aicodeman 1.40.0 → 1.41.1

package/dist/web/server.js

@@ -32,11 +32,11 @@ import fastifyCookie from '@fastify/cookie';
 import fastifyStatic from '@fastify/static';
 import fastifyWebsocket from '@fastify/websocket';
 import fastifyMultipart from '@fastify/multipart';
-import { pasteImageDirInUseByOtherSession, startPasteImageGc } from './paste-image-gc.js';
+import { pasteImageDirInUseByOtherSession, startPasteImageGc, uploadDirs } from './paste-image-gc.js';
 import { CLEAN_EXIT_CLOSE_REASON, shouldCloseCleanlyExitedSession } from '../pane-exit-sweep.js';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { existsSync, mkdirSync, readFileSync, chmodSync, rmSync, statSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, chmodSync, statSync } from 'node:fs';
 import fs from 'node:fs/promises';
 import { execSync } from 'node:child_process';
 import { hostname as getHostname, uptime as osUptime } from 'node:os';
@@ -62,6 +62,7 @@ import { subagentWatcher, } from '../subagent-watcher.js';
 import { imageWatcher } from '../image-watcher.js';
 import { workflowRunWatcher, summarizeRun } from '../workflow-run-watcher.js';
 import { attachmentRegistry, buildFileThumbnailRoute, registerExternalAttachment } from '../attachment-registry.js';
+import { folderGrants } from '../folder-listing.js';
 import { getCli, enabledClis, listClis } from '../config/cli-registry/registry.js';
 import { isCliEntryInstalled, probeStockCliAvailability } from '../utils/cli-installed-probes.js';
 import { readCustomModelHosts } from '../custom-model-hosts.js';
@@ -111,6 +112,7 @@ import { MAX_CONCURRENT_SESSIONS, MAX_SSE_CLIENTS } from '../config/map-limits.j
 import { MAX_PASTE_IMAGE_BYTES } from '../config/buffer-limits.js';
 import { resolveTerminalHistoryConfig } from '../config/terminal-history.js';
 import { SseEvent } from './sse-events.js';
+import { MAX_ROUTE_PARAM_LENGTH } from './route-helpers.js';
 import { getLatestPlanUsage, setLatestCodexPlanUsage } from './plan-usage-latest.js';
 import { telemetrySignature } from '../usage-telemetry.js';
 import { readCodexPlanUsage, resolveCodexBinaryPath } from '../utils/codex-cli-resolver.js';
@@ -119,7 +121,7 @@ import { isMultiUserMode } from '../config/multiuser.js';
 import { bootstrapInitialAdmin, hasUsers, resolveClaudeModeForUsername } from '../user-store.js';
 import { installRouteErrorHandler } from './route-error-handler.js';
 import { isExplicitlyEnabled, isLoopbackBindHost, buildHostPolicy } from './network-auth-policy.js';
-import { registerPushRoutes, registerTeamRoutes, registerMuxRoutes, registerFileRoutes, registerScheduledRoutes, registerHookEventRoutes, registerApprovalRoutes, registerRebootRestoreRoutes, registerReadMyMindRoutes, registerGitStatusRoutes, registerStatusTelemetryRoutes, registerSystemRoutes, registerCaseRoutes, registerSessionRoutes, registerRespawnRoutes, registerRalphRoutes, registerPlanRoutes, registerClipboardRoutes, registerSearchRoutes, registerOrchestratorRoutes, registerCronRoutes, registerMeRoutes, registerAdminRoutes, registerWsRoutes, registerVoiceRoutes, registerWebviewRoutes, registerTabLayoutRoutes, registerMcpSyncRoutes, registerWebhookRoutes, registerDoctorRoutes, registerCustomModelRoutes, refreshAllCustomModelHosts, readCustomModelEndpointsEnabled, closeAllLlamaSwapLogTails, detectCustomModelSwapDisplacements, pruneIdleLlamaSwapLogTails, tryWebviewRefererFallback, registerCliRegistryRoutes, } from './routes/index.js';
+import { registerPushRoutes, registerTeamRoutes, registerMuxRoutes, registerFileRoutes, registerHtmlViewRoutes, registerScheduledRoutes, registerHookEventRoutes, registerApprovalRoutes, registerRebootRestoreRoutes, registerReadMyMindRoutes, registerGitStatusRoutes, registerStatusTelemetryRoutes, registerSystemRoutes, registerCaseRoutes, registerSessionRoutes, registerRespawnRoutes, registerRalphRoutes, registerPlanRoutes, registerClipboardRoutes, registerSearchRoutes, registerOrchestratorRoutes, registerCronRoutes, registerMeRoutes, registerAdminRoutes, registerWsRoutes, registerVoiceRoutes, registerWebviewRoutes, registerTabLayoutRoutes, registerMcpSyncRoutes, registerWebhookRoutes, registerDoctorRoutes, registerCustomModelRoutes, refreshAllCustomModelHosts, readCustomModelEndpointsEnabled, closeAllLlamaSwapLogTails, detectCustomModelSwapDisplacements, pruneIdleLlamaSwapLogTails, tryWebviewRefererFallback, registerCliRegistryRoutes, } from './routes/index.js';
 import { isLostWebviewFrameNavigation } from './webview-proxy.js';
 import { CronService } from '../cron/cron-service.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -282,10 +284,15 @@ export class WebServer extends EventEmitter {
         const rewriteUrl = (req) => rewriteApiV1Url(stripBasePath(this.basePath, req.url || ''));
         if (https) {
             const { key, cert } = getOrCreateSelfSignedCert();
-            this.app = Fastify({ logger: false, https: { key, cert }, rewriteUrl });
+            this.app = Fastify({
+                logger: false,
+                https: { key, cert },
+                rewriteUrl,
+                routerOptions: { maxParamLength: MAX_ROUTE_PARAM_LENGTH },
+            });
         }
         else {
-            this.app = Fastify({ logger: false, rewriteUrl });
+            this.app = Fastify({ logger: false, rewriteUrl, routerOptions: { maxParamLength: MAX_ROUTE_PARAM_LENGTH } });
         }
         this.mux = createMultiplexer();
         this.sse = new SseStreamManager({
@@ -304,6 +311,9 @@ export class WebServer extends EventEmitter {
                 this.cachedLightState = null;
                 this.sse.broadcastSessionOrder(change);
             },
+            // Fresh, not the 2s cache: the settings PUT does not invalidate it, and a
+            // flip must apply to the very next spawn.
