lastActivityAt: saved.lastActivityAt,
+                        owner: saved.owner,
+                        parentSessionId: saved.parentSessionId,
+                    });
+                    await ctx.addSession(session);
+                    // Before the listeners, because setupSessionListeners() reads the
+                    // image-watcher flag this phase restores; before the spawn, because the
+                    // custom-model environment and the nice priority shape the process.
+                    await ctx.reapplyPersistedSessionState(session, saved, 'before-spawn');
+                    await ctx.setupSessionListeners(session);
+                    await session.startInteractive();
+                    // The session's own history, applied only once the pane exists: on a
+                    // failed start these totals would belong to a session that never ran.
+                    // Both halves precede the route's OWN persist, which matters because a
+                    // constructed session carries none of this and `toState()` is written
+                    // wholesale, so persisting first would replace the fuller record with
+                    // the reduced one and drop the pin that keeps it from being pruned. A
+                    // listener-driven persist can still land inside the debounce window
+                    // while the pane starts; the write below repairs the record.
+                    // `rearmAutoResumeSchedule: false`: the saved stamp predates the reboot and
+                    // the pane is new, so honouring it would have every restored session type
+                    // `continue` into itself about a minute after one click. Auto-resume stays
+                    // enabled and re-arms on the next real limit message. This is also what the
+                    // module header promises ("comes back attached, idle and disarmed").
+                    await ctx.reapplyPersistedSessionState(session, saved, 'after-spawn', {
+                        rearmAutoResumeSchedule: false,
+                    });
+                    ctx.persistSessionState(session);
+                    // A session without its workspace hooks goes silently blind: no stop or
+                    // idle events for respawn, no Approvals Inbox item, no red tab on a
+                    // blocking dialog. The boot-time sweep finished hours ago, so the click
+                    // path installs them itself. `hooks: 'always'` is the capability that says
+                    // this CLI installs Codeman's hooks into the workspace.
+                    if (workspaceHooksEnabled && getCli(session.mode)?.capabilities.hooks === 'always') {
+                        await applyWorkspaceHooks(session.workingDir, true).catch((err) => console.warn(`[reboot-restore] hook install failed for ${session.workingDir}: ${getErrorMessage(err)}`));
+                    }
+                    // Both create paths seed this; without it a restored claude session's agent
+                    // skill falls back to writing out the whole ~150-line §0 preamble. Remote and
+                    // docker sessions never reach here (the plan rejects them as
+                    // `remote-or-docker`), so the local-only condition is structural.
+                    if (getCli(session.mode)?.capabilities.agentSkillInjection && (await ctx.getAgentSkillEnabled())) {
+                        await seedAgentSessionPreamble(session.id).catch((err) => console.warn(`[agent-skill] preamble seed failed for ${session.id}: ${getErrorMessage(err)}`));
+                    }
+                    getLifecycleLog().log({ event: 'recovered', sessionId: session.id, name: session.name });
+                    // Every other open tab and phone needs this; the clicking tab already has
+                    // the response, and the client's handler is an idempotent upsert.
+                    ctx.broadcast(SseEvent.SessionCreated, ctx.getSessionStateWithRespawn(session));
+                    restored.push(toBannerItem(entry));
+                }
+                catch (err) {
+                    // One entry that will not start must not stop the rest of the pass, and
+                    // must not leave a registered session with no pane behind it: by this
+                    // point the session is in `ctx.sessions`, holds a tab-layout slot and has
+                    // listeners.
+                    //
+                    // Reaching this is rarer than it looks, measured against a real server:
+                    // the CLI resolver finds its binary by absolute path rather than through
+                    // PATH, and tmux falls back to another directory rather than failing when
+                    // it cannot enter the workspace, so neither of the two obvious "freshly
+                    // booted machine" failures throws. What is left is the mux layer itself
+                    // failing, which is why this path is defended rather than expected.
+                    console.error(`[reboot-restore] failed to rebuild ${entry.sessionId}:`, err);
+                    // Not cleanupSession(): that is the user-initiated delete, and it would
+                    // count this session's historical tokens into the lifetime totals, demote
+                    // a pinned record to `stopped` (which this pass reads as an intentional
+                    // kill, making the session permanently unrestorable) and delete the
+                    // workspace's `.claude-images`. This undoes only the construction.
