aicodeman 1.41.1 → 1.43.0

package/dist/web/routes/session-routes.js

@@ -10,6 +10,7 @@ import { execFile } from 'node:child_process';
 import fs from 'node:fs/promises';
 import { finished } from 'node:stream/promises';
 import { randomBytes, randomUUID } from 'node:crypto';
+import { isUtf8 } from 'node:buffer';
 import { performance } from 'node:perf_hooks';
 import { ApiErrorCode, createErrorResponse, getErrorMessage, } from '../../types.js';
 import { Session, cliTakesSessionModel, isAltScreenStripMode, isExternalCliMode, isMuxAltScreenOnlyStripMode, isMuxMouseStripMode, } from '../../session.js';
@@ -51,12 +52,13 @@ import { dataPath, getDataDir } from '../../config/instance.js';
 import { checkRemoteTmuxAvailable, readRemoteCases, readRemoteHosts, rehydrateRemoteHostFields, toAttachedSessionRemote, toSessionRemote, } from '../../remote-hosts.js';
 import { fetchRemoteScrollback } from '../../remote-pane-history.js';
 import { checkDockerAvailable, checkDockerConfigDrift, probeAdoptableContainer, checkDockerTmuxAvailable, ensureAgentBaseImage, DEFAULT_AGENT_IMAGE, persistDockerCaseClaudeSessionId, readDockerCases, readDockerHosts, toSessionDocker, } from '../../docker-hosts.js';
+import { resolveCaseRepository, resolveManagedWorktree } from '../../git-worktrees.js';
 import { LRUMap } from '../../utils/lru-map.js';
 import { describeUnknownPath, probePathKind } from '../../utils/index.js';
 import { findLatestOmpSessionId } from '../../utils/omp-session-resolver.js';
 import { scanOmpSessionsHistory } from '../../omp-transcript.js';
 import { scanCodexSessionsHistory, codexThreadBySessionId } from '../../codex-transcript.js';
-import { getLastTranscriptResponse, isExternalCliTranscriptMode, parseExternalCliTranscript, selectLastAnsweredTurn, } from '../response-viewer-transcript.js';
+import { transcriptNeedsScreenCapture, getLastTranscriptResponse, isExternalCliTranscriptMode, parseExternalCliTranscript, selectLastAnsweredTurn, } from '../response-viewer-transcript.js';
 import { readDeepSeekLastResponse } from '../../deepseek-transcript.js';
 import { appendClaudeCustomTitle } from '../../claude-session-title.js';
 import { UPLOADS_DIR } from '../paste-image-gc.js';
@@ -183,19 +185,53 @@ export function stripInkRedrawBloat(buffer) {
     return parts.join('');
 }
 /**
- * Validate image bytes against a declared extension. Sniffs the first ~12 bytes
- * for a known magic-number signature. Defends against polyglots (e.g. HTML or
- * SVG disguised under a `Content-Type: image/png` header) and against simple
- * extension-only spoofing — both the multipart filename and the Content-Type
- * are attacker-controlled, the raw bytes are not.
+ * The text half of the document allowlist: these are judged on their encoding
+ * (valid UTF-8, no NUL byte) rather than on a signature, since plain text has none.
+ */
+const TEXT_UPLOAD_EXTS = new Set(['.txt', '.md', '.csv', '.tsv', '.json', '.log', '.yaml', '.yml', '.xml']);
+/**
+ * Documents a user hands an agent to read: the office formats plus the text
+ * family. Curated on purpose, never SUPPORTED_ATTACHMENT_EXTENSIONS or
+ * EDITABLE_EXTENSIONS, which carry sh/py/js/html; a prompt upload is a thing
+ * to read, not a thing to run or serve. Each is judged on its bytes by
+ * imageMagicMatchesExt (signature, or UTF-8 without NUL for text). The browser
+ * keeps its own copies (test/upload-document-list-parity.test.ts pins them).
+ */
+export const ALLOWED_DOCUMENT_EXTS = new Set([
+    '.pdf',
+    '.docx',
+    '.pptx',
+    '.xlsx',
+    '.zip',
+    ...TEXT_UPLOAD_EXTS,
+]);
+/**
+ * Validate upload bytes against a declared extension. Sniffs the first ~12 bytes
+ * for a known magic-number signature (a text file is instead required to be
+ * UTF-8 without a NUL byte, the one check plain text allows). Defends against
+ * polyglots (e.g. HTML or SVG disguised under a `Content-Type: image/png`
+ * header) and against simple extension-only spoofing — both the multipart
+ * filename and the Content-Type are attacker-controlled, the raw bytes are not.
