aicodeman 1.4.0 → 1.5.0

package/dist/web/routes/session-routes.js

@@ -13,7 +13,9 @@ import { ApiErrorCode, createErrorResponse, getErrorMessage, } from '../../types
 import { Session, isAltScreenStripMode } from '../../session.js';
 import { SseEvent } from '../sse-events.js';
 import { CreateSessionSchema, SessionNameSchema, SessionColorSchema, RunPromptSchema, SessionInputWithLimitSchema, ResizeSchema, AutoClearSchema, AutoCompactSchema, AutoResumeSchema, ImageWatcherSchema, FlickerFilterSchema, QuickRunSchema, QuickStartSchema, InteractiveStartSchema, } from '../schemas.js';
-import { autoConfigureRalph, CASES_DIR, findSessionOrFail, parseBody, persistAndBroadcastSession, SETTINGS_PATH, validatePathWithinBase, } from '../route-helpers.js';
+import { autoConfigureRalph, canAccessOwned, CASES_DIR, findSessionOrFail, getAuthUser, isAdmin, isWorkingDirAllowed, ownerFor, parseBody, persistAndBroadcastSession, resolveCasesDir, sessionCapacityMessage, SETTINGS_PATH, validatePathWithinBase, } from '../route-helpers.js';
+import { canUsernameRunPrivilegedCommands, resolveClaudeModeForUsername } from '../../user-store.js';
+import { isMultiUserMode } from '../../config/multiuser.js';
 import { AUTH_COOKIE_NAME } from '../middleware/auth.js';
 import { writeHooksConfig, updateCaseModel, stripCaseEnvKeys, applyStatusLineConfig, refreshStaleHookSecret, } from '../../hooks-config.js';
 import { generateClaudeMd } from '../../templates/claude-md.js';
@@ -21,13 +23,12 @@ import { imageWatcher } from '../../image-watcher.js';
 import { convertHeicToJpeg } from '../heic-jpeg-converter.js';
 import { getLifecycleLog } from '../../session-lifecycle-log.js';
 import { mergeUnifiedSessions, filterAndPaginate, } from '../../services/unified-session-service.js';
-import { MAX_CONCURRENT_SESSIONS } from '../../config/map-limits.js';
 import { RunSummaryTracker } from '../../run-summary.js';
 import { MAX_INPUT_LENGTH, MAX_SESSION_NAME_LENGTH } from '../../config/terminal-limits.js';
 import { MAX_PASTE_IMAGE_BYTES } from '../../config/buffer-limits.js';
 import { dataPath, getDataDir } from '../../config/instance.js';
 import { checkRemoteTmuxAvailable, readRemoteCases, readRemoteHosts, toSessionRemote } from '../../remote-hosts.js';
-import { checkDockerAvailable, checkDockerTmuxAvailable, readDockerCases, readDockerHosts, toSessionDocker, } from '../../docker-hosts.js';
+import { checkDockerAvailable, checkDockerTmuxAvailable, ensureAgentBaseImage, DEFAULT_AGENT_IMAGE, readDockerCases, readDockerHosts, toSessionDocker, } from '../../docker-hosts.js';
 import { LRUMap } from '../../utils/lru-map.js';
 // Path to linked-cases registry (same file used by case-routes resolveCasePath)
 const LINKED_CASES_FILE = dataPath('linked-cases.json');
@@ -197,6 +198,25 @@ export function consumePasteToken(key, now = Date.now()) {
 export function _resetPasteRateBuckets() {
     pasteRateBuckets.clear();
 }
+/**
+ * Security (multi-user §6.3): the Claude-only permission-mode downgrade does not
+ * cover the other CLIs' bypass switches. Codex `--dangerously-bypass-approvals-and-sandbox`
+ * and Gemini `--approval-mode yolo` disable the safety classifier the non-granted-user
+ * downgrade is meant to keep on, so clamp them for a non-granted owner. buildGeminiCommand
+ * defaults an ABSENT approvalMode to yolo, so the gemini config must be MATERIALIZED
+ * (auto_edit) even when the request sent none. No-op in single-user mode / for a granted
+ * owner (canUsernameRunPrivilegedCommands returns true when !isMultiUserMode()).
