aicodeman 1.4.1 → 1.5.1

package/dist/web/routes/session-routes.js

@@ -13,7 +13,9 @@ import { ApiErrorCode, createErrorResponse, getErrorMessage, } from '../../types
 import { Session, isAltScreenStripMode } from '../../session.js';
 import { SseEvent } from '../sse-events.js';
 import { CreateSessionSchema, SessionNameSchema, SessionColorSchema, RunPromptSchema, SessionInputWithLimitSchema, ResizeSchema, AutoClearSchema, AutoCompactSchema, AutoResumeSchema, ImageWatcherSchema, FlickerFilterSchema, QuickRunSchema, QuickStartSchema, InteractiveStartSchema, } from '../schemas.js';
-import { autoConfigureRalph, CASES_DIR, findSessionOrFail, parseBody, persistAndBroadcastSession, SETTINGS_PATH, validatePathWithinBase, } from '../route-helpers.js';
+import { autoConfigureRalph, canAccessOwned, CASES_DIR, findSessionOrFail, getAuthUser, isAdmin, isWorkingDirAllowed, ownerFor, parseBody, persistAndBroadcastSession, resolveCasesDir, sessionCapacityMessage, SETTINGS_PATH, validatePathWithinBase, } from '../route-helpers.js';
+import { canUsernameRunPrivilegedCommands, resolveClaudeModeForUsername } from '../../user-store.js';
+import { isMultiUserMode } from '../../config/multiuser.js';
 import { AUTH_COOKIE_NAME } from '../middleware/auth.js';
 import { writeHooksConfig, updateCaseModel, stripCaseEnvKeys, applyStatusLineConfig, refreshStaleHookSecret, } from '../../hooks-config.js';
 import { generateClaudeMd } from '../../templates/claude-md.js';
@@ -21,13 +23,12 @@ import { imageWatcher } from '../../image-watcher.js';
 import { convertHeicToJpeg } from '../heic-jpeg-converter.js';
 import { getLifecycleLog } from '../../session-lifecycle-log.js';
 import { mergeUnifiedSessions, filterAndPaginate, } from '../../services/unified-session-service.js';
-import { MAX_CONCURRENT_SESSIONS } from '../../config/map-limits.js';
 import { RunSummaryTracker } from '../../run-summary.js';
 import { MAX_INPUT_LENGTH, MAX_SESSION_NAME_LENGTH } from '../../config/terminal-limits.js';
 import { MAX_PASTE_IMAGE_BYTES } from '../../config/buffer-limits.js';
 import { dataPath, getDataDir } from '../../config/instance.js';
 import { checkRemoteTmuxAvailable, readRemoteCases, readRemoteHosts, toSessionRemote } from '../../remote-hosts.js';
-import { checkDockerAvailable, checkDockerTmuxAvailable, ensureAgentBaseImage, DEFAULT_AGENT_IMAGE, readDockerCases, readDockerHosts, toSessionDocker, } from '../../docker-hosts.js';
+import { checkDockerAvailable, checkDockerConfigDrift, checkDockerTmuxAvailable, ensureAgentBaseImage, DEFAULT_AGENT_IMAGE, persistDockerCaseClaudeSessionId, readDockerCases, readDockerHosts, toSessionDocker, } from '../../docker-hosts.js';
 import { LRUMap } from '../../utils/lru-map.js';
 // Path to linked-cases registry (same file used by case-routes resolveCasePath)
 const LINKED_CASES_FILE = dataPath('linked-cases.json');
@@ -197,6 +198,25 @@ export function consumePasteToken(key, now = Date.now()) {
 export function _resetPasteRateBuckets() {
     pasteRateBuckets.clear();
 }
+/**
+ * Security (multi-user §6.3): the Claude-only permission-mode downgrade does not
+ * cover the other CLIs' bypass switches. Codex `--dangerously-bypass-approvals-and-sandbox`
+ * and Gemini `--approval-mode yolo` disable the safety classifier the non-granted-user
+ * downgrade is meant to keep on, so clamp them for a non-granted owner. buildGeminiCommand
+ * defaults an ABSENT approvalMode to yolo, so the gemini config must be MATERIALIZED
+ * (auto_edit) even when the request sent none. No-op in single-user mode / for a granted
+ * owner (canUsernameRunPrivilegedCommands returns true when !isMultiUserMode()).