+ * Fail-closed: an extension this function does not know is never a match.
  *
  * Signatures: https://en.wikipedia.org/wiki/List_of_file_signatures
  */
 export function imageMagicMatchesExt(data, ext) {
+    if (TEXT_UPLOAD_EXTS.has(ext))
+        return data.length > 0 && !data.includes(0) && isUtf8(data);
     if (data.length < 12)
         return false;
     const u32be = (off) => data.readUInt32BE(off);
     switch (ext) {
+        case '.pdf':
+            // "%PDF-"
+            return u32be(0) === 0x25504446 && data[4] === 0x2d;
+        case '.docx':
+        case '.pptx':
+        case '.xlsx':
+        case '.zip':
+            // PK\x03\x04, the local-file header every non-empty zip (OOXML included) opens with
+            return u32be(0) === 0x504b0304;
         case '.png':
             return u32be(0) === 0x89504e47 && u32be(4) === 0x0d0a1a0a;
         case '.jpg':
@@ -294,11 +330,26 @@ async function ensureUploadDir(workingDir) {
     }
     return uploadDir;
 }
+/**
+ * The part of an uploaded document's name that survives into the saved name,
+ * so `Q3 report (final).pdf` is findable as `paste-<ts>-<hex>-Q3-report-final.pdf`.
+ * Only `[A-Za-z0-9._-]` survive, runs of anything else become one `-`, and the
+ * result is capped at 40 chars; nothing in it can be a path separator or a
+ * second extension that matters (the allowlisted extension is appended after).
+ */
+function sanitizeUploadStem(filename) {
+    const stem = basename(filename).replace(/\.[^.]*$/, '');
+    return stem
+        .replace(/[^A-Za-z0-9._-]+/g, '-')
+        .replace(/^[-.]+|[-.]+$/g, '')
+        .slice(0, 40);
+}
 /** Open a fresh, uniquely named paste file for writing. */
-async function openPasteFile(imageDir, ext) {
+async function openPasteFile(imageDir, ext, stem = '') {
     // Date.now() collides on same-ms uploads from two tabs (last-write wins
     // silently). Append 8 hex chars so concurrent pastes get distinct names.
-    const filename = `paste-${Date.now()}-${randomBytes(4).toString('hex')}${ext}`;
+    // The `paste-` prefix is what the GC (paste-image-gc.ts) matches on.
+    const filename = `paste-${Date.now()}-${randomBytes(4).toString('hex')}${stem ? `-${stem}` : ''}${ext}`;
     const filepath = join(imageDir, filename);
     // O_EXCL: refuse to overwrite (collision is impossible with random suffix,
     // but defends against TOCTOU). O_NOFOLLOW: refuse if filepath is a symlink.
@@ -421,7 +472,7 @@ async function clampExternalCliBypassForOwner(owner, configs) {
  * named individually, so `privilegedParams` on anything outside that list was declared but
  * unreachable.
  */
-export async function _clampExternalCliBypassForOwner(owner, codexConfig, geminiConfig, antigravityConfig, piConfig, grokConfig, deepSeekConfig) {
+export async function _clampExternalCliBypassForOwner(owner, codexConfig, geminiConfig, antigravityConfig, piConfig, grokConfig, deepSeekConfig, copilotConfig) {
     const out = await clampExternalCliBypassForOwner(owner, {
         codexConfig,
         geminiConfig,
@@ -429,6 +480,7 @@ export async function _clampExternalCliBypassForOwner(owner, codexConfig, gemini
         piConfig,
         grokConfig,
         deepSeekConfig,
+        copilotConfig,
     });
     return out;
 }
@@ -505,6 +557,23 @@ function currentSignalFor(session, dead) {
         return 'exit';
     return signalForStatus(session.status);
 }
+/**
+ * `currentSignalFor`, answering `blocked` for a session whose pane is showing a dialog
+ * its CLI is blocked on (`Session.screenBlocked`, read off the screen for a CLI with no
+ * hook: codex) when the caller asked for it. A hook-raised `blocked` is an edge with no
+ * history, but this one is a level the server is still looking at, so a caller that
+ * asks after the dialog appeared is answered at once instead of waiting out its timeout
+ * for an edge that already passed. Only when `blocked` was asked for: such a pane is also
+ * `idle`, and a caller that asked for `idle` alone must keep getting `idle`. Used by
+ * `GET .../wait` and by a DUPLICATE send-and-wait, every place a wait answers from the
+ * session's current state.