+                    await ctx
+                        .discardPartiallyBuiltSession(entry.sessionId)
+                        .catch((discardErr) => console.error(`[reboot-restore] discarding a failed rebuild failed: ${getErrorMessage(discardErr)}`));
+                    failures.push({ sessionId: entry.sessionId, reason: 'rebuild-failed' });
+                    // Left on offer: the user can put the binary back and click again.
+                    continue;
+                }
+                unspent.delete(entry);
+            }
+            if (restored.length > 0) {
+                // A reboot leaves recovery with nothing alive to find, so its own block never
+                // started the stats collector. This clears and re-arms its interval, so it is
+                // safe to call whether or not the collector is already running.
+                ctx.mux.startStatsCollection(STATS_COLLECTION_INTERVAL_MS);
+            }
+            return { restored, skipped: failures };
+        }
+        finally {
+            // Anything that never became a pane goes back on offer, including after a
+            // throw, so a transient failure costs a retry rather than the whole plan.
+            // Ends the flight: entries still parked for it come back if they are in
+            // `unspent`, and a Dismiss that unparked them meanwhile wins.
+            rebootRestoreRegistry.releaseFlight(owner, [...unspent]);
+            rebootRestoreRegistry.endSpending(owner);
+        }
+    });
+    // ========== Drop it ==========
+    app.post('/api/reboot-restore/dismiss', async (req) => {
+        const dismissed = rebootRestoreRegistry.clear(accessorFor(req));
+        return { dismissed };
+    });
+}
+//# sourceMappingURL=reboot-restore-routes.js.map

package/dist/web/routes/reboot-restore-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reboot-restore-routes.js","sourceRoot":"","sources":["../../../src/web/routes/reboot-restore-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,EACL,SAAS,EACT,WAAW,EACX,cAAc,EACd,QAAQ,EACR,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAAwD,MAAM,yBAAyB,CAAC;AAClH,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,MAAM,EAAE,MAAM,uCAAuC,CAAC;AAC/D,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,4BAA4B,EAAE,MAAM,+BAA+B,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAM5C,8FAA8F;AAC9F,SAAS,YAAY,CAAC,KAAyB;IAC7C,OAAO;QACL,EAAE,EAAE,KAAK,CAAC,SAAS;QACnB,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAoB,EAAE,GAAqB;IACrF,MAAM,WAAW,GAAG,CAAC,GAAsC,EAAE,EAAE;QAC7D,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,CAAC,KAAyB,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACpE,CAAC,CAAC;IAEF,yCAAyC;IAEzC,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3C,MAAM,OAAO,GAAG,qBAAqB,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7D,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;YACnC,4EAA4E;YAC5E,wEAAwE;YACxE,kBAAkB,EAAE,KAAK;SAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,iCAAiC;IAEjC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,0BAA0B,EAAE,GAAG,CAAC,IAAI,EAAE,gCAAgC,CAAC,CAAC;QAC/F,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QAE5B,0EAA0E;QAC1E,2EAA2E;QAC3E,gFAAgF;QAChF,IAAI,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAE7D,8EAA8E;YAC9E,4EAA4E;YAC5E,4EAA4E;YAC5E,8EAA8E;YAC9E,6EAA6E;YAC7E,8EAA8E;YAC9E,8EAA8E;YAC9E,wCAAwC;YACxC,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YAC1D,MAAM,mBAAmB,GAAG,GAAG,EAAE,CAC/B,IAAI,GAAG,CACL,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACxG,CAAC;YACJ,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/F,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;gBAC1B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC;oBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAClF,CAAC;YAED,MAAM,QAAQ,GAAsC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAA6B,CAAC,GAAG,OAAO,CAAC,CAAC;YACxD,MAAM,qBAAqB,GAAG,MAAM,GAAG,CAAC,wBAAwB,EAAE,CAAC;YAEnE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,0EAA0E;gBAC1E,4EAA4E;gBAC5E,sEAAsE;gBACtE,wEAAwE;gBACxE,wEAAwE;gBACxE,mCAAmC;gBACnC,MAAM,CAAC,QAAQ,CAAC,GAAG,iBAAiB,CAAC,CAAC,KAAK,CAAC,EAAE,cAAc,EAAE,EAAE,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC;gBAC/F,IAAI,QAAQ,EAAE,CAAC;oBACb,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;oBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBACtB,SAAS;gBACX,CAAC;gBACD,oEAAoE;gBACpE,sEAAsE;gBACtE,iDAAiD;gBACjD,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;gBACjE,IAAI,MAAM,EAAE,CAAC;oBACX,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC1E,SAAS;gBACX,CAAC;gBACD,0EAA0E;gBAC1E,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;oBAC3E,SAAS;gBACX,CAAC;gBACD,2EAA2E;gBAC3E,2EAA2E;gBAC3E,wEAAwE;gBACxE,wEAAwE;gBACxE,sEAAsE;gBACtE,oEAAoE;gBACpE,8DAA8D;gBAC9D,iBAAiB;gBACjB,IAAI,CAAC,CAAC,MAAM,8BAA8B,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;oBAC3E,2EAA2E;oBAC3E,8DAA8D;oBAC9D,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;oBAC7E,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;oBAC1B,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,mBAAmB,EAAE,CAAC;oBACzD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC;wBAC1B,sEAAsE;wBACtE,uEAAuE;wBACvE,uDAAuD;wBACvD,EAAE,EAAE,KAAK,CAAC,EAAE;wBACZ,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,uEAAuE;wBACvE,0EAA0E;wBAC1E,uEAAuE;wBACvE,qEAAqE;wBACrE,8DAA8D;wBAC9D,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;wBAC1B,GAAG,EAAE,GAAG,CAAC,GAAG;wBACZ,MAAM,EAAE,IAAI;wBACZ,6EAA6E;wBAC7E,iDAAiD;wBACjD,UAAU,EAAE,MAAM,4BAA4B,CAAC,gBAAgB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC;wBACxF,YAAY,EAAE,gBAAgB,CAAC,YAAY;wBAC3C,eAAe,EAAE,KAAK,CAAC,oBAAoB;wBAC3C,yEAAyE;wBACzE,oEAAoE;wBACpE,YAAY,EAAE,MAAM,yBAAyB,CAC3C,KAAK,CAAC,KAAK,EACV,KAAqD,CAAC,cAAc,CACtE;wBACD,MAAM,EAAE,KAAK,CAAC,MAAM;wBACpB,iBAAiB,EACd,KAAkE,CAAC,mBAAmB;4BACvF,KAAK,CAAC,iBAAiB;wBACzB,YAAY,EAAE,KAAK,CAAC,YAAY;wBAChC,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;wBAC5C,cAAc,EAAE,KAAK,CAAC,cAAc;wBACpC,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,eAAe,EAAE,KAAK,CAAC,eAAe;qBACvC,CAAC,CAAC;oBAEH,MAAM,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAC9B,kEAAkE;oBAClE,wEAAwE;oBACxE,oEAAoE;oBACpE,MAAM,GAAG,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC;oBACvE,MAAM,GAAG,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;oBACzC,MAAM,OAAO,CAAC,gBAAgB,EAAE,CAAC;oBACjC,qEAAqE;oBACrE,sEAAsE;oBACtE,uEAAuE;oBACvE,sEAAsE;oBACtE,sEAAsE;oBACtE,sEAAsE;oBACtE,oEAAoE;oBACpE,6DAA6D;oBAC7D,4EAA4E;oBAC5E,0EAA0E;oBAC1E,2EAA2E;oBAC3E,4EAA4E;oBAC5E,qEAAqE;oBACrE,MAAM,GAAG,CAAC,4BAA4B,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE;wBACpE,uBAAuB,EAAE,KAAK;qBAC/B,CAAC,CAAC;oBACH,GAAG,CAAC,mBAAmB,CAAC,OAAO,CAAC,CAAC;oBAEjC,wEAAwE;oBACxE,oEAAoE;oBACpE,wEAAwE;oBACxE,2EAA2E;oBAC3E,wDAAwD;oBACxD,IAAI,qBAAqB,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;wBACnF,MAAM,mBAAmB,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CACzE,OAAO,CAAC,IAAI,CAAC,4CAA4C,OAAO,CAAC,UAAU,KAAK,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CACxG,CAAC;oBACJ,CAAC;oBAED,4EAA4