+ */
+async function clampExternalCliBypassForOwner(owner, codexConfig, geminiConfig) {
+    const granted = await canUsernameRunPrivilegedCommands(owner);
+    if (granted)
+        return { codexConfig, geminiConfig };
+    // Non-granted: force codex bypass off (only meaningful when a config was sent) and
+    // materialize gemini to auto_edit (clamps an explicit 'yolo' and the yolo default).
+    const clampedCodex = codexConfig ? { ...codexConfig, dangerouslyBypassApprovals: false } : codexConfig;
+    const clampedGemini = { ...(geminiConfig ?? {}), approvalMode: 'auto_edit' };
+    return { codexConfig: clampedCodex, geminiConfig: clampedGemini };
+}
 export function registerSessionRoutes(app, ctx) {
     // ═══════════════════════════════════════════════════════════════
     // Auth
@@ -215,17 +235,36 @@ export function registerSessionRoutes(app, ctx) {
     // Session CRUD (list, create, rename, color, delete, detail)
     // ═══════════════════════════════════════════════════════════════
     // ========== Session Listing ==========
-    app.get('/api/sessions', async () => {
-        return ctx.getLightSessionsState();
+    app.get('/api/sessions', async (req) => {
+        const list = ctx.getLightSessionsState();
+        if (!isMultiUserMode())
+            return list;
+        const user = getAuthUser(req);
+        if (user.role === 'admin')
+            return list;
+        return list.filter((s) => canAccessOwned(user, s.owner));
     });
     // ========== Session Creation ==========
     app.post('/api/sessions', async (req) => {
-        // Prevent unbounded session creation
-        if (ctx.sessions.size >= MAX_CONCURRENT_SESSIONS) {
-            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Maximum concurrent sessions (${MAX_CONCURRENT_SESSIONS}) reached. Delete some sessions first.`);
-        }
+        const owner = ownerFor(req);
+        // Global + per-user session cap.
+        const capMsg = sessionCapacityMessage(ctx.sessions, owner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, capMsg);
         const body = parseBody(CreateSessionSchema, req.body);
         const workingDir = body.workingDir || process.cwd();
+        // Multi-user: shell mode is arbitrary command execution as the host account,
+        // gated behind the same grant as bypass (section 6.3). Resolve the owner's grant
+        // from the store so a GRANTED regular user is not wrongly denied (AuthUser role alone can't tell).
+        if (body.mode === 'shell' && !(await canUsernameRunPrivilegedCommands(owner))) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'Shell sessions require the can-bypass-permissions grant');
+        }
+        // Multi-user linchpin (section 6.2): a non-admin's workingDir must resolve
+        // inside their own case space. Enforced BEFORE any disk-mutating call below so
+        // a foreign path can never be written into.
+        if (!isWorkingDirAllowed(getAuthUser(req), workingDir)) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'workingDir is outside your workspace');
+        }
         // Validate workingDir exists and is a directory
         if (body.workingDir) {
             try {
@@ -243,15 +282,17 @@ export function registerSessionRoutes(app, ctx) {
         // For keys the caller is actively setting, strip any stale disk entry a prior
         // Codeman version may have written. Scope limited to:
         //   - Claude mode (OpenCode/Codex/Gemini don't read .claude/settings.local.json)
-        //   - workingDir inside CASES_DIR (Codeman's managed territory — we never mutate
-        //     .claude/settings.local.json in arbitrary user repos that POST /api/sessions
-        //     can target, because those may have hand-authored values).
+        //   - workingDir inside CASES_DIR / the per-user case space (Codeman's managed
+        //     territory — we never mutate .claude/settings.local.json in arbitrary user
+        //     repos that POST /api/sessions can target, as those may have hand-authored
+        //     values).