+ */
+function currentSignalForWait(session, dead, until) {
+    const signal = currentSignalFor(session, dead);
+    if (signal !== 'exit' && session.screenBlocked && until.includes('blocked'))
+        return 'blocked';
+    return signal;
+}
 // ── Worker liveness for tmux-backed sessions ────────────────────────────────
 //
 // `session.pid` is the LOCAL `tmux attach` client, not the worker. Codeman sets
@@ -1050,7 +1119,7 @@ options = {}) {
         // Section 6.3: force non-granted users to a classifier-guarded mode.
         const effectiveClaudeMode = await resolveClaudeModeForUsername(claudeModeConfig.claudeMode, owner);
         // Section 6.3: clamp Codex/Gemini/Antigravity bypass switches for a non-granted owner (no-op single-user/granted).
-        const { codexConfig: gatedCodexConfig, geminiConfig: gatedGeminiConfig, antigravityConfig: gatedAntigravityConfig, piConfig: gatedPiConfig, grokConfig: gatedGrokConfig, deepSeekConfig: gatedDeepSeekConfig, } = await _clampExternalCliBypassForOwner(owner, launchBody.codexConfig, launchBody.geminiConfig, launchBody.antigravityConfig, launchBody.piConfig, launchBody.grokConfig, launchBody.deepSeekConfig);
+        const { codexConfig: gatedCodexConfig, geminiConfig: gatedGeminiConfig, antigravityConfig: gatedAntigravityConfig, piConfig: gatedPiConfig, grokConfig: gatedGrokConfig, deepSeekConfig: gatedDeepSeekConfig, copilotConfig: gatedCopilotConfig, } = await _clampExternalCliBypassForOwner(owner, launchBody.codexConfig, launchBody.geminiConfig, launchBody.antigravityConfig, launchBody.piConfig, launchBody.grokConfig, launchBody.deepSeekConfig, launchBody.copilotConfig);
         const terminalHistoryConfig = await ctx.getTerminalHistoryConfig();
         const session = new Session({
             workingDir,
@@ -1068,6 +1137,7 @@ options = {}) {
             antigravityConfig: mode === 'antigravity' ? gatedAntigravityConfig : undefined,
             piConfig: mode === 'pi' ? gatedPiConfig : undefined,
             grokConfig: mode === 'grok' ? gatedGrokConfig : undefined,
+            copilotConfig: mode === 'copilot' ? gatedCopilotConfig : undefined,
             deepSeekConfig: mode === 'deepseek' ? gatedDeepSeekConfig : undefined,
             ompConfig: resolveOmpConfigForCreate(mode, workingDir, launchBody.ompConfig),
             resumeSessionId: validatedResumeId,
@@ -1646,7 +1716,9 @@ options = {}) {
                     // A DUPLICATE has no new turn coming, so it answers from the current state
                     // instead of blocking for a transition that already happened.
                     requireTransition: !duplicate,
-                    currentSignal: duplicate ? currentSignalFor(session, workerDead) : undefined,
+                    // The `...ForWait` variant, as on GET .../wait: a screen-read dialog the first
+                    // delivery raised is a level, and a retry asking for `blocked` must find it.
+                    currentSignal: duplicate ? currentSignalForWait(session, workerDead, until) : undefined,
                 });
             }
             catch (err) {
@@ -1663,7 +1735,7 @@ options = {}) {
         }
         const stopDeathWatch = wantsWait ? watchForDeadWorker(ctx.mux, session, id) : () => { };
         // Write input to PTY. Direct write is synchronous; writeViaMux
-        // (tmux send-keys) is fire-and-forget to avoid blocking the HTTP response.
+        // (tmux paste + Enter) is fire-and-forget to avoid blocking the HTTP response.
         // Every write here is `fromUser`: this route carries a person's prompt, or an
         // agent's on their behalf, so it may name the tab (Ralph, respawn, cron and
         // approvals write through the session directly and never say so).
@@ -1685,7 +1757,7 @@ options = {}) {
         // A plain prompt (`<text>\r`) goes through the mux even when the caller did not
         // ask for it: written straight into the pane it arrives as one burst, and Claude
         // Code takes a long burst as a paste whose `\r` becomes a newline, so the prompt
-        // sat unsent (see isPlainPromptInput). The mux path types the text, presses Enter
+        // sat unsent (see isPlainPromptInput). The mux path pastes the text, presses Enter
         // separately and arms the SubmitVerifier. An explicit `useMux: false` keeps the
         // raw write for a caller that really wants it.
         const autoMux = useMux === undefined && isPlainPromptInput(inputStr);
@@ -1833,7 +1905,7 @@ options = {}) {
                 abortSignal: abort.signal,
                 requireTransition: query.fresh === '1' || query.fresh === 'true',
                 // Read BEFORE awaiting: this is the state the caller is asking about.
-                currentSignal: currentSignalFor(session, workerIsDead(ctx.mux, session)),
+                currentSignal: currentSignalForWait(session, workerIsDead(ctx.mux, session), until),
             });
             return {
                 success: true,
@@ -2363,7 +2435,13 @@ options = {}) {
         // where a real rollout file is the better source.
         if (isExternalCliTranscriptMode(session.mode)) {
             const externalQuery = req.query;
-            const blocks = parseExternalCliTranscript(session.terminalBuffer, session.mode);
+            // A repainting full-screen TUI (copilot) streams absolute cursor moves, not lines, so the
+            // buffer cannot be segmented; read the pane's visible screen instead, and fall back to the
+            // buffer when there is no tmux pane to ask (direct PTY, tests).
+            const screen = transcriptNeedsScreenCapture(session.mode) && session.muxName
+                ? (ctx.mux.capturePaneText?.(session.muxName) ?? null)
+                : null;
+            const blocks = parseExternalCliTranscript(screen ?? session.terminalBuffer, session.mode);
             return {
                 text: getLastTranscriptResponse(blocks),
                 timestamp: '',
@@ -3173,7 +3251,7 @@ options = {}) {
         const capMsg = sessionCapacityMessage(ctx.sessions, owner);
         if (capMsg)
             return createErrorResponse(ApiErrorCode.SESSION_BUSY, capMsg);
-        const { caseName = 'testcase', sessionName, mode = 'claude', modelOverride, openCodeConfig, codexConfig, geminiConfig, antigravityConfig, piConfig, grokConfig, deepSeekConfig, ompConfig, envOverrides, effort, advisorModel, parentSessionId, agentOrigin, customModel, tabGroupId, } = parseBody(QuickStartSchema, req.body);
+        const { caseName = 'testcase', sessionName, mode = 'claude', modelOverride, openCodeConfig, codexConfig, geminiConfig, antigravityConfig, piConfig, grokConfig, copilotConfig, deepSeekConfig, ompConfig, envOverrides, effort, advisorModel, parentSessionId, agentOrigin, customModel, tabGroupId, worktree, } = parseBody(QuickStartSchema, req.body);
         // Resolved ONCE here: the same value labels a case directory this request creates
         // (agent-case-marker.ts) and draws the tab lineage line on the session below.
         const qsParentSessionId = resolveParentSessionId(ctx, req, parentSessionId, owner);
@@ -3199,6 +3277,13 @@ options = {}) {
         const dockerCase = remoteCase
             ? undefined
             : (await readDockerCases(CODEMAN_CONFIG_DIR)).find((item) => item.name === caseName && canAccessOwned(getAuthUser(req), item.owner));
+        // Worktrees are local only (src/git-worktrees.ts): refused BEFORE a remote host is woken or a
+        // container is touched, since neither branch below could honour it.
+        if (worktree && (remoteCase || dockerCase)) {
+            return createErrorResponse(ApiErrorCode.INVALID_INPUT, remoteCase
+                ? 'worktree is not available for remote (SSH) cases: the repository is on another machine'
+                : 'worktree is not available for Docker cases: git would run on this machine over a workspace the container can write');
+        }
         if (remoteCase) {
             const host = (await readRemoteHosts(CODEMAN_CONFIG_DIR)).find((item) => item.id === remoteCase.hostId);
             if (!host)
@@ -3216,6 +3301,7 @@ options = {}) {
                 antigravityConfig ||
                 piConfig ||
                 grokConfig ||
+                copilotConfig ||
                 deepSeekConfig ||
                 ompConfig ||
                 openCodeConfig ||
@@ -3274,6 +3360,7 @@ options = {}) {
                 antigravityConfig ||
                 piConfig ||
                 grokConfig ||
+                copilotConfig ||
                 deepSeekConfig ||
                 ompConfig ||
                 openCodeConfig ||
@@ -3358,6 +3445,7 @@ options = {}) {
                     antigravityConfig,
                     piConfig,
                     grokConfig,
+                    copilotConfig,
                     deepSeekConfig,
                 }));
                 if (qsLaunchError) {
@@ -3403,6 +3491,28 @@ options = {}) {
         if (localCaseState === 'unknown') {
             return createErrorResponse(ApiErrorCode.OPERATION_FAILED, describeUnknownPath('Case folder', resolvedCasePath, { pastCap: true }));
         }
+        // Where the session runs: the case folder, or one of its git worktrees. A worktree is only
+        // ever USED here (created through POST /api/cases/:name/worktrees), so a case that does not
+        // exist yet is a 404 rather than a scaffold, and the worktree must be a registered, managed
+        // one, every path component a real directory (src/git-worktrees.ts).