+            childrenFollowParent: async () => (await this.readSettings(true)).spawnedTabsFollowParent === true,
         });
         if (this.testMode)
             this.tabLayouts.markRestorationSkipped();
@@ -537,16 +547,20 @@ export class WebServer extends EventEmitter {
             this.teamWatcherHandlers = null;
         }
     }
-    /** Add a tentative session only after its owner layout accepts the creation. */
-    async registerSessionWithLayout(session) {
-        this.sessions.set(session.id, session);
-        try {
-            await this.tabLayouts.sessionCreated(ownerLayoutKey(session.owner));
-        }
-        catch (error) {
-            this.sessions.delete(session.id);
-            throw error;
-        }
+    /**
+     * Add a tentative session only after its owner layout accepts the creation.
+     * The session enters the live map inside the layout service's owner lock, so
+     * the placement it asked for (`tabGroupId`) lands in the same versioned write
+     * that first records it.
+     */
+    async registerSessionWithLayout(session, placement) {
+        return this.tabLayouts.sessionCreated(ownerLayoutKey(session.owner), session.id, placement, () => {
+            this.sessions.set(session.id, session);
+            return () => {
+                if (this.sessions.get(session.id) === session)
+                    this.sessions.delete(session.id);
+            };
+        });
     }
     /**
      * Build a route context object satisfying all 5 port interfaces.
@@ -944,6 +958,7 @@ export class WebServer extends EventEmitter {
         registerTeamRoutes(this.app, ctx);
         registerMuxRoutes(this.app, ctx);
         registerFileRoutes(this.app, ctx);
+        registerHtmlViewRoutes(this.app, ctx);
         registerScheduledRoutes(this.app, ctx);
         registerHookEventRoutes(this.app, ctx);
         registerApprovalRoutes(this.app, ctx);
@@ -1296,6 +1311,7 @@ export class WebServer extends EventEmitter {
             fileStreamManager.closeSessionStreams(sessionId);
             // Drop live external attachment registrations for this session
             attachmentRegistry.clearSession(sessionId);
+            folderGrants.clearSession(sessionId);
             // Stop watching for images in this session's directory
             imageWatcher.unwatchSession(sessionId);
             // Clean up pasted images directory for this session. The dir belongs to the
@@ -1314,12 +1330,17 @@ export class WebServer extends EventEmitter {
                     workingDir: session.workingDir,
                     killing: this.killingSessions,
                 })) {
-                const pasteImageDir = join(session.workingDir, '.claude-images');
-                try {
-                    rmSync(pasteImageDir, { recursive: true, force: true });
-                }
-                catch {
-                    // Best-effort cleanup
+                // Both upload dirs, the pre-move one too; uploadDirs() lists only real
+                // directories that are not the data dir and do not contain it, none for a
+                // remote session, and nothing on a workspace whose bounded probe did not
+                // answer (pastCap: this acts on one path at the user's request).
+                for (const uploadDir of await uploadDirs(session, { pastCap: true })) {
+                    try {
+                        await fs.rm(uploadDir, { recursive: true, force: true });
+                    }
+                    catch {
+                        // Best-effort cleanup
+                    }
                 }
             }
             // Drop the agent skill's preamble cache for this session (seeded at create).
@@ -1528,6 +1549,16 @@ export class WebServer extends EventEmitter {
                 gutterClis[entry.id] = columns;
         }
         html = html.replace('</head>', () => `<script>window.__codemanTranscriptGutter=${JSON.stringify(gutterClis)};</script>\n</head>`);
+        // Which run modes page their own transcript on PageUp/PageDown, for the scroll
+        // fallback over a pane with no local history (`_maybePageCliTranscript`). Read off
+        // the `transcriptPageKeys` capability, never an id list here, and injected for a
+        // solo window too for the same reason as the gutter map: it scrolls a terminal.