+        const managedCasesBase = resolveCasesDir(getAuthUser(req));
         const canStripDisk = body.mode !== 'opencode' &&
             body.mode !== 'codex' &&
             body.mode !== 'gemini' &&
             body.envOverrides &&
             Object.keys(body.envOverrides).length > 0 &&
-            workingDir.startsWith(CASES_DIR + '/');
+            (workingDir.startsWith(CASES_DIR + '/') || workingDir.startsWith(managedCasesBase + '/'));
         if (canStripDisk) {
             await stripCaseEnvKeys(workingDir, Object.keys(body.envOverrides));
         }
@@ -344,6 +385,10 @@ export function registerSessionRoutes(app, ctx) {
                         ? modelConfig?.defaultModel || undefined
                         : undefined;
         const claudeModeConfig = await ctx.getClaudeModeConfig();
+        // Section 6.3: force non-granted users to a classifier-guarded mode.
+        const effectiveClaudeMode = await resolveClaudeModeForUsername(claudeModeConfig.claudeMode, owner);
+        // Section 6.3: clamp Codex/Gemini bypass switches for a non-granted owner (no-op single-user/granted).
+        const { codexConfig: gatedCodexConfig, geminiConfig: gatedGeminiConfig } = await clampExternalCliBypassForOwner(owner, body.codexConfig, body.geminiConfig);
         const terminalHistoryConfig = await ctx.getTerminalHistoryConfig();
         const session = new Session({
             workingDir,
@@ -353,15 +398,16 @@ export function registerSessionRoutes(app, ctx) {
             useMux: true,
             niceConfig: globalNice,
             model,
-            claudeMode: claudeModeConfig.claudeMode,
+            claudeMode: effectiveClaudeMode,
             allowedTools: claudeModeConfig.allowedTools,
             openCodeConfig: mode === 'opencode' ? body.openCodeConfig : undefined,
-            codexConfig: mode === 'codex' ? body.codexConfig : undefined,
-            geminiConfig: mode === 'gemini' ? body.geminiConfig : undefined,
+            codexConfig: mode === 'codex' ? gatedCodexConfig : undefined,
+            geminiConfig: mode === 'gemini' ? gatedGeminiConfig : undefined,
             resumeSessionId: validatedResumeId,
             envOverrides: body.envOverrides,
             effort: body.effort,
             tmuxHistoryLimit: terminalHistoryConfig.tmuxHistoryLimit,
+            owner,
         });
         ctx.addSession(session);
         ctx.store.incrementSessionsCreated();
@@ -378,7 +424,7 @@ export function registerSessionRoutes(app, ctx) {
     app.put('/api/sessions/:id/name', async (req) => {
         const { id } = req.params;
         const body = parseBody(SessionNameSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const name = String(body.name || '').slice(0, MAX_SESSION_NAME_LENGTH);
         session.name = name;
         // Also update the mux session name if applicable
@@ -390,7 +436,7 @@ export function registerSessionRoutes(app, ctx) {
     app.put('/api/sessions/:id/color', async (req) => {
         const { id } = req.params;
         const body = parseBody(SessionColorSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const validColors = ['default', 'red', 'orange', 'yellow', 'green', 'blue', 'purple', 'pink'];
         if (!validColors.includes(body.color)) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid color');
@@ -404,15 +450,19 @@ export function registerSessionRoutes(app, ctx) {
         const { id } = req.params;
         const query = req.query;
         const killMux = query.killMux !== 'false'; // Default to true
-        if (!ctx.sessions.has(id)) {
-            return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Session not found');
-        }
-        await ctx.cleanupSession(id, killMux, 'user_delete');
+        // Security: owner-scoped lookup 404s foreign/missing sessions uniformly (no existence leak, no cross-user kill).
+        const session = findSessionOrFail(ctx, id, req);
+        await ctx.cleanupSession(session.id, killMux, 'user_delete');
         return {};
     });
     // ========== Delete All Sessions ==========
-    app.delete('/api/sessions', async () => {
-        const sessionIds = Array.from(ctx.sessions.keys());
+    app.delete('/api/sessions', async (req) => {
+        // Security: scope the bulk sweep to sessions the caller can access — a non-admin
+        // must not wipe other users' sessions (canAccessOwned is allow-all for admin/single-user).