+        let workspacePath = resolvedCasePath;
+        if (worktree) {
+            if (localCaseState === 'absent') {
+                return createErrorResponse(ApiErrorCode.NOT_FOUND, `Case "${caseName}" not found`);
+            }
+            if (localCaseState !== 'directory') {
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Case path is not a folder');
+            }
+            const caseRepo = await resolveCaseRepository(resolvedCasePath, {
+                dockerWorkspaces: (await readDockerCases(CODEMAN_CONFIG_DIR)).map((c) => c.hostWorkspacePath).filter(Boolean),
+            });
+            if (!caseRepo.ok)
+                return createErrorResponse(ApiErrorCode[caseRepo.code], caseRepo.message);
+            const managed = await resolveManagedWorktree(caseRepo.repo, worktree);
+            if (!managed.ok)
+                return createErrorResponse(ApiErrorCode[managed.code], managed.message);
+            workspacePath = managed.path;
+        }
         // Create case folder and CLAUDE.md if it doesn't exist (only for non-linked, non-remote,
         // non-docker cases — docker workspaces are scaffolded in their own block below)
         if (localCaseState === 'absent') {
@@ -3454,10 +3564,10 @@ options = {}) {
             // of its own. Skipped for remote cases — resolvedCasePath is a REMOTE path that
             // doesn't exist on the local filesystem.
             if (getCli(mode)?.capabilities.hooks === 'always') {
-                await applyWorkspaceHooks(resolvedCasePath, await ctx.getWorkspaceHooksEnabled());
+                await applyWorkspaceHooks(workspacePath, await ctx.getWorkspaceHooksEnabled());
             }
             else {
-                await refreshStaleCodemanHooks(resolvedCasePath).catch(() => { });
+                await refreshStaleCodemanHooks(workspacePath).catch(() => { });
             }
         }
         // Agent skill injection (docs/agent-control-plan.md §2): ADD-ONLY on create,
@@ -3468,7 +3578,7 @@ options = {}) {
         // hostWorkspacePath is a real host dir and the skill crosses the bind mount.
         const quickStartSkillDir = agentSkillDir(getCli(mode)?.capabilities);
         if (!remote && quickStartSkillDir && (await ctx.getAgentSkillEnabled())) {
-            await injectAgentSkill(resolvedCasePath, quickStartSkillDir);
+            await injectAgentSkill(workspacePath, quickStartSkillDir);
         }
         // Docker cases: the workspace is a REAL host dir bind-mounted into the container.
         // Scaffold hooks (+ a CLAUDE.md) if MISSING so in-container permission prompts and
@@ -3501,13 +3611,13 @@ options = {}) {
         // docker — the docker workspace is a real host dir, so the settings file crosses
         // the bind mount and the in-container claude reads it). Remote was rejected above.
         if (getCli(mode)?.capabilities.model.source === 'claude-settings-file' && modelOverride !== undefined) {
-            await updateCaseModel(resolvedCasePath, modelOverride || null);
+            await updateCaseModel(workspacePath, modelOverride || null);
         }
         // Strip stale disk entries for keys this request is actively setting (Claude only —
         // see POST /api/sessions for full rationale).
         // Same chain, same replacement as the create path above: byte-identical, drift-proof.
         if (!isExternalCliMode(mode) && !remote && envOverrides && Object.keys(envOverrides).length > 0) {
-            await stripCaseEnvKeys(resolvedCasePath, Object.keys(envOverrides));
+            await stripCaseEnvKeys(workspacePath, Object.keys(envOverrides));
         }
         // Create a new session with the case as working directory
         // Apply global Nice priority config and model config from settings
@@ -3522,6 +3632,7 @@ options = {}) {
             antigravityConfig,
             piConfig,
             grokConfig,
+            copilotConfig,
             deepSeekConfig,
             ompConfig,
         };
@@ -3540,10 +3651,10 @@ options = {}) {
         const qsClaudeModeConfig = await ctx.getClaudeModeConfig();
         const qsEffectiveClaudeMode = await resolveClaudeModeForUsername(qsClaudeModeConfig.claudeMode, owner);
         // Section 6.3: clamp Codex/Gemini/Antigravity bypass switches for a non-granted owner (no-op single-user/granted).