+        // Ids only, which the registry schema bounds to kebab tokens, so JSON.stringify
+        // alone is enough.
+        const pageKeyClis = enabledClis()
+            .filter((entry) => entry.capabilities.transcriptPageKeys === true)
+            .map((entry) => entry.id);
+        html = html.replace('</head>', () => `<script>window.__codemanTranscriptPageKeys=${JSON.stringify(pageKeyClis)};</script>\n</head>`);
         if (!soloSessionId && process.env.CODEMAN_GESTURE === '1') {
             html = html.replace('</head>', () => `<script>window.__codemanGestureAvailable=true;</script>\n</head>`);
             if (settings.gestureControlEnabled === true) {
@@ -2396,9 +2427,12 @@ export class WebServer extends EventEmitter {
             // Approvals Inbox item id: lets sw.js answer an Approve/Deny action
             // click directly (POST /api/approvals/:id/answer) with no tab open.
             // Gated on the opt-in setting together with the action buttons.
+            // Approve/Deny only when we also have an approvalId to answer with.
+            // Supervised-hook CLIs (DeepSeek) omit approvalId upstream so this also
+            // strips their action buttons — buttons without an id can never answer.
             approvalId: approvalsEnabled && typeof data.approvalId === 'string' ? data.approvalId : undefined,
             urgency: template.urgency,
-            actions: approvalsEnabled ? template.actions : undefined,
+            actions: approvalsEnabled && typeof data.approvalId === 'string' ? template.actions : undefined,
         });
         for (const sub of subscriptions) {
             // Check per-subscription preferences
@@ -2558,7 +2592,7 @@ export class WebServer extends EventEmitter {
             });
         }
         // Bound disk use under heavy paste-image traffic: delete `paste-*` files
-        // older than 7 days from each live session's .claude-images/ hourly.
+        // older than 7 days from each live session's upload dirs hourly.
         if (!this.testMode) {
             this._pasteImageGcStop = startPasteImageGc({ sessions: this.sessions });
             // Surface event-loop stalls (e.g. a slow synchronous tmux/ps call) so the
@@ -2946,7 +2980,7 @@ export class WebServer extends EventEmitter {
      * path adds the session's token totals to the lifetime figures, demotes a
      * pinned record to `stopped` (the durable marker of an intentional kill, which
      * would make the session permanently ineligible for a reboot restore), drops
-     * the persisted Ralph state, and recursively removes `.claude-images` from the
+     * the persisted Ralph state, and recursively removes the upload dirs from the
      * WORKING DIRECTORY, which belongs to the workspace rather than to this session
      * and may hold another live session's pasted images.
      *
@@ -3000,6 +3034,7 @@ export class WebServer extends EventEmitter {
         // otherwise meet the retry, which reuses the same session id by design.
         this.stopTranscriptWatcher(sessionId);
         attachmentRegistry.clearSession(sessionId);
+        folderGrants.clearSession(sessionId);
         sessionWaits.notifySignal(sessionId, 'exit');
         sessionWaits.cancelAll(sessionId);
         approvalInbox.resolveForSession(sessionId, 'session_ended');
@@ -3140,6 +3175,11 @@ export class WebServer extends EventEmitter {
                             // tile header keeps naming it until the next report; an idle claude
                             // session re-renders its statusline only on its next turn.
                             displayModel: savedState?.displayModel,
+                            // The last prompt-cache report, restored for the same reason: an idle claude
+                            // session re-renders its statusline only on its next turn, so without this the
+                            // Session Options readout would read "not reported yet" after every restart. The
+                            // readout is time-aware, so a value past its expiry shows as cold, not stale-warm.
+                            promptCache: savedState?.promptCache,
                             // A record rebuilt from the socket has no provenance, so its
                             // apparent locality is a guess (see `MuxSession.discovered`).
                             discoveredMuxSession: muxSession.discovered,
@@ -3238,6 +3278,19 @@ export class WebServer extends EventEmitter {
                             if (savedState.flickerFilterEnabled !== undefined) {
                                 session.flickerFilterEnabled = savedState.flickerFilterEnabled;
                             }
+                            // Tab colour, pin and the image watcher are user-set and persisted like the settings
+                            // above, but this path never read them back: after a restart every surviving pane came
+                            // back uncoloured and unpinned with its image watcher off, and the next persist
+                            // overwrote the saved values. `reapplyPersistedSessionState()` (the reboot-restore
+                            // path) already restores all three. The watcher flag has to be set before
+                            // `setupSessionListeners()` below, which reads it to decide whether to start one.
+                            if (savedState.color)
+                                session.setColor(savedState.color);
+                            if (savedState.pinned)
+                                session.restorePin(true, savedState.pinnedAt);
+                            if (savedState.imageWatcherEnabled !== undefined) {
+                                session.imageWatcherEnabled = savedState.imageWatcherEnabled;
+                            }
                             // Respawn controller (not supported for external-CLI sessions)
                             if (!isExternalCliMode(session.mode) && savedState.respawnEnabled && savedState.respawnConfig) {
                                 try {