+ */
+async function clampExternalCliBypassForOwner(owner, codexConfig, geminiConfig) {
+    const granted = await canUsernameRunPrivilegedCommands(owner);
+    if (granted)
+        return { codexConfig, geminiConfig };
+    // Non-granted: force codex bypass off (only meaningful when a config was sent) and
+    // materialize gemini to auto_edit (clamps an explicit 'yolo' and the yolo default).
+    const clampedCodex = codexConfig ? { ...codexConfig, dangerouslyBypassApprovals: false } : codexConfig;
+    const clampedGemini = { ...(geminiConfig ?? {}), approvalMode: 'auto_edit' };
+    return { codexConfig: clampedCodex, geminiConfig: clampedGemini };
+}
 export function registerSessionRoutes(app, ctx) {
     // ═══════════════════════════════════════════════════════════════
     // Auth
@@ -215,17 +235,36 @@ export function registerSessionRoutes(app, ctx) {
     // Session CRUD (list, create, rename, color, delete, detail)
     // ═══════════════════════════════════════════════════════════════
     // ========== Session Listing ==========
-    app.get('/api/sessions', async () => {
-        return ctx.getLightSessionsState();
+    app.get('/api/sessions', async (req) => {
+        const list = ctx.getLightSessionsState();
+        if (!isMultiUserMode())
+            return list;
+        const user = getAuthUser(req);
+        if (user.role === 'admin')
+            return list;
+        return list.filter((s) => canAccessOwned(user, s.owner));
     });
     // ========== Session Creation ==========
     app.post('/api/sessions', async (req) => {
-        // Prevent unbounded session creation
-        if (ctx.sessions.size >= MAX_CONCURRENT_SESSIONS) {
-            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `Maximum concurrent sessions (${MAX_CONCURRENT_SESSIONS}) reached. Delete some sessions first.`);
-        }
+        const owner = ownerFor(req);
+        // Global + per-user session cap.
+        const capMsg = sessionCapacityMessage(ctx.sessions, owner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.OPERATION_FAILED, capMsg);
         const body = parseBody(CreateSessionSchema, req.body);
         const workingDir = body.workingDir || process.cwd();
+        // Multi-user: shell mode is arbitrary command execution as the host account,
+        // gated behind the same grant as bypass (section 6.3). Resolve the owner's grant
+        // from the store so a GRANTED regular user is not wrongly denied (AuthUser role alone can't tell).
+        if (body.mode === 'shell' && !(await canUsernameRunPrivilegedCommands(owner))) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'Shell sessions require the can-bypass-permissions grant');
+        }
+        // Multi-user linchpin (section 6.2): a non-admin's workingDir must resolve
+        // inside their own case space. Enforced BEFORE any disk-mutating call below so
+        // a foreign path can never be written into.
+        if (!isWorkingDirAllowed(getAuthUser(req), workingDir)) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'workingDir is outside your workspace');
+        }
         // Validate workingDir exists and is a directory
         if (body.workingDir) {
             try {
@@ -243,15 +282,17 @@ export function registerSessionRoutes(app, ctx) {
         // For keys the caller is actively setting, strip any stale disk entry a prior
         // Codeman version may have written. Scope limited to:
         //   - Claude mode (OpenCode/Codex/Gemini don't read .claude/settings.local.json)
-        //   - workingDir inside CASES_DIR (Codeman's managed territory — we never mutate
-        //     .claude/settings.local.json in arbitrary user repos that POST /api/sessions
-        //     can target, because those may have hand-authored values).
+        //   - workingDir inside CASES_DIR / the per-user case space (Codeman's managed
+        //     territory — we never mutate .claude/settings.local.json in arbitrary user
+        //     repos that POST /api/sessions can target, as those may have hand-authored
+        //     values).
+        const managedCasesBase = resolveCasesDir(getAuthUser(req));
         const canStripDisk = body.mode !== 'opencode' &&
             body.mode !== 'codex' &&
             body.mode !== 'gemini' &&
             body.envOverrides &&
             Object.keys(body.envOverrides).length > 0 &&
-            workingDir.startsWith(CASES_DIR + '/');
+            (workingDir.startsWith(CASES_DIR + '/') || workingDir.startsWith(managedCasesBase + '/'));
         if (canStripDisk) {
             await stripCaseEnvKeys(workingDir, Object.keys(body.envOverrides));
         }
@@ -344,6 +385,10 @@ export function registerSessionRoutes(app, ctx) {
                         ? modelConfig?.defaultModel || undefined
                         : undefined;
         const claudeModeConfig = await ctx.getClaudeModeConfig();
+        // Section 6.3: force non-granted users to a classifier-guarded mode.