+        const user = getAuthUser(req);
+        const sessionIds = Array.from(ctx.sessions.values())
+            .filter((s) => canAccessOwned(user, s.owner))
+            .map((s) => s.id);
         let killed = 0;
         for (const id of sessionIds) {
             if (ctx.sessions.has(id)) {
@@ -425,7 +475,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Session Detail ==========
     app.get('/api/sessions/:id', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         // Use light state (no full buffers) — terminal buffer available via /terminal endpoint.
         // Full buffers were 2-3MB and caused slowness when polled frequently (e.g. Ralph wizard).
         return ctx.getSessionStateWithRespawn(session);
@@ -436,7 +486,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Session Output ==========
     app.get('/api/sessions/:id/output', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         return {
             success: true,
             data: {
@@ -449,7 +499,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Ralph State ==========
     app.get('/api/sessions/:id/ralph-state', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         return {
             success: true,
             data: {
@@ -462,7 +512,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Run Summary ==========
     app.get('/api/sessions/:id/run-summary', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const tracker = ctx.runSummaryTrackers.get(id);
         if (!tracker) {
             // Create a fresh tracker if one doesn't exist (shouldn't happen normally)
@@ -477,7 +527,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Active Tools ==========
     app.get('/api/sessions/:id/active-tools', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         return {
             success: true,
             data: {
@@ -492,7 +542,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/run', async (req) => {
         const { id } = req.params;
         const { prompt } = parseBody(RunPromptSchema, req.body);
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -514,7 +564,7 @@ export function registerSessionRoutes(app, ctx) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid request body');
         }
         const { clearBreaker } = bodyResult.data;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -563,7 +613,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Start Shell Mode ==========
     app.post('/api/sessions/:id/shell', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -592,7 +642,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/input', async (req) => {
         const { id } = req.params;
         const { input, useMux, seq, clientId } = parseBody(SessionInputWithLimitSchema, req.body);
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const inputStr = String(input);
         if (inputStr.length > MAX_INPUT_LENGTH) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Input exceeds maximum length (${MAX_INPUT_LENGTH} bytes)`);
@@ -642,7 +692,7 @@ export function registerSessionRoutes(app, ctx) {
         if (!hex) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Key not allowed: ${key}`);
         }
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const muxName = session.muxName;
         if (!muxName) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'No tmux session');
@@ -669,7 +719,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/resize', async (req) => {
         const { id } = req.params;
         const { cols, rows, viewportType, force } = parseBody(ResizeSchema, req.body);
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.resize(cols, rows, { viewportType, force });
         return {};
     });
@@ -755,7 +805,7 @@ export function registerSessionRoutes(app, ctx) {
     }
     app.get('/api/sessions/:id/last-response', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         // Codex sessions don't write to ~/.claude/projects — their transcripts
         // live in ~/.codex/sessions/**. Branch to a Codex-specific reader so the
         // response-viewer works for Codex panes too.