-        const { codexConfig: qsGatedCodexConfig, geminiConfig: qsGatedGeminiConfig, antigravityConfig: qsGatedAntigravityConfig, piConfig: qsGatedPiConfig, grokConfig: qsGatedGrokConfig, deepSeekConfig: qsGatedDeepSeekConfig, } = await _clampExternalCliBypassForOwner(owner, qsLaunchConfigs.codexConfig, qsLaunchConfigs.geminiConfig, qsLaunchConfigs.antigravityConfig, qsLaunchConfigs.piConfig, qsLaunchConfigs.grokConfig, qsLaunchConfigs.deepSeekConfig);
+        const { codexConfig: qsGatedCodexConfig, geminiConfig: qsGatedGeminiConfig, antigravityConfig: qsGatedAntigravityConfig, piConfig: qsGatedPiConfig, grokConfig: qsGatedGrokConfig, deepSeekConfig: qsGatedDeepSeekConfig, copilotConfig: qsGatedCopilotConfig, } = await _clampExternalCliBypassForOwner(owner, qsLaunchConfigs.codexConfig, qsLaunchConfigs.geminiConfig, qsLaunchConfigs.antigravityConfig, qsLaunchConfigs.piConfig, qsLaunchConfigs.grokConfig, qsLaunchConfigs.deepSeekConfig, qsLaunchConfigs.copilotConfig);
         const qsTerminalHistoryConfig = await ctx.getTerminalHistoryConfig();
         const qsGatedEnvOverrides = await clampEnvOverridesForOwner(owner, envOverrides);
-        const qsResolvedOmpConfig = resolveOmpConfigForCreate(mode, resolvedCasePath, qsLaunchOmpConfig);
+        const qsResolvedOmpConfig = resolveOmpConfigForCreate(mode, workspacePath, qsLaunchOmpConfig);
         // Custom Model Endpoint Profiles, applied AT CREATE TIME (docs/custom-model-endpoints-plan.md)
         // rather than via the dedicated restart-in-place route (POST /api/sessions/:id/custom-
         // model, still what an ALREADY-RUNNING session uses to switch later): computing the
@@ -3627,7 +3738,7 @@ options = {}) {
             // with, not a placeholder: `new Session({ id: ... })` accepts an explicit id for
             // exactly this reason.
             qsCustomModelSessionId = randomUUID();
-            const cmApplied = applyCustomModelInjection(cmEntry, cmEndpoint, customModel.modelId, qsCustomModelSessionId, cmContextLength, resolvedCasePath);
+            const cmApplied = applyCustomModelInjection(cmEntry, cmEndpoint, customModel.modelId, qsCustomModelSessionId, cmContextLength, workspacePath);
             if (!cmApplied) {
                 return createErrorResponse(ApiErrorCode.OPERATION_FAILED, `${mode} has no known custom-model mechanism`);
             }
@@ -3659,7 +3770,7 @@ options = {}) {
         }
         const qsSessionOptions = {
             id: qsCustomModelSessionId,
-            workingDir: resolvedCasePath,
+            workingDir: workspacePath,
             name: sessionName ? sessionName.slice(0, MAX_SESSION_NAME_LENGTH) : '',
             mux: ctx.mux,
             useMux: true,
@@ -3675,6 +3786,7 @@ options = {}) {
             antigravityConfig: mode === 'antigravity' ? qsGatedAntigravityConfig : undefined,
             piConfig: mode === 'pi' ? qsGatedPiConfig : undefined,
             grokConfig: mode === 'grok' ? qsGatedGrokConfig : undefined,
+            copilotConfig: mode === 'copilot' ? qsGatedCopilotConfig : undefined,
             deepSeekConfig: mode === 'deepseek' ? qsGatedDeepSeekConfig : undefined,
             ompConfig: qsResolvedOmpConfig,
             envOverrides: qsCustomModelEnvOverrides,
@@ -3716,7 +3828,7 @@ options = {}) {
         // Auto-detect completion phrase from CLAUDE.md BEFORE broadcasting
         // so the initial state already has the phrase configured (only if globally enabled)
         if (getCli(mode)?.capabilities.ralph && !remote && !docker && ctx.store.getConfig().ralphEnabled) {
-            autoConfigureRalph(session, resolvedCasePath, ctx);
+            autoConfigureRalph(session, workspacePath, ctx);
             if (!session.ralphTracker.enabled) {
                 session.ralphTracker.enable();
                 session.ralphTracker.enableAutoEnable(); // Allow re-enabling on restart
@@ -3771,36 +3883,42 @@ options = {}) {
             if (docker && mode === 'claude') {
                 void persistDockerCaseClaudeSessionId(CODEMAN_CONFIG_DIR, docker.containerName, session.claudeSessionId || session.id).catch(() => { });
             }
-            // Save lastUsedCase to settings for TUI/web sync
-            try {
-                const settingsFilePath = SETTINGS_PATH;
-                let settings = {};
+            // Save lastUsedCase to settings for TUI/web sync. It is a key of the server-wide
+            // settings.json, readable by every user through GET /api/settings, so a non-admin's
+            // case name is not written there in multi-user mode (writes are admin-only, like
+            // PUT /api/settings). isAdmin is always true in single-user mode.