+        const effectiveClaudeMode = await resolveClaudeModeForUsername(claudeModeConfig.claudeMode, owner);
+        // Section 6.3: clamp Codex/Gemini bypass switches for a non-granted owner (no-op single-user/granted).
+        const { codexConfig: gatedCodexConfig, geminiConfig: gatedGeminiConfig } = await clampExternalCliBypassForOwner(owner, body.codexConfig, body.geminiConfig);
         const terminalHistoryConfig = await ctx.getTerminalHistoryConfig();
         const session = new Session({
             workingDir,
@@ -353,15 +398,16 @@ export function registerSessionRoutes(app, ctx) {
             useMux: true,
             niceConfig: globalNice,
             model,
-            claudeMode: claudeModeConfig.claudeMode,
+            claudeMode: effectiveClaudeMode,
             allowedTools: claudeModeConfig.allowedTools,
             openCodeConfig: mode === 'opencode' ? body.openCodeConfig : undefined,
-            codexConfig: mode === 'codex' ? body.codexConfig : undefined,
-            geminiConfig: mode === 'gemini' ? body.geminiConfig : undefined,
+            codexConfig: mode === 'codex' ? gatedCodexConfig : undefined,
+            geminiConfig: mode === 'gemini' ? gatedGeminiConfig : undefined,
             resumeSessionId: validatedResumeId,
             envOverrides: body.envOverrides,
             effort: body.effort,
             tmuxHistoryLimit: terminalHistoryConfig.tmuxHistoryLimit,
+            owner,
         });
         ctx.addSession(session);
         ctx.store.incrementSessionsCreated();
@@ -378,7 +424,7 @@ export function registerSessionRoutes(app, ctx) {
     app.put('/api/sessions/:id/name', async (req) => {
         const { id } = req.params;
         const body = parseBody(SessionNameSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const name = String(body.name || '').slice(0, MAX_SESSION_NAME_LENGTH);
         session.name = name;
         // Also update the mux session name if applicable
@@ -390,7 +436,7 @@ export function registerSessionRoutes(app, ctx) {
     app.put('/api/sessions/:id/color', async (req) => {
         const { id } = req.params;
         const body = parseBody(SessionColorSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const validColors = ['default', 'red', 'orange', 'yellow', 'green', 'blue', 'purple', 'pink'];
         if (!validColors.includes(body.color)) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid color');
@@ -404,15 +450,19 @@ export function registerSessionRoutes(app, ctx) {
         const { id } = req.params;
         const query = req.query;
         const killMux = query.killMux !== 'false'; // Default to true
-        if (!ctx.sessions.has(id)) {
-            return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Session not found');
-        }
-        await ctx.cleanupSession(id, killMux, 'user_delete');
+        // Security: owner-scoped lookup 404s foreign/missing sessions uniformly (no existence leak, no cross-user kill).
+        const session = findSessionOrFail(ctx, id, req);
+        await ctx.cleanupSession(session.id, killMux, 'user_delete');
         return {};
     });
     // ========== Delete All Sessions ==========
-    app.delete('/api/sessions', async () => {
-        const sessionIds = Array.from(ctx.sessions.keys());
+    app.delete('/api/sessions', async (req) => {
+        // Security: scope the bulk sweep to sessions the caller can access — a non-admin
+        // must not wipe other users' sessions (canAccessOwned is allow-all for admin/single-user).
+        const user = getAuthUser(req);
+        const sessionIds = Array.from(ctx.sessions.values())
+            .filter((s) => canAccessOwned(user, s.owner))
+            .map((s) => s.id);
         let killed = 0;
         for (const id of sessionIds) {
             if (ctx.sessions.has(id)) {
@@ -425,7 +475,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Session Detail ==========
     app.get('/api/sessions/:id', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         // Use light state (no full buffers) — terminal buffer available via /terminal endpoint.
         // Full buffers were 2-3MB and caused slowness when polled frequently (e.g. Ralph wizard).