E;oBAC5E,8EAA8E;oBAC9E,6DAA6D;oBAC7D,kEAAkE;oBAClE,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,mBAAmB,IAAI,CAAC,MAAM,GAAG,CAAC,oBAAoB,EAAE,CAAC,EAAE,CAAC;wBACjG,MAAM,wBAAwB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAChE,OAAO,CAAC,IAAI,CAAC,0CAA0C,OAAO,CAAC,EAAE,KAAK,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAC9F,CAAC;oBACJ,CAAC;oBAED,eAAe,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBACzF,0EAA0E;oBAC1E,kEAAkE;oBAClE,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;oBAChF,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBACrC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,wEAAwE;oBACxE,sEAAsE;oBACtE,0EAA0E;oBAC1E,aAAa;oBACb,EAAE;oBACF,wEAAwE;oBACxE,yEAAyE;oBACzE,0EAA0E;oBAC1E,wEAAwE;oBACxE,wEAAwE;oBACxE,oEAAoE;oBACpE,OAAO,CAAC,KAAK,CAAC,sCAAsC,KAAK,CAAC,SAAS,GAAG,EAAE,GAAG,CAAC,CAAC;oBAC7E,wEAAwE;oBACxE,0EAA0E;oBAC1E,wEAAwE;oBACxE,oEAAoE;oBACpE,mEAAmE;oBACnE,MAAM,GAAG;yBACN,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC;yBAC7C,KAAK,CAAC,CAAC,UAAmB,EAAE,EAAE,CAC7B,OAAO,CAAC,KAAK,CAAC,wDAAwD,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CACrG,CAAC;oBACJ,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;oBACxE,mEAAmE;oBACnE,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;YAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,8EAA8E;gBAC9E,8EAA8E;gBAC9E,gEAAgE;gBAChE,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,4BAA4B,CAAC,CAAC;YAC7D,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QACzC,CAAC;gBAAS,CAAC;YACT,0EAA0E;YAC1E,0EAA0E;YAC1E,wEAAwE;YACxE,8DAA8D;YAC9D,qBAAqB,CAAC,aAAa,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;YACzD,qBAAqB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,gCAAgC;IAEhC,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACpD,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QAChE,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/web/routes/session-routes.d.ts

@@ -5,6 +5,7 @@
  */
 import { FastifyInstance } from 'fastify';
 import { type SessionMode, type CodexConfig, type GeminiConfig, type AntigravityConfig, type PiConfig, type GrokConfig, type DeepSeekConfig, type OmpConfig } from '../../types.js';
+import { clampEnvOverridesForOwner } from '../../session-env-clamp.js';
 import type { SessionPort, EventPort, ConfigPort, InfraPort, AuthPort, TabLayoutPort } from '../ports/index.js';
 /**
  * Strip redundant Ink spinner/status-bar redraw frames from the terminal buffer.
@@ -49,23 +50,6 @@ export declare function _clampExternalCliBypassForOwner(owner: string | undefine
     grokConfig: GrokConfig | undefined;
     deepSeekConfig: DeepSeekConfig | undefined;
 }>;
-/**
- * Env-var half of the multi-user bypass clamp.
- *
- * `clampExternalCliBypassForOwner()` clamps the per-CLI CONFIG, and for every CLI
- * but DeepSeek that is the whole story. Here it is not: `applyEnvOverrides()` runs
- * AFTER `_configureCliEnv()` in tmux-manager, so an override sent on the SAME
- * request lands last and wins, and a non-granted owner could restore
- * `danger-full-access` on the very request the config clamp downgraded.
- *
- * Keys are DROPPED rather than rewritten: dropping falls through to what
- * `_configureCliEnv()` exports, which is the clamped config and the server's own
- * `DSH_HOME`, i.e. exactly the intended state. No-op in single-user mode and for a
- * granted owner, like every other clamp here
- * (`canUsernameRunPrivilegedCommands()` returns true when `!isMultiUserMode()`),
- * and it returns the caller's own object untouched when there is nothing to strip.