@@ -1182,7 +1232,7 @@ export function registerSessionRoutes(app, ctx) {
     app.get('/api/sessions/:id/terminal', async (req) => {
         const { id } = req.params;
         const query = req.query;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         // `full=1` is the EXPLICIT full-reload signal (COD-47): the browser reloaded
         // the page and wants the whole scroll history back, so we capture the ENTIRE
         // tmux scrollback and the user gets back history that scrolled off Codeman's
@@ -1301,7 +1351,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/auto-clear', async (req) => {
         const { id } = req.params;
         const body = parseBody(AutoClearSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.setAutoClear(body.enabled, body.threshold);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1318,7 +1368,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/auto-compact', async (req) => {
         const { id } = req.params;
         const body = parseBody(AutoCompactSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.setAutoCompact(body.enabled, body.threshold, body.prompt);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1336,7 +1386,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/auto-resume', async (req) => {
         const { id } = req.params;
         const body = parseBody(AutoResumeSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.setAutoResume(body.enabled);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1353,7 +1403,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/image-watcher', async (req) => {
         const { id } = req.params;
         const body = parseBody(ImageWatcherSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (body.enabled) {
             imageWatcher.watchSession(session.id, session.workingDir);
         }
@@ -1374,7 +1424,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/flicker-filter', async (req) => {
         const { id } = req.params;
         const body = parseBody(FlickerFilterSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.flickerFilterEnabled = body.enabled;
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1389,15 +1439,19 @@ export function registerSessionRoutes(app, ctx) {
     // ═══════════════════════════════════════════════════════════════
     // ========== Quick Run ==========
     app.post('/api/run', async (req) => {
-        // Prevent unbounded session creation
-        if (ctx.sessions.size >= MAX_CONCURRENT_SESSIONS) {
-            return createErrorResponse(ApiErrorCode.SESSION_BUSY, `Maximum concurrent sessions (${MAX_CONCURRENT_SESSIONS}) reached`);
-        }
+        const runOwner = ownerFor(req);
+        const capMsg = sessionCapacityMessage(ctx.sessions, runOwner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.SESSION_BUSY, capMsg);
         const { prompt, workingDir, envOverrides: runEnvOverrides, } = parseBody(QuickRunSchema, req.body, 'Invalid request body');
         if (!prompt.trim()) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'prompt is required');
         }
         const dir = workingDir || process.cwd();
+        // Multi-user: confine a non-admin's one-shot working dir to their space.
+        if (!isWorkingDirAllowed(getAuthUser(req), dir)) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'workingDir is outside your workspace');
+        }
         // Validate workingDir exists and is a directory
         if (workingDir) {
             try {
@@ -1410,7 +1464,17 @@ export function registerSessionRoutes(app, ctx) {
                 return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'workingDir does not exist');
             }
         }
-        const session = new Session({ workingDir: dir, envOverrides: runEnvOverrides });
+        // Section 6.3: the one-shot spawn path (runPrompt/buildPromptArgs) respects the
+        // session's claudeMode, so resolve it for the owner (bypass -> auto for non-granted).
+        const runClaudeModeConfig = await ctx.getClaudeModeConfig();
+        const runClaudeMode = await resolveClaudeModeForUsername(runClaudeModeConfig.claudeMode, runOwner);
+        const session = new Session({
+            workingDir: dir,
+            envOverrides: runEnvOverrides,
+            claudeMode: runClaudeMode,
+            allowedTools: runClaudeModeConfig.allowedTools,
+            owner: runOwner,
+        });
         ctx.addSession(session);
         ctx.store.incrementSessionsCreated();
         ctx.persistSessionState(session);
@@ -1437,11 +1501,16 @@ export function registerSessionRoutes(app, ctx) {
     });
     // ========== Quick Start ==========
     app.post('/api/quick-start', async (req) => {
-        // Prevent unbounded session creation
-        if (ctx.sessions.size >= MAX_CONCURRENT_SESSIONS) {
-            return createErrorResponse(ApiErrorCode.SESSION_BUSY, `Maximum concurrent sessions (${MAX_CONCURRENT_SESSIONS}) reached.`);
+        const owner = ownerFor(req);
+        const capMsg = sessionCapacityMessage(ctx.sessions, owner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.SESSION_BUSY, capMsg);
+        const { caseName = 'testcase', sessionName, mode = 'claude', openCodeConfig, codexConfig, geminiConfig, envOverrides, effort, } = parseBody(QuickStartSchema, req.body);
+        // Multi-user: shell mode is arbitrary host-account execution, gated by the grant.
+        // Resolve the owner's grant from the store so a GRANTED regular user is not wrongly denied.
+        if (mode === 'shell' && !(await canUsernameRunPrivilegedCommands(owner))) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'Shell sessions require the can-bypass-permissions grant');
         }
-        const { caseName = 'testcase', mode = 'claude', openCodeConfig, codexConfig, geminiConfig, envOverrides, effort, } = parseBody(QuickStartSchema, req.body);
         // Resolve the remote case FIRST — the CLI executes on the REMOTE host over ssh,
         // so the LOCAL availability gates below (isCodexAvailable() etc.) don't apply and
         // would wrongly reject a machine that hasn't got the CLI installed locally.