         return ctx.getSessionStateWithRespawn(session);
@@ -436,7 +486,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Session Output ==========
     app.get('/api/sessions/:id/output', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         return {
             success: true,
             data: {
@@ -449,7 +499,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Ralph State ==========
     app.get('/api/sessions/:id/ralph-state', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         return {
             success: true,
             data: {
@@ -462,7 +512,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Run Summary ==========
     app.get('/api/sessions/:id/run-summary', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const tracker = ctx.runSummaryTrackers.get(id);
         if (!tracker) {
             // Create a fresh tracker if one doesn't exist (shouldn't happen normally)
@@ -477,7 +527,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Get Active Tools ==========
     app.get('/api/sessions/:id/active-tools', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         return {
             success: true,
             data: {
@@ -492,7 +542,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/run', async (req) => {
         const { id } = req.params;
         const { prompt } = parseBody(RunPromptSchema, req.body);
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -514,7 +564,7 @@ export function registerSessionRoutes(app, ctx) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid request body');
         }
         const { clearBreaker } = bodyResult.data;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -563,7 +613,7 @@ export function registerSessionRoutes(app, ctx) {
     // ========== Start Shell Mode ==========
     app.post('/api/sessions/:id/shell', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (session.isBusy()) {
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, 'Session is busy');
         }
@@ -592,7 +642,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/input', async (req) => {
         const { id } = req.params;
         const { input, useMux, seq, clientId } = parseBody(SessionInputWithLimitSchema, req.body);
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const inputStr = String(input);
         if (inputStr.length > MAX_INPUT_LENGTH) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Input exceeds maximum length (${MAX_INPUT_LENGTH} bytes)`);
@@ -642,7 +692,7 @@ export function registerSessionRoutes(app, ctx) {
         if (!hex) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Key not allowed: ${key}`);
         }
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         const muxName = session.muxName;
         if (!muxName) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'No tmux session');
@@ -669,7 +719,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/resize', async (req) => {
         const { id } = req.params;
         const { cols, rows, viewportType, force } = parseBody(ResizeSchema, req.body);
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.resize(cols, rows, { viewportType, force });
         return {};
     });
@@ -755,7 +805,7 @@ export function registerSessionRoutes(app, ctx) {
     }
     app.get('/api/sessions/:id/last-response', async (req) => {
         const { id } = req.params;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         // Codex sessions don't write to ~/.claude/projects — their transcripts
         // live in ~/.codex/sessions/**. Branch to a Codex-specific reader so the
         // response-viewer works for Codex panes too.
@@ -771,6 +821,10 @@ export function registerSessionRoutes(app, ctx) {
         const activeId = await resolveActiveClaudeSessionIdFromHistory(session, projectsDir);
         if (activeId && activeId !== session.claudeSessionId) {
             session.adoptClaudeSessionId(activeId);
+            // Docker sessions: keep the case's resume seed following the live conversation.
+            if (session.docker) {
+                void persistDockerCaseClaudeSessionId(CODEMAN_CONFIG_DIR, session.docker.containerName, activeId).catch(() => { });
+            }
         }
         // The Claude conversation ID (used as JSONL filename)
         const claudeSessionId = session.claudeSessionId || session.id;
@@ -1182,7 +1236,7 @@ export function registerSessionRoutes(app, ctx) {
     app.get('/api/sessions/:id/terminal', async (req) => {
         const { id } = req.params;
         const query = req.query;
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         // `full=1` is the EXPLICIT full-reload signal (COD-47): the browser reloaded
         // the page and wants the whole scroll history back, so we capture the ENTIRE
         // tmux scrollback and the user gets back history that scrolled off Codeman's
@@ -1301,7 +1355,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/auto-clear', async (req) => {
         const { id } = req.params;
         const body = parseBody(AutoClearSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.setAutoClear(body.enabled, body.threshold);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1318,7 +1372,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/auto-compact', async (req) => {
         const { id } = req.params;
         const body = parseBody(AutoCompactSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.setAutoCompact(body.enabled, body.threshold, body.prompt);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1336,7 +1390,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/auto-resume', async (req) => {
         const { id } = req.params;
         const body = parseBody(AutoResumeSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.setAutoResume(body.enabled);
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1353,7 +1407,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/image-watcher', async (req) => {
         const { id } = req.params;
         const body = parseBody(ImageWatcherSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (body.enabled) {
             imageWatcher.watchSession(session.id, session.workingDir);
         }
@@ -1374,7 +1428,7 @@ export function registerSessionRoutes(app, ctx) {
     app.post('/api/sessions/:id/flicker-filter', async (req) => {
         const { id } = req.params;
         const body = parseBody(FlickerFilterSchema, req.body, 'Invalid request body');
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         session.flickerFilterEnabled = body.enabled;
         persistAndBroadcastSession(ctx, session);
         return {
@@ -1389,15 +1443,19 @@ export function registerSessionRoutes(app, ctx) {
     // ═══════════════════════════════════════════════════════════════
     // ========== Quick Run ==========
     app.post('/api/run', async (req) => {
-        // Prevent unbounded session creation
-        if (ctx.sessions.size >= MAX_CONCURRENT_SESSIONS) {
-            return createErrorResponse(ApiErrorCode.SESSION_BUSY, `Maximum concurrent sessions (${MAX_CONCURRENT_SESSIONS}) reached`);
-        }
+        const runOwner = ownerFor(req);
+        const capMsg = sessionCapacityMessage(ctx.sessions, runOwner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.SESSION_BUSY, capMsg);
         const { prompt, workingDir, envOverrides: runEnvOverrides, } = parseBody(QuickRunSchema, req.body, 'Invalid request body');
         if (!prompt.trim()) {
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'prompt is required');
         }
         const dir = workingDir || process.cwd();
+        // Multi-user: confine a non-admin's one-shot working dir to their space.