+            if (isAdmin(req)) {
                 try {
-                    settings = JSON.parse(await fs.readFile(settingsFilePath, 'utf-8'));
+                    const settingsFilePath = SETTINGS_PATH;
+                    let settings = {};
+                    try {
+                        settings = JSON.parse(await fs.readFile(settingsFilePath, 'utf-8'));
+                    }
+                    catch (err) {
+                        if (err.code !== 'ENOENT')
+                            throw err;
+                    }
+                    settings.lastUsedCase = caseName;
+                    const dir = dirname(settingsFilePath);
+                    if (!existsSync(dir)) {
+                        mkdirSync(dir, { recursive: true });
+                    }
+                    // Use async write to avoid blocking event loop
+                    fs.writeFile(settingsFilePath, JSON.stringify(settings, null, 2)).catch((err) => {
+                        // Non-critical but log for debugging
+                        console.warn('[Server] Failed to save settings (lastUsedCase):', err);
+                    });
                 }
                 catch (err) {
-                    if (err.code !== 'ENOENT')
-                        throw err;
-                }
-                settings.lastUsedCase = caseName;
-                const dir = dirname(settingsFilePath);
-                if (!existsSync(dir)) {
-                    mkdirSync(dir, { recursive: true });
-                }
-                // Use async write to avoid blocking event loop
-                fs.writeFile(settingsFilePath, JSON.stringify(settings, null, 2)).catch((err) => {
                     // Non-critical but log for debugging
-                    console.warn('[Server] Failed to save settings (lastUsedCase):', err);
-                });
-            }
-            catch (err) {
-                // Non-critical but log for debugging
-                console.warn('[Server] Failed to prepare settings update:', err);
+                    console.warn('[Server] Failed to prepare settings update:', err);
+                }
             }
             return {
                 sessionId: session.id,
                 casePath: resolvedCasePath,
                 caseName,
+                ...(worktree ? { worktree, workingDir: workspacePath } : {}),
                 ...(customModel ? { modelSwapInProgress: qsCustomModelSwapInProgress } : {}),
                 ...(tabGroupId ? { tabLayout } : {}),
             };
@@ -4701,6 +4819,20 @@ options = {}) {
         ogg: '.ogv',
     };
     // The per-file size cap (MAX_PASTE_IMAGE_BYTES) is enforced by @fastify/multipart (registered in server.ts).
+    /** Write buffered upload bytes into the session's upload dir. Null: the dir is not a real directory. */
+    async function writeBufferedUpload(workingDir, ext, bytes, stem = '') {
+        const uploadDir = await ensureUploadDir(workingDir);
+        if (!uploadDir)
+            return null;
+        const { filename, filepath, fh } = await openPasteFile(uploadDir, ext, stem);
+        try {
+            await fh.writeFile(bytes);
+        }
+        finally {
+            await fh.close();
+        }
+        return { path: filepath, filename };
+    }
     app.post('/api/sessions/:id/paste-image', async (req, reply) => {
         // CSRF defense: state-changing routes must come from same origin.
         // Cookies are SameSite=lax, multipart/form-data is a "simple" CORS request
@@ -4819,13 +4951,13 @@ options = {}) {
                 reply.code(400);
                 return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Unsupported video type. Allowed: ${[...ALLOWED_VIDEO_EXTS].join(', ')}`);
             }
-            const imageDir = await ensureUploadDir(session.workingDir);
-            if (!imageDir) {
+            const uploadDir = await ensureUploadDir(session.workingDir);
+            if (!uploadDir) {
                 await finished(part.file.resume()).catch(() => { });
                 reply.code(403);
                 return createErrorResponse(ApiErrorCode.INVALID_INPUT, `${UPLOADS_DIR} is not a regular directory`);
             }
-            const { filename, filepath, fh } = await openPasteFile(imageDir, ext);
+            const { filename, filepath, fh } = await openPasteFile(uploadDir, ext);
             // Written as it arrives: a phone video is far too large to buffer the way an
             // image is. The container is judged on the first 12 bytes as soon as they are
             // in, so a mislabeled upload stops touching disk at its first chunk; the rest
@@ -4887,13 +5019,41 @@ options = {}) {
             reply.code(400);
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, 'Empty file');
         }
+        // Dispatch mirrors the client's _promptAttachKind: an image MIME type takes
+        // the image path whatever the name says, a document extension (the MIME a
+        // phone gives a .md is anyone's guess) takes the document branch, anything
+        // else the image path exactly as before, HEIC sniff included. See CLAUDE.md.