- */
-declare function clampEnvOverridesForOwner(owner: string | undefined, envOverrides: Record<string, string> | undefined): Promise<Record<string, string> | undefined>;
 /** Test hook: the env-var half of the same multi-user safety gate. */
 export declare const _clampEnvOverridesForOwner: typeof clampEnvOverridesForOwner;
 /** Test seam: pane-liveness state is module-level, so a suite must be able to reset it. */
@@ -86,5 +70,4 @@ export declare function _paneDeathWatcherCount(): number;
  */
 export declare function resolveOmpConfigForCreate(mode: SessionMode, workingDir: string, ompConfig: OmpConfig | undefined): OmpConfig | undefined;
 export declare function registerSessionRoutes(app: FastifyInstance, ctx: SessionPort & EventPort & ConfigPort & InfraPort & AuthPort & TabLayoutPort): void;
-export {};
 //# sourceMappingURL=session-routes.d.ts.map

package/dist/web/routes/session-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/session-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,SAAS,CAAC;AAS7D,OAAO,EAOL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AA+FxB,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA0EhH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA0C1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAmCvE;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAiBhF;AAGD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAoED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC;IACT,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IACrC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IACvC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;CAC5C,CAAC,CAiBD;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,iBAAe,yBAAyB,CACtC,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,GAC/C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC,CAQ7C;AAED,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,kCAA4B,CAAC;AA8LpE,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA2ED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GAAG,SAAS,GAC/B,SAAS,GAAG,SAAS,CAYvB;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAC/E,IAAI,CA00HN"}
+{"version":3,"file":"session-routes.d.ts","sourceRoot":"","sources":["../../../src/web/routes/session-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAqB,MAAM,SAAS,CAAC;AAS7D,OAAO,EAOL,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,SAAS,EACf,MAAM,gBAAgB,CAAC;AA6DxB,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAmCvE,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA0EhH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA0C1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAmCvE;AAWD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAiBhF;AAGD,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C;AAoED;;;;;;;GAOG;AACH,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,WAAW,CAAC,EAAE,WAAW,EACzB,YAAY,CAAC,EAAE,YAAY,EAC3B,iBAAiB,CAAC,EAAE,iBAAiB,EACrC,QAAQ,CAAC,EAAE,QAAQ,EACnB,UAAU,CAAC,EAAE,UAAU,EACvB,cAAc,CAAC,EAAE,cAAc,GAC9B,OAAO,CAAC;IACT,WAAW,EAAE,WAAW,GAAG,SAAS,CAAC;IACrC,YAAY,EAAE,YAAY,GAAG,SAAS,CAAC;IACvC,iBAAiB,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACjD,QAAQ,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,UAAU,EAAE,UAAU,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,cAAc,GAAG,SAAS,CAAC;CAC5C,CAAC,CAiBD;AAED,sEAAsE;AACtE,eAAO,MAAM,0BAA0B,kCAA4B,CAAC;AA8LpE,2FAA2F;AAC3F,wBAAgB,uBAAuB,IAAI,IAAI,CAI9C;AAED,+EAA+E;AAC/E,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C;AA2ED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,WAAW,EACjB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,SAAS,GAAG,SAAS,GAC/B,SAAS,GAAG,SAAS,CAYvB;AAED,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,eAAe,EACpB,GAAG,EAAE,WAAW,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAC/E,IAAI,CA00HN"}

package/dist/web/routes/session-routes.js

@@ -25,6 +25,7 @@ import { clampWaitMs, MAX_BUFFER_SCAN_BYTES } from '../../config/agent-wait.js';
 import { autoConfigureRalph, canAccessOwned, CASES_DIR, findPersistedSessionOrFail, findSessionOrFail, getAuthUser, isAdmin, isWorkingDirAllowed, ownerFor, parseBody, persistAndBroadcastSession, resolveAgentCaseOrigin, resolveCasesDir, resolveParentSessionId, sessionCapacityMessage, SETTINGS_PATH, validatePathWithinBase, } from '../route-helpers.js';
 import { buildAgentCaseMarker, writeAgentCaseMarker } from '../../agent-case-marker.js';
 import { canUsernameRunPrivilegedCommands, resolveClaudeModeForUsername } from '../../user-store.js';
+import { clampEnvOverridesForOwner } from '../../session-env-clamp.js';
 import { enabledClis, getCli } from '../../config/cli-registry/registry.js';
 import { resolveCliLaunchError } from '../../utils/cli-launcher.js';
 import { legacyConfigForMode } from '../../session-cli-registry-bridge.js';
@@ -301,71 +302,6 @@ export async function _clampExternalCliBypassForOwner(owner, codexConfig, gemini
     });
     return out;
 }
-/**
- * Env-var keys a non-granted owner must not be able to set, because each one
- * hands back privilege the config clamp above just removed, or redirects a
- * credential-resolution endpoint.