+        if (!isWorkingDirAllowed(getAuthUser(req), dir)) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'workingDir is outside your workspace');
+        }
         // Validate workingDir exists and is a directory
         if (workingDir) {
             try {
@@ -1410,7 +1468,17 @@ export function registerSessionRoutes(app, ctx) {
                 return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'workingDir does not exist');
             }
         }
-        const session = new Session({ workingDir: dir, envOverrides: runEnvOverrides });
+        // Section 6.3: the one-shot spawn path (runPrompt/buildPromptArgs) respects the
+        // session's claudeMode, so resolve it for the owner (bypass -> auto for non-granted).
+        const runClaudeModeConfig = await ctx.getClaudeModeConfig();
+        const runClaudeMode = await resolveClaudeModeForUsername(runClaudeModeConfig.claudeMode, runOwner);
+        const session = new Session({
+            workingDir: dir,
+            envOverrides: runEnvOverrides,
+            claudeMode: runClaudeMode,
+            allowedTools: runClaudeModeConfig.allowedTools,
+            owner: runOwner,
+        });
         ctx.addSession(session);
         ctx.store.incrementSessionsCreated();
         ctx.persistSessionState(session);
@@ -1437,11 +1505,16 @@ export function registerSessionRoutes(app, ctx) {
     });
     // ========== Quick Start ==========
     app.post('/api/quick-start', async (req) => {
-        // Prevent unbounded session creation
-        if (ctx.sessions.size >= MAX_CONCURRENT_SESSIONS) {
-            return createErrorResponse(ApiErrorCode.SESSION_BUSY, `Maximum concurrent sessions (${MAX_CONCURRENT_SESSIONS}) reached.`);
+        const owner = ownerFor(req);
+        const capMsg = sessionCapacityMessage(ctx.sessions, owner);
+        if (capMsg)
+            return createErrorResponse(ApiErrorCode.SESSION_BUSY, capMsg);
+        const { caseName = 'testcase', sessionName, mode = 'claude', modelOverride, openCodeConfig, codexConfig, geminiConfig, envOverrides, effort, } = parseBody(QuickStartSchema, req.body);
+        // Multi-user: shell mode is arbitrary host-account execution, gated by the grant.
+        // Resolve the owner's grant from the store so a GRANTED regular user is not wrongly denied.
+        if (mode === 'shell' && !(await canUsernameRunPrivilegedCommands(owner))) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'Shell sessions require the can-bypass-permissions grant');
         }
-        const { caseName = 'testcase', sessionName, mode = 'claude', openCodeConfig, codexConfig, geminiConfig, envOverrides, effort, } = parseBody(QuickStartSchema, req.body);
         // Resolve the remote case FIRST — the CLI executes on the REMOTE host over ssh,
         // so the LOCAL availability gates below (isCodexAvailable() etc.) don't apply and
         // would wrongly reject a machine that hasn't got the CLI installed locally.
@@ -1449,11 +1522,16 @@ export function registerSessionRoutes(app, ctx) {
         let docker = undefined;
         let dockerResumeId;
         let casePath = null;
+        // Security: fold ownership INTO the match (don't early-return) so a NON-OWNED
+        // same-named remote/docker case is skipped and control falls through to the caller's
+        // own LOCAL case — remote/docker names are globally unique but local names are
+        // per-user, so a name collision must not shadow the caller's own case. canAccessOwned
+        // is allow-all for admins/single-user, so flag-OFF stays byte-identical.