@@ -1449,11 +1518,16 @@ export function registerSessionRoutes(app, ctx) {
         let docker = undefined;
         let dockerResumeId;
         let casePath = null;
+        // Security: fold ownership INTO the match (don't early-return) so a NON-OWNED
+        // same-named remote/docker case is skipped and control falls through to the caller's
+        // own LOCAL case — remote/docker names are globally unique but local names are
+        // per-user, so a name collision must not shadow the caller's own case. canAccessOwned
+        // is allow-all for admins/single-user, so flag-OFF stays byte-identical.
         const remoteCases = await readRemoteCases(CODEMAN_CONFIG_DIR);
-        const remoteCase = remoteCases.find((item) => item.name === caseName);
+        const remoteCase = remoteCases.find((item) => item.name === caseName && canAccessOwned(getAuthUser(req), item.owner));
         const dockerCase = remoteCase
             ? undefined
-            : (await readDockerCases(CODEMAN_CONFIG_DIR)).find((item) => item.name === caseName);
+            : (await readDockerCases(CODEMAN_CONFIG_DIR)).find((item) => item.name === caseName && canAccessOwned(getAuthUser(req), item.owner));
         if (remoteCase) {
             const host = (await readRemoteHosts(CODEMAN_CONFIG_DIR)).find((item) => item.id === remoteCase.hostId);
             if (!host)
@@ -1483,7 +1557,7 @@ export function registerSessionRoutes(app, ctx) {
             // Docker case: the CLI executes INSIDE a container via local tmux + `docker
             // exec`, so the LOCAL availability gates below don't apply. Mirror the remote
             // branch's rejection of per-session config that would not cross into the
-            // container (it would silently no-op).
+            // container (it would silently no-op). (Ownership is enforced in the .find above.)
             const host = (await readDockerHosts(CODEMAN_CONFIG_DIR)).find((item) => item.id === dockerCase.hostId);
             if (!host)
                 return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Docker host not found');
@@ -1499,10 +1573,26 @@ export function registerSessionRoutes(app, ctx) {
                 return createErrorResponse(ApiErrorCode.OPERATION_FAILED, availability.error || 'docker daemon is not available');
             }
             const sessionDocker = toSessionDocker(host, dockerCase);
+            // Ensure the base image exists, auto-building the default image on first use so
+            // it is never a blocker. Dedup'd with any build kicked off at case-create, so
+            // this awaits the SAME in-flight build rather than starting a second one.
+            const ensured = await ensureAgentBaseImage(sessionDocker.engine, sessionDocker.image, {
+                onProgress: (line) => ctx.broadcast(SseEvent.DockerImageBuildProgress, { name: dockerCase.name, line }),
+            });
+            if (!ensured.ok) {
+                return createErrorResponse(ApiErrorCode.OPERATION_FAILED, ensured.error || 'base image not available');
+            }
+            if (ensured.built) {
+                ctx.broadcast(SseEvent.DockerImageBuildComplete, { name: dockerCase.name, image: sessionDocker.image });
+            }
             // tmux is a hard prerequisite (the in-container tmux makes reconnect durable).
-            const tmuxCheck = await checkDockerTmuxAvailable(sessionDocker);
-            if (!tmuxCheck.ok) {
-                return createErrorResponse(ApiErrorCode.OPERATION_FAILED, tmuxCheck.error || 'base image is missing tmux');
+            // Skip the extra container-run probe for our OWN default image (the baked
+            // Dockerfile always contains tmux); still verify a custom image.