- *
- * The DeepSeek three are reachable because `DSH_*` and `DEEPSEEK_*` are
- * allowlisted `envOverrides` prefixes (schemas.ts) — which they have to be, since
- * that is also how a user configures the harness's non-privileged knobs.
- *
- * - `DSH_PERMISSION_MODE` IS the harness's permission switch. Every other CLI's
- *   bypass is a command-line FLAG, reachable only through the per-CLI config the
- *   clamp already owns; this one is an env var, so the config clamp alone is
- *   half a gate.
- * - `DSH_HOME` points the launcher at a profile tree, and a profile's plugin code
- *   executes at BOOT, before any approval row can apply. A user who can write a
- *   workspace can put a profile in it, so this is the wider of the two.
- * - `DEEPSEEK_BASE_URL` aims the provider endpoint, and `_configureCliEnv()`
- *   forwards the SERVER's own `DEEPSEEK_API_KEY` into every dsh pane before
- *   `applyEnvOverrides()` runs — so a non-granted owner who could set the base
- *   URL would have the operator's API key sent as a bearer credential to a host
- *   of their choosing. (`DEEPSEEK_API_KEY` itself stays overridable: supplying
- *   your OWN key removes privilege rather than granting it.)
- * - `OMP_AUTH_BROKER_URL`/`OMP_AUTH_BROKER_TOKEN` are where omp resolves
- *   credentials from — the same shape as `DEEPSEEK_BASE_URL` above, reachable
- *   because `OMP_*` is an allowlisted prefix. Unlike DeepSeek, Codeman does not
- *   forward any operator-held key into an omp pane today (omp's provider
- *   credentials live in `~/.omp` config files, not env vars), so there is no
- *   known concrete exfiltration path yet — clamped defensively anyway, since a
- *   non-granted owner redirecting where a shared multi-tenant deployment
- *   resolves auth from is not something to allow silently (found in
- *   Ark0N/Codeman#353 review; omp's own knobs are otherwise mostly `PI_*`,
- *   already allowlisted for pi and not addressed here — see resolveOmpHome()).
- */
-function ownerClampedEnvKeys() {
-    return enabledClis().flatMap((entry) => entry.capabilities.privilegedEnvKeys);
-}
-/**
- * Env-var half of the multi-user bypass clamp.
- *
- * `clampExternalCliBypassForOwner()` clamps the per-CLI CONFIG, and for every CLI
- * but DeepSeek that is the whole story. Here it is not: `applyEnvOverrides()` runs
- * AFTER `_configureCliEnv()` in tmux-manager, so an override sent on the SAME
- * request lands last and wins, and a non-granted owner could restore
- * `danger-full-access` on the very request the config clamp downgraded.
- *
- * Keys are DROPPED rather than rewritten: dropping falls through to what
- * `_configureCliEnv()` exports, which is the clamped config and the server's own
- * `DSH_HOME`, i.e. exactly the intended state. No-op in single-user mode and for a
- * granted owner, like every other clamp here
- * (`canUsernameRunPrivilegedCommands()` returns true when `!isMultiUserMode()`),
- * and it returns the caller's own object untouched when there is nothing to strip.
- */
-async function clampEnvOverridesForOwner(owner, envOverrides) {
-    if (!envOverrides)
-        return envOverrides;
-    const keys = ownerClampedEnvKeys();
-    if (!keys.some((key) => key in envOverrides))
-        return envOverrides;
-    if (await canUsernameRunPrivilegedCommands(owner))
-        return envOverrides;
-    const clamped = { ...envOverrides };
-    for (const key of keys)
-        delete clamped[key];
-    return clamped;
-}
 /** Test hook: the env-var half of the same multi-user safety gate. */
 export const _clampEnvOverridesForOwner = clampEnvOverridesForOwner;
 // ═══════════════════════════════════════════════════════════════