         const remoteCases = await readRemoteCases(CODEMAN_CONFIG_DIR);
-        const remoteCase = remoteCases.find((item) => item.name === caseName);
+        const remoteCase = remoteCases.find((item) => item.name === caseName && canAccessOwned(getAuthUser(req), item.owner));
         const dockerCase = remoteCase
             ? undefined
-            : (await readDockerCases(CODEMAN_CONFIG_DIR)).find((item) => item.name === caseName);
+            : (await readDockerCases(CODEMAN_CONFIG_DIR)).find((item) => item.name === caseName && canAccessOwned(getAuthUser(req), item.owner));
         if (remoteCase) {
             const host = (await readRemoteHosts(CODEMAN_CONFIG_DIR)).find((item) => item.id === remoteCase.hostId);
             if (!host)
@@ -1464,10 +1542,11 @@ export function registerSessionRoutes(app, ctx) {
             // remote command/env customization goes through the per-host command override.
             if ((envOverrides && Object.keys(envOverrides).length > 0) ||
                 effort ||
+                modelOverride !== undefined ||
                 codexConfig ||
                 geminiConfig ||
                 openCodeConfig) {
-                return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'envOverrides, effort, and per-CLI config are not supported for remote cases (they do not cross ssh). Configure the remote command via the host command override instead.');
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'envOverrides, effort, modelOverride, and per-CLI config are not supported for remote cases (they do not cross ssh). Configure the remote command via the host command override instead.');
             }
             // tmux is a hard prerequisite on the remote host (the agent runs inside a remote
             // tmux server so it survives ssh drops). Probe before spawning so a missing tmux
@@ -1483,7 +1562,7 @@ export function registerSessionRoutes(app, ctx) {
             // Docker case: the CLI executes INSIDE a container via local tmux + `docker
             // exec`, so the LOCAL availability gates below don't apply. Mirror the remote
             // branch's rejection of per-session config that would not cross into the
-            // container (it would silently no-op).
+            // container (it would silently no-op). (Ownership is enforced in the .find above.)
             const host = (await readDockerHosts(CODEMAN_CONFIG_DIR)).find((item) => item.id === dockerCase.hostId);
             if (!host)
                 return createErrorResponse(ApiErrorCode.NOT_FOUND, 'Docker host not found');
@@ -1502,7 +1581,7 @@ export function registerSessionRoutes(app, ctx) {
             // Ensure the base image exists, auto-building the default image on first use so
             // it is never a blocker. Dedup'd with any build kicked off at case-create, so
             // this awaits the SAME in-flight build rather than starting a second one.
-            const ensured = await ensureAgentBaseImage(sessionDocker.engine, sessionDocker.image, {
+            const ensured = await ensureAgentBaseImage(sessionDocker, sessionDocker.image, {
                 onProgress: (line) => ctx.broadcast(SseEvent.DockerImageBuildProgress, { name: dockerCase.name, line }),
             });
             if (!ensured.ok) {
@@ -1520,6 +1599,15 @@ export function registerSessionRoutes(app, ctx) {
                     return createErrorResponse(ApiErrorCode.OPERATION_FAILED, tmuxCheck.error || 'base image is missing tmux');
                 }
             }
+            // Config drift (docs/docker-cases-plan.md §4): the desired create-config no
+            // longer matches the existing container's codeman.confighash label. Refuse to
+            // silently launch into the stale container — the frontend confirms a recreate
+            // (POST /api/docker-cases/:name/recreate; workspace + transcripts ride bind
+            // mounts and the conversation resumes), or the user reverts the host edit.
+            const drift = await checkDockerConfigDrift(sessionDocker);
+            if (drift.exists && drift.drifted) {
+                return createErrorResponse(ApiErrorCode.CONFLICT, `Container config for case "${dockerCase.name}" changed since the container was created. Recreate the container to apply it (workspace and conversation survive), or revert the docker host edit.`);
+            }
             casePath = dockerCase.hostWorkspacePath; // a REAL host dir (bind-mounted into the container)
             docker = sessionDocker;
             // Seed resume so a relaunch resumes the case's last conversation from the
@@ -1561,7 +1649,11 @@ export function registerSessionRoutes(app, ctx) {
             catch {
                 // File missing or unparseable — treat as empty registry
             }
-            casePath = linkedCases[caseName] || validatePathWithinBase(caseName, CASES_DIR);
+            // Multi-user: the linked-cases registry is ownerless/global, so only admins may
+            // resolve a name to an arbitrary linked path. A non-admin resolves inside their
+            // OWN case space only (single-user: isAdmin true, so linked cases still honoured).