+            if (sessionDocker.image !== DEFAULT_AGENT_IMAGE) {
+                const tmuxCheck = await checkDockerTmuxAvailable(sessionDocker);
+                if (!tmuxCheck.ok) {
+                    return createErrorResponse(ApiErrorCode.OPERATION_FAILED, tmuxCheck.error || 'base image is missing tmux');
+                }
             }
             casePath = dockerCase.hostWorkspacePath; // a REAL host dir (bind-mounted into the container)
             docker = sessionDocker;
@@ -1545,7 +1635,11 @@ export function registerSessionRoutes(app, ctx) {
             catch {
                 // File missing or unparseable — treat as empty registry
             }
-            casePath = linkedCases[caseName] || validatePathWithinBase(caseName, CASES_DIR);
+            // Multi-user: the linked-cases registry is ownerless/global, so only admins may
+            // resolve a name to an arbitrary linked path. A non-admin resolves inside their
+            // OWN case space only (single-user: isAdmin true, so linked cases still honoured).
+            const linked = isAdmin(req) ? linkedCases[caseName] : undefined;
+            casePath = linked || validatePathWithinBase(caseName, resolveCasesDir(getAuthUser(req)));
             if (!casePath) {
                 return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid case path');
             }
@@ -1553,6 +1647,14 @@ export function registerSessionRoutes(app, ctx) {
         // By this point casePath is guaranteed non-null: for remote cases it was set from remoteCase.remotePath,
         // for local cases the !casePath guard above returned early. TypeScript can't narrow across the if/else.
         const resolvedCasePath = casePath;
+        // Multi-user linchpin (section 6.2): confine the resolved workingDir to the caller's
+        // own case space BEFORE any mkdir/scaffold below creates or mutates it. Applies to
+        // LOCAL and DOCKER cases (docker.hostWorkspacePath is a real host dir the file routes
+        // trust); skipped for REMOTE, whose path is an ssh path that would spuriously fail
+        // realpath confinement. No-op for admins / single-user mode.
+        if (!remote && !isWorkingDirAllowed(getAuthUser(req), resolvedCasePath)) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'case path is outside your workspace');
+        }
         // Create case folder and CLAUDE.md if it doesn't exist (only for non-linked, non-remote,
         // non-docker cases — docker workspaces are scaffolded in their own block below)
         if (!remote && !docker && !existsSync(resolvedCasePath)) {
@@ -1626,19 +1728,24 @@ export function registerSessionRoutes(app, ctx) {
                         ? qsModelConfig?.defaultModel || undefined
                         : undefined;
         const qsClaudeModeConfig = await ctx.getClaudeModeConfig();
+        const qsEffectiveClaudeMode = await resolveClaudeModeForUsername(qsClaudeModeConfig.claudeMode, owner);
+        // Section 6.3: clamp Codex/Gemini bypass switches for a non-granted owner (no-op single-user/granted).
+        const { codexConfig: qsGatedCodexConfig, geminiConfig: qsGatedGeminiConfig } = await clampExternalCliBypassForOwner(owner, codexConfig, geminiConfig);
         const qsTerminalHistoryConfig = await ctx.getTerminalHistoryConfig();
         const session = new Session({
             workingDir: resolvedCasePath,
+            name: sessionName ? sessionName.slice(0, MAX_SESSION_NAME_LENGTH) : '',
             mux: ctx.mux,
             useMux: true,
             mode: mode,
             niceConfig: niceConfig,
             model: qsModel,
-            claudeMode: qsClaudeModeConfig.claudeMode,
+            claudeMode: qsEffectiveClaudeMode,
             allowedTools: qsClaudeModeConfig.allowedTools,
+            owner,
             openCodeConfig: mode === 'opencode' ? openCodeConfig : undefined,
-            codexConfig: mode === 'codex' ? codexConfig : undefined,
-            geminiConfig: mode === 'gemini' ? geminiConfig : undefined,
+            codexConfig: mode === 'codex' ? qsGatedCodexConfig : undefined,
+            geminiConfig: mode === 'gemini' ? qsGatedGeminiConfig : undefined,
             envOverrides,
             effort,
             remote,
@@ -1976,6 +2083,12 @@ export function registerSessionRoutes(app, ctx) {
         const query = req.query;
         const projectsDir = join(process.env.HOME || '/tmp', '.claude', 'projects');
         const headBuf = Buffer.alloc(16384);
+        // Multi-user: this scans the host-wide ~/.claude/projects tree, so a non-admin
+        // must only see history whose decoded workingDir is inside their own case space.