+        const origExt = part.filename ? extname(part.filename).toLowerCase() : '';
+        const imageMime = /^image\//i.test(part.mimetype || '');
+        if (!imageMime && ALLOWED_DOCUMENT_EXTS.has(origExt)) {
+            if (!imageMagicMatchesExt(imageBytes, origExt)) {
+                // The first bytes of a text file are user content, so for text the log
+                // names the failure and never the bytes; a signature is safe to print.
+                // A text refusal names the encoding, since an Excel or Notepad export
+                // (UTF-16 with a BOM, or Windows-1252) is not a corrupt file.
+                const isText = TEXT_UPLOAD_EXTS.has(origExt);
+                const bom = imageBytes.length >= 2 ? imageBytes.readUInt16BE(0) : 0;
+                const utf16 = bom === 0xfffe || bom === 0xfeff;
+                const detail = isText
+                    ? `reason=${utf16 ? 'utf16-bom' : imageBytes.includes(0) ? 'nul-byte' : 'not-utf8'}`
+                    : `magic=${imageBytes.subarray(0, 12).toString('hex')}`;
+                console.warn(`[paste-image] document mismatch: filename=${JSON.stringify(part.filename)} mime=${JSON.stringify(part.mimetype)} declaredExt=${origExt} size=${imageBytes.length} ${detail}`);
+                reply.code(415);
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, isText
+                    ? `This ${origExt} file is ${utf16 ? 'UTF-16 text, not UTF-8' : 'not UTF-8 text'}; save it as UTF-8 and attach it again`
+                    : `File bytes do not match declared type ${origExt}`);
+            }
+            const saved = await writeBufferedUpload(session.workingDir, origExt, imageBytes, sanitizeUploadStem(part.filename));
+            if (!saved) {
+                reply.code(403);
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, `${UPLOADS_DIR} is not a regular directory`);
+            }
+            return saved;
+        }
         // Determine extension from filename or Content-Type.
         let ext = '.png';
-        if (part.filename) {
-            const origExt = extname(part.filename).toLowerCase();
-            if (ALLOWED_IMAGE_EXTS.has(origExt))
-                ext = origExt;
-        }
+        if (ALLOWED_IMAGE_EXTS.has(origExt))
+            ext = origExt;
         const mimeMatch = (part.mimetype || '').toLowerCase().match(/^image\/(png|jpeg|jpg|webp|gif|bmp|heic|heif)$/);
         if (mimeMatch) {
             const map = {
@@ -4929,6 +5089,15 @@ options = {}) {
             }
         }
         else if (!imageMagicMatchesExt(imageBytes, ext)) {
+            // A foreign extension with no image MIME (a script, an HTML page, a video
+            // without its flag) was never going to be an image: say so, rather than
+            // the ".png" the default extension would name. Decided only HERE, after
+            // the sniff, so anything the image path ever accepted by its bytes (a
+            // HEIC under a generic name) still is.
+            if (origExt && !ALLOWED_IMAGE_EXTS.has(origExt) && !imageMime) {
+                reply.code(400);
+                return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Unsupported file type: ${origExt}`);
+            }
             // Sniff actual bytes — a polyglot HTML/PNG would otherwise pass and
             // serve back with image/png MIME. Log the real header so format
             // mismatches can be pinned down without a reproduce-and-guess loop. The
@@ -4937,20 +5106,12 @@ options = {}) {
             reply.code(415);
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, `Image bytes do not match declared type ${ext}`);
         }
-        // {workingDir}/.codeman-uploads/, see ensureUploadDir.
-        const imageDir = await ensureUploadDir(session.workingDir);
-        if (!imageDir) {
+        const saved = await writeBufferedUpload(session.workingDir, ext, imageBytes);
+        if (!saved) {
             reply.code(403);
             return createErrorResponse(ApiErrorCode.INVALID_INPUT, `${UPLOADS_DIR} is not a regular directory`);
         }
-        const { filename, filepath, fh } = await openPasteFile(imageDir, ext);
-        try {
-            await fh.writeFile(imageBytes);
-        }
-        finally {
-            await fh.close();
-        }
-        return { path: filepath, filename };
+        return saved;
     });
     // Returned so the server can own the registry's LIFETIME (drop state when a session is
     // cleaned up on any of its paths, resolve in-flight wakes on shutdown). The wake-CAPABLE