+            const linked = isAdmin(req) ? linkedCases[caseName] : undefined;
+            casePath = linked || validatePathWithinBase(caseName, resolveCasesDir(getAuthUser(req)));
             if (!casePath) {
                 return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Invalid case path');
             }
@@ -1569,6 +1661,14 @@ export function registerSessionRoutes(app, ctx) {
         // By this point casePath is guaranteed non-null: for remote cases it was set from remoteCase.remotePath,
         // for local cases the !casePath guard above returned early. TypeScript can't narrow across the if/else.
         const resolvedCasePath = casePath;
+        // Multi-user linchpin (section 6.2): confine the resolved workingDir to the caller's
+        // own case space BEFORE any mkdir/scaffold below creates or mutates it. Applies to
+        // LOCAL and DOCKER cases (docker.hostWorkspacePath is a real host dir the file routes
+        // trust); skipped for REMOTE, whose path is an ssh path that would spuriously fail
+        // realpath confinement. No-op for admins / single-user mode.
+        if (!remote && !isWorkingDirAllowed(getAuthUser(req), resolvedCasePath)) {
+            return createErrorResponse(ApiErrorCode.FORBIDDEN, 'case path is outside your workspace');
+        }
         // Create case folder and CLAUDE.md if it doesn't exist (only for non-linked, non-remote,
         // non-docker cases — docker workspaces are scaffolded in their own block below)
         if (!remote && !docker && !existsSync(resolvedCasePath)) {
@@ -1618,6 +1718,12 @@ export function registerSessionRoutes(app, ctx) {
                 /* non-fatal — the session still runs, hooks may be degraded */
             }
         }
+        // Model override → <case>/.claude/settings.local.json (claude-mode; local AND
+        // docker — the docker workspace is a real host dir, so the settings file crosses
+        // the bind mount and the in-container claude reads it). Remote was rejected above.
+        if (mode === 'claude' && modelOverride !== undefined) {
+            await updateCaseModel(resolvedCasePath, modelOverride || null);
+        }
         // Strip stale disk entries for keys this request is actively setting (Claude only —
         // see POST /api/sessions for full rationale).
         if (mode !== 'opencode' &&
@@ -1642,6 +1748,9 @@ export function registerSessionRoutes(app, ctx) {
                         ? qsModelConfig?.defaultModel || undefined
                         : undefined;
         const qsClaudeModeConfig = await ctx.getClaudeModeConfig();
+        const qsEffectiveClaudeMode = await resolveClaudeModeForUsername(qsClaudeModeConfig.claudeMode, owner);
+        // Section 6.3: clamp Codex/Gemini bypass switches for a non-granted owner (no-op single-user/granted).
+        const { codexConfig: qsGatedCodexConfig, geminiConfig: qsGatedGeminiConfig } = await clampExternalCliBypassForOwner(owner, codexConfig, geminiConfig);
         const qsTerminalHistoryConfig = await ctx.getTerminalHistoryConfig();
         const session = new Session({
             workingDir: resolvedCasePath,
@@ -1651,11 +1760,12 @@ export function registerSessionRoutes(app, ctx) {
             mode: mode,
             niceConfig: niceConfig,
             model: qsModel,
-            claudeMode: qsClaudeModeConfig.claudeMode,
+            claudeMode: qsEffectiveClaudeMode,
             allowedTools: qsClaudeModeConfig.allowedTools,
+            owner,
             openCodeConfig: mode === 'opencode' ? openCodeConfig : undefined,
-            codexConfig: mode === 'codex' ? codexConfig : undefined,
-            geminiConfig: mode === 'gemini' ? geminiConfig : undefined,
+            codexConfig: mode === 'codex' ? qsGatedCodexConfig : undefined,
+            geminiConfig: mode === 'gemini' ? qsGatedGeminiConfig : undefined,
             envOverrides,
             effort,
             remote,
@@ -1707,6 +1817,14 @@ export function registerSessionRoutes(app, ctx) {
                 ctx.broadcast(SseEvent.SessionInteractive, { id: session.id, mode });
             }
             ctx.broadcast(SseEvent.SessionUpdated, { session: ctx.getSessionStateWithRespawn(session) });
+            // Docker + claude: the pane command pins the conversation id (--session-id /
+            // --resume, claudeDockerPaneCommand), so persist it as the case's resume seed
+            // NOW — a later container stop/reboot relaunch resumes this conversation even
+            // if no in-container hook ever reaches the host (loopback bind, no bridge
+            // listener). Hook/last-response adoption updates it again after /clear.