+        // Do NOT trust the caller-supplied projectKey — confine on the decoded path.
+        // No-op for admins / single-user mode.
+        const user = getAuthUser(req);
+        const scopeHistory = isMultiUserMode() && user.role !== 'admin';
         // Single-folder drill-down: when projectKey is provided, scan only that
         // directory, bypass the 50-cap, and honor offset/limit pagination.
         if (query.projectKey) {
@@ -1986,12 +2099,15 @@ export function registerSessionRoutes(app, ctx) {
             const offset = Math.max(0, parseInt(query.offset || '0', 10) || 0);
             const limit = Math.min(100, Math.max(1, parseInt(query.limit || '20', 10) || 20));
             const projPath = join(projectsDir, query.projectKey);
-            const all = await scanProjectDir(projPath, query.projectKey, headBuf);
+            let all = await scanProjectDir(projPath, query.projectKey, headBuf);
+            // Confine to the caller's workspace (a projectKey maps to a single foreign cwd).
+            if (scopeHistory)
+                all = all.filter((r) => isWorkingDirAllowed(user, r.workingDir));
             all.sort((a, b) => new Date(b.lastModified).getTime() - new Date(a.lastModified).getTime());
             return { sessions: all.slice(offset, offset + limit), total: all.length };
         }
         // Global overview: scan all projects, return up to 50 most-recent sessions.
-        const results = [];
+        let results = [];
         try {
             const projectDirs = await fs.readdir(projectsDir);
             for (const projDir of projectDirs) {
@@ -2003,6 +2119,9 @@ export function registerSessionRoutes(app, ctx) {
         catch {
             // Projects dir may not exist
         }
+        // Multi-user: drop rows outside the non-admin caller's own case space.
+        if (scopeHistory)
+            results = results.filter((r) => isWorkingDirAllowed(user, r.workingDir));
         results.sort((a, b) => new Date(b.lastModified).getTime() - new Date(a.lastModified).getTime());
         return { sessions: results.slice(0, 50) };
     });
@@ -2099,7 +2218,32 @@ export function registerSessionRoutes(app, ctx) {
         catch {
             // Mux stats are optional.
         }
-        const merged = mergeUnifiedSessions({ live, persisted, lifecycle, history, mux });
+        // Multi-user: a non-admin only sees their own sessions; host-wide transcript
+        // history (not tied to an owned session) is admin-only.
+        let sLive = live;
+        let sPersisted = persisted;
+        let sLifecycle = lifecycle;
+        let sHistory = history;
+        const uUser = getAuthUser(req);
+        if (isMultiUserMode() && uUser.role !== 'admin') {
+            const ownedLive = new Set([...ctx.sessions.values()].filter((s) => canAccessOwned(uUser, s.owner)).map((s) => s.id));
+            const stored = ctx.store.getState().sessions;
+            const ownedPersisted = new Set(Object.values(stored)
+                .filter((p) => canAccessOwned(uUser, p.owner))
+                .map((p) => p.id));
+            const isOwned = (id) => ownedLive.has(id) || ownedPersisted.has(id);
+            sLive = live.filter((l) => isOwned(l.id));
+            sPersisted = persisted.filter((p) => isOwned(p.id));
+            sLifecycle = lifecycle.filter((e) => isOwned(e.sessionId));
+            sHistory = [];
+        }
+        const merged = mergeUnifiedSessions({
+            live: sLive,
+            persisted: sPersisted,
+            lifecycle: sLifecycle,
+            history: sHistory,
+            mux,
+        });
         const offset = query.offset !== undefined ? parseInt(query.offset, 10) : undefined;
         const limit = query.limit !== undefined ? parseInt(query.limit, 10) : undefined;
         return filterAndPaginate(merged, {
@@ -2156,7 +2300,7 @@ export function registerSessionRoutes(app, ctx) {
             reply.header('Retry-After', '60');
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Rate limit exceeded (30 uploads/min per session)');
         }
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (!req.isMultipart()) {
             reply.code(400);
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Expected multipart/form-data');