+            if (docker && mode === 'claude') {
+                void persistDockerCaseClaudeSessionId(CODEMAN_CONFIG_DIR, docker.containerName, session.claudeSessionId || session.id).catch(() => { });
+            }
             // Save lastUsedCase to settings for TUI/web sync
             try {
                 const settingsFilePath = SETTINGS_PATH;
@@ -1993,6 +2111,12 @@ export function registerSessionRoutes(app, ctx) {
         const query = req.query;
         const projectsDir = join(process.env.HOME || '/tmp', '.claude', 'projects');
         const headBuf = Buffer.alloc(16384);
+        // Multi-user: this scans the host-wide ~/.claude/projects tree, so a non-admin
+        // must only see history whose decoded workingDir is inside their own case space.
+        // Do NOT trust the caller-supplied projectKey — confine on the decoded path.
+        // No-op for admins / single-user mode.
+        const user = getAuthUser(req);
+        const scopeHistory = isMultiUserMode() && user.role !== 'admin';
         // Single-folder drill-down: when projectKey is provided, scan only that
         // directory, bypass the 50-cap, and honor offset/limit pagination.
         if (query.projectKey) {
@@ -2003,12 +2127,15 @@ export function registerSessionRoutes(app, ctx) {
             const offset = Math.max(0, parseInt(query.offset || '0', 10) || 0);
             const limit = Math.min(100, Math.max(1, parseInt(query.limit || '20', 10) || 20));
             const projPath = join(projectsDir, query.projectKey);
-            const all = await scanProjectDir(projPath, query.projectKey, headBuf);
+            let all = await scanProjectDir(projPath, query.projectKey, headBuf);
+            // Confine to the caller's workspace (a projectKey maps to a single foreign cwd).
+            if (scopeHistory)
+                all = all.filter((r) => isWorkingDirAllowed(user, r.workingDir));
             all.sort((a, b) => new Date(b.lastModified).getTime() - new Date(a.lastModified).getTime());
             return { sessions: all.slice(offset, offset + limit), total: all.length };
         }
         // Global overview: scan all projects, return up to 50 most-recent sessions.
-        const results = [];
+        let results = [];
         try {
             const projectDirs = await fs.readdir(projectsDir);
             for (const projDir of projectDirs) {
@@ -2020,6 +2147,9 @@ export function registerSessionRoutes(app, ctx) {
         catch {
             // Projects dir may not exist
         }
+        // Multi-user: drop rows outside the non-admin caller's own case space.
+        if (scopeHistory)
+            results = results.filter((r) => isWorkingDirAllowed(user, r.workingDir));
         results.sort((a, b) => new Date(b.lastModified).getTime() - new Date(a.lastModified).getTime());
         return { sessions: results.slice(0, 50) };
     });
@@ -2116,7 +2246,32 @@ export function registerSessionRoutes(app, ctx) {
         catch {
             // Mux stats are optional.
         }
-        const merged = mergeUnifiedSessions({ live, persisted, lifecycle, history, mux });
+        // Multi-user: a non-admin only sees their own sessions; host-wide transcript
+        // history (not tied to an owned session) is admin-only.
+        let sLive = live;
+        let sPersisted = persisted;
+        let sLifecycle = lifecycle;
+        let sHistory = history;
+        const uUser = getAuthUser(req);
+        if (isMultiUserMode() && uUser.role !== 'admin') {
+            const ownedLive = new Set([...ctx.sessions.values()].filter((s) => canAccessOwned(uUser, s.owner)).map((s) => s.id));
+            const stored = ctx.store.getState().sessions;
+            const ownedPersisted = new Set(Object.values(stored)
+                .filter((p) => canAccessOwned(uUser, p.owner))
+                .map((p) => p.id));
+            const isOwned = (id) => ownedLive.has(id) || ownedPersisted.has(id);
+            sLive = live.filter((l) => isOwned(l.id));
+            sPersisted = persisted.filter((p) => isOwned(p.id));
+            sLifecycle = lifecycle.filter((e) => isOwned(e.sessionId));
+            sHistory = [];
+        }
+        const merged = mergeUnifiedSessions({
+            live: sLive,
+            persisted: sPersisted,
+            lifecycle: sLifecycle,
+            history: sHistory,
+            mux,
+        });
         const offset = query.offset !== undefined ? parseInt(query.offset, 10) : undefined;
         const limit = query.limit !== undefined ? parseInt(query.limit, 10) : undefined;
         return filterAndPaginate(merged, {
@@ -2173,7 +2328,7 @@ export function registerSessionRoutes(app, ctx) {
             reply.header('Retry-After', '60');
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Rate limit exceeded (30 uploads/min per session)');
         }
-        const session = findSessionOrFail(ctx, id);
+        const session = findSessionOrFail(ctx, id, req);
         if (!req.isMultipart()) {
             reply.code(400);
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Expected multipart